Lexvibe

io.github.marcosnovoPublished by GitHub account marcosnovov1.0.4Updated Oct 24, 2026

One-step legal compliance for vibe-coded apps: privacy, terms, cookie banner and EU AI Act check.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

LexVibe generates privacy policies, terms, cookie-consent snippets and EU AI Act risk checks for web and mobile apps from inside an AI coding assistant.

What you can do
  • Scan a deployed website or a public App Store / Google Play listing for trackers, payments, AI and data collection
  • Generate localized privacy policy, terms of service and AI disclosure drafts in Markdown
  • Classify EU AI Act risk and list obligations with deadlines; look up privacy and AI laws and which ones apply to given markets
  • Return install snippets for the cookie banner and hosted policy links, and verify a deployed page actually serves the snippet
  • Create a LexVibe app through a claim link and poll until the user confirms it
When to use it
Useful when building or shipping a web or mobile app and you want the assistant to draft legal documents, add a cookie banner and check AI Act exposure without reading the law yourself. Also handy for re-checking compliance after adding analytics, payments, auth or AI SDKs.
Requirements
Either the hosted remote endpoint (Streamable HTTP, no auth) or the npm package run with npx, which needs Node.js. LEXVIBE_APP_ID is optional; if unset, tools ask for it. Self-hosting uses LEXVIBE_API_URL, LEXVIBE_CDN_URL and LEXVIBE_EVENTS_URL. Network access to the LexVibe API is required.
Before you install
Some tools write to your project: install_snippet edits one HTML file and make_compliant writes files under /legal and modifies the HTML head. generate_policies and check_website send data to the LexVibe API, and claim_app creates a real app in your LexVibe account once you confirm the link. Each tool call sends an anonymous usage event unless LEXVIBE_TELEMETRY is set to 0 or DO_NOT_TRACK=1. Generated documents are drafts to review, not legal advice.

Installation

In SourceWeft

  1. Open Lexvibe in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.marcosnovo%2Flexvibe/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "lexvibe": {
      "type": "http",
      "url": "https://golexvibe.com/api/mcp"
    }
  }
}

README

@lexvibe/mcp

[lexvibe-mcp MCP server] [lexvibe-mcp MCP server] [Lexvibe MCP server]

LexVibe MCP server — one-step legal compliance for vibe-coded apps (Lovable, Bolt, v0, Next.js, plain HTML). Wire it into your AI assistant (Claude Code, Claude Desktop, Cursor…) and it makes your app "legally ready" without you knowing the law: privacy policy, terms of service, cookie consent banner with real script blocking, and an EU AI Act risk check.

Not using an AI coding tool? The same checks run in the browser: paste your URL into the free website checker — no signup.

Tools

ToolWhat it does
make_compliantOne step: scan → generate docs into /legal → install the banner snippet → classify EU AI Act risk.
check_complianceRead-only readiness report: what was detected, what could be auto-derived, and which human facts are still missing. Run it again after adding any SDK to catch drift.
scan_projectDetect analytics, payments, generative AI, email collection, third parties and platforms (web / iOS / Android).
check_websiteFree, no-signup compliance check of a deployed site by URL: per-vendor signals, recommendations and EU AI Act applicability (the same public checker as /check).
verify_snippetFetch a deployed URL and confirm the cookie-banner snippet is actually live in the served HTML (ok / missing / unknown).
generate_policiesGenerate privacy policy / terms / AI disclosure, localized and tailored per market.
install_snippetInsert the cookie-banner snippet before </head>; for JSX layouts it returns exact instructions instead.
check_ai_actClassify EU AI Act risk and list the applicable obligations with deadlines.
claim_appCreate a REAL app in the user's LexVibe account: returns a link the user opens to sign in and confirm (valid 7 days).
get_claim_statusPoll a claim created with claim_app; once confirmed it returns the real app id, install snippet and policy URL.

Typical use (natural language)

"Make my app legally compliant for the EU and the US."

One make_compliant call: the agent scans the project, writes the localized policies to /legal, installs the cookie-banner snippet in your HTML head and returns the EU AI Act classification plus next steps. You just review and approve.

Draft-first flow: start with check_compliance — it reports what the scan could figure out on its own and returns an agentPrompt your coding agent can answer by reading the repo (company entity, contact email, target markets), so there are no forms to fill.

