@lexvibe/mcp

LexVibe MCP server — one-step legal compliance for vibe-coded apps (Lovable, Bolt, v0, Next.js, plain HTML). Wire it into your AI assistant (Claude Code, Claude Desktop, Cursor…) and it makes your app "legally ready" without you knowing the law: privacy policy, terms of service, cookie consent banner with real script blocking, and an EU AI Act risk check.

Tools

Typical use (natural language)

"Make my app legally compliant for the EU and the US."

One make_compliant call: the agent scans the project, writes the localized policies to /legal, installs the cookie-banner snippet in your HTML head and returns the EU AI Act classification plus next steps. You just review and approve.

Draft-first flow: start with check_compliance — it reports what the scan could figure out on its own and returns an agentPrompt your coding agent can answer by reading the repo (company entity, contact email, target markets), so there are no forms to fill.

No app id yet? The agent calls claim_app and hands you a link: open it, sign in and confirm — that creates the real app in your LexVibe account (hosted, auto-updated policies and consent proof linked to you). The agent then picks up the real app id via get_claim_status and replaces any YOUR_APP_ID placeholder automatically.

Keep your policies in sync with your code

Legal documents describe your app as it was when they were generated. Every SDK you add afterwards — payments, analytics, auth, AI — is a processing activity your documents don't cover yet. LexVibe calls this drift, and the MCP server is the sensor that lives inside your AI dev loop: the same assistant that adds the SDK can catch the compliance gap before you deploy.

Paste this standing rule into your assistant's project rules — AGENTS.md (Codex, Gemini CLI and most agents), CLAUDE.md, .cursorrules, .windsurfrules…:

After adding any SDK, analytics, payments, auth or AI integration to this project, run LexVibe's check_compliance tool and follow its recommendation.

When check_compliance reports processing activities that were added after your documents were generated, re-run generate_policies (or make_compliant) so the documents disclose the new processing. The same applies to the deployed site: check_website detects the trackers that actually ship to visitors, so you can catch drift the local scan can't see (scripts injected by a CMS, a tag manager, a no-code platform…). Claimed apps are also watched by LexVibe's other drift sensors (periodic site rechecks and the GitHub integration), and the remote check_website tool additionally returns a drift section for claimed apps comparing the live site against the baseline the documents were generated from.

Quickstart

npx -y @lexvibe/mcp   # or build from source: npm run build -w packages/mcp

Claude Code (.mcp.json in your project, or claude mcp add)

{
  "mcpServers": {
    "lexvibe": {
      "command": "npx",
      "args": ["-y", "@lexvibe/mcp"],
      "env": {
        "LEXVIBE_APP_ID": "your-app-id"
      }
    }
  }
}

Cursor (~/.cursor/mcp.json)

{
  "mcpServers": {
    "lexvibe": {
      "command": "npx",
      "args": ["-y", "@lexvibe/mcp"],
      "env": {
        "LEXVIBE_APP_ID": "your-app-id"
      }
    }
  }
}

Claude Desktop uses the same mcpServers structure in claude_desktop_config.json.

Codex CLI (~/.codex/config.toml)

Codex is the one client that does not use the mcpServers JSON above — its config is TOML:

codex mcp add lexvibe -- npx -y @lexvibe/mcp

Or by hand:

[mcp_servers.lexvibe]
command = "npx"
args = ["-y", "@lexvibe/mcp"]
env = { LEXVIBE_APP_ID = "YOUR_APP_ID" }

Project-scoped config lives in .codex/config.toml (trusted projects only).

Gemini CLI (~/.gemini/settings.json)

Same mcpServers shape as Cursor. For the remote server use httpUrl, not url: in Gemini CLI url means SSE, and this endpoint speaks Streamable HTTP only, so url fails without saying why.

{
  "mcpServers": {
    "lexvibe": { "httpUrl": "https://golexvibe.com/api/mcp" }
  }
}

Remote MCP (no install)

Browser-based agents that cannot run local processes — claude.ai / Claude Desktop connectors, ChatGPT connectors — can use the hosted remote server instead (Streamable HTTP, no auth):

https://golexvibe.com/api/mcp

The remote server has no filesystem access, so it exposes the remote-safe subset: check_website, check_store, generate_policies (template-based drafts, capped for anonymous callers), check_ai_act, get_install_snippet, plus claim_app / get_claim_status to create a real app in the user's account. Stdio-only clients can bridge to it with npx -y mcp-remote https://golexvibe.com/api/mcp.

Which integration to use, per platform

Full per-platform setup guide: https://golexvibe.com/docs/integrations

Configuration

Usage analytics

Each tool call sends one anonymous mcp_tool_call event to LexVibe so your MCP usage shows up alongside your website in the Platform analytics dashboard (same event the hosted remote server already records, tagged source: "mcp_stdio" so the two channels are distinguishable).

• Anonymous. The event carries only the tool name, the package version and — only when LEXVIBE_APP_ID is a real app id (a valid UUID) — that app id, so the events map to your app. Placeholders like your-app-id are ignored. Never your file paths, file contents, app name, emails or generated documents.
• Non-blocking. It's fire-and-forget with a 3s timeout: it never delays, breaks or fails a tool call, even offline.
• Opt-out. Set LEXVIBE_TELEMETRY=0 (or the de-facto DO_NOT_TRACK=1) to turn it off completely.

Side effects: scan_project, check_compliance, check_website, verify_snippet, check_ai_act and get_claim_status are read-only (check_website, the AI Act check and the claim poll call the LexVibe API; verify_snippet fetches the URL you pass it — public http(s) hosts only, with the same anti-SSRF validation the platform uses). generate_policies calls the API and returns Markdown. install_snippet edits one file on your local filesystem (only when it contains </head>). make_compliant does both: it calls the API and writes files (/legal/*.md plus the snippet in your HTML head). claim_app creates a pending claim in LexVibe; the app itself is only created when the user confirms the link while signed in.