No app id yet? The agent calls claim_app and hands you a link: open it, sign in and confirm — that creates the real app in your LexVibe account (hosted, auto-updated policies and consent proof linked to you). The agent then picks up the real app id via get_claim_status and replaces any YOUR_APP_ID placeholder automatically.

Keep your policies in sync with your code

Legal documents describe your app as it was when they were generated. Every SDK you add afterwards — payments, analytics, auth, AI — is a processing activity your documents don't cover yet. LexVibe calls this drift, and the MCP server is the sensor that lives inside your AI dev loop: the same assistant that adds the SDK can catch the compliance gap before you deploy.

Paste this standing rule into your assistant's project rules — AGENTS.md (Codex, Gemini CLI and most agents), CLAUDE.md, .cursorrules, .windsurfrules…:

After adding any SDK, analytics, payments, auth or AI integration to this project, run LexVibe's check_compliance tool and follow its recommendation.

When check_compliance reports processing activities that were added after your documents were generated, re-run generate_policies (or make_compliant) so the documents disclose the new processing. The same applies to the deployed site: check_website detects the trackers that actually ship to visitors, so you can catch drift the local scan can't see (scripts injected by a CMS, a tag manager, a no-code platform…). Claimed apps are also watched by LexVibe's other drift sensors (periodic site rechecks and the GitHub integration), and the remote check_website tool additionally returns a drift section for claimed apps comparing the live site against the baseline the documents were generated from.

Agent skill

skills/lexvibe-compliance/SKILL.md is an Agent Skill that tells your coding agent when to use this server (before a deploy, after adding an SDK) and how to report the result honestly. Drop the folder into your agent's skills directory — e.g. .claude/skills/ in Claude Code — next to the MCP server below.

Quickstart

bash
npx -y @lexvibe/mcp   # or build from source: npm run build -w packages/mcp

Claude Code (.mcp.json in your project, or claude mcp add)

json
{  "mcpServers": {    "lexvibe": {      "command": "npx",      "args": ["-y", "@lexvibe/mcp"],      "env": {        "LEXVIBE_APP_ID": "your-app-id"      }    }  }}

Cursor (~/.cursor/mcp.json)

json
{  "mcpServers": {    "lexvibe": {      "command": "npx",      "args": ["-y", "@lexvibe/mcp"],      "env": {        "LEXVIBE_APP_ID": "your-app-id"      }    }  }}

Claude Desktop uses the same mcpServers structure in claude_desktop_config.json.

Codex CLI (~/.codex/config.toml)

Codex is the one client that does not use the mcpServers JSON above — its config is TOML:

bash
codex mcp add lexvibe -- npx -y @lexvibe/mcp

Or by hand:

toml
[mcp_servers.lexvibe]command = "npx"args = ["-y", "@lexvibe/mcp"]env = { LEXVIBE_APP_ID = "YOUR_APP_ID" }

Project-scoped config lives in .codex/config.toml (trusted projects only).

Gemini CLI (~/.gemini/settings.json)

Same mcpServers shape as Cursor. For the remote server use httpUrl, not url: in Gemini CLI url means SSE, and this endpoint speaks Streamable HTTP only, so url fails without saying why.

json
{  "mcpServers": {    "lexvibe": { "httpUrl": "https://golexvibe.com/api/mcp" }  }}

Remote MCP (no install)

Browser-based agents that cannot run local processes — claude.ai / Claude Desktop connectors, ChatGPT connectors — can use the hosted remote server instead (Streamable HTTP, no auth):

https://golexvibe.com/api/mcp

The remote server has no filesystem access, so it exposes the remote-safe subset: check_website, check_store, generate_policies (template-based drafts, capped for anonymous callers), check_ai_act, get_install_snippet, plus claim_app / get_claim_status to create a real app in the user's account. Stdio-only clients can bridge to it with npx -y mcp-remote https://golexvibe.com/api/mcp.

Which integration to use, per platform

PlatformIntegrationHow
Claude Codestdio (or remote)claude mcp add lexvibe -- npx -y @lexvibe/mcp
Cursor / Windsurf / Cline / VS CodestdiomcpServers config with npx -y @lexvibe/mcp
Codex CLIstdio (or remote)codex mcp add lexvibe -- npx -y @lexvibe/mcp
Gemini CLIstdio (or remote)mcpServers in ~/.gemini/settings.json
Zedstdio (or remote)context_servers in settings.json
Claude Desktop / claude.airemoteSettings → Connectors → https://golexvibe.com/api/mcp
ChatGPTremoteSettings → Connectors → https://golexvibe.com/api/mcp
Lovable / Bolt / v0 / Base44 / Replitprompt (no MCP)Paste the one-liner from https://golexvibe.com/prompt

Full per-platform setup guide: https://golexvibe.com/docs/integrations

Configuration

VariableDefaultPurpose
LEXVIBE_APP_IDYOUR_APP_IDYour LexVibe app id (links the snippet to your hosted policies)
LEXVIBE_API_URLhttps://golexvibe.comLexVibe instance that generates documents and classifies AI risk
LEXVIBE_CDN_URLhttps://golexvibe.comHost the widget script is served from (self-hosting only)
LEXVIBE_EVENTS_URLLexVibe events endpointOverride where anonymous tool-usage events are sent (self-hosting)
LEXVIBE_TELEMETRY1Set to 0 / false / off to disable usage telemetry

Usage analytics

Each tool call sends one anonymous mcp_tool_call event to LexVibe so your MCP usage shows up alongside your website in the Platform analytics dashboard (same event the hosted remote server already records, tagged source: "mcp_stdio" so the two channels are distinguishable).

  • Anonymous. The event carries only the tool name, the package version and — only when LEXVIBE_APP_ID is a real app id (a valid UUID) — that app id, so the events map to your app. Placeholders like your-app-id are ignored. Never your file paths, file contents, app name, emails or generated documents.
  • Non-blocking. It's fire-and-forget with a 3s timeout: it never delays, breaks or fails a tool call, even offline.
  • Opt-out. Set LEXVIBE_TELEMETRY=0 (or the de-facto DO_NOT_TRACK=1) to turn it off completely.

Side effects: scan_project, check_compliance, check_website, verify_snippet, check_ai_act and get_claim_status are read-only (check_website, the AI Act check and the claim poll call the LexVibe API; verify_snippet fetches the URL you pass it — public http(s) hosts only, with the same anti-SSRF validation the platform uses). generate_policies calls the API and returns Markdown. install_snippet edits one file on your local filesystem (only when it contains </head>). make_compliant does both: it calls the API and writes files (/legal/*.md plus the snippet in your HTML head). claim_app creates a pending claim in LexVibe; the app itself is only created when the user confirms the link while signed in.

Learn more

  • LexVibe — hosted legal documents and a cookie banner with real script blocking, for web and mobile apps.
  • Free website checker — paste a URL and see which documents and consent your site needs. No signup.
  • Compliance guides — each privacy law applied to the kind of product you built (SaaS, marketplace, mobile app, AI tool). Also in Spanish.
  • Privacy and AI law reference — every framework with its effective date, the rights it grants and its primary sources, also available as an open dataset (CC BY 4.0).
  • Integration guides — setup for Claude, Cursor, Codex, Gemini CLI, ChatGPT, Lovable, Bolt, v0 and more.

Source: README.md at commit ae77568

Tools

10

check_website

Check website compliance

Free legal-compliance check of a public website (no signup). Fetches the URL server-side and detects data processing relevant to compliance — analytics, marketing pixels, payments, generative AI, email collection, third-party sharing — then returns the legal documents and cookie-consent setup the site needs, whether the EU AI Act applies, and suggestedAnswers you can pass straight to generate_policies. Result contract: `fetched` is true only when the page HTML was actually read; when false, `fetchError` says why ("unreachable": the URL could not be resolved or connected; "blocked": the server answered with an error status) and the detected signals are NOT meaningful — report the check as inconclusive, not as clean. Run it again after adding any SDK, analytics, payment, auth or AI integration: when an appId is passed (or read from the installed LexVibe snippet) the result ALWAYS includes a `drift` key — status "in_sync", "outdated" (listing processing the hosted legal documents don't cover yet) or "unavailable" with a bounded `reason` (no-database, app-not-found, no-baseline, domain-mismatch, page-not-fetched) when the comparison could not be made; treat "unavailable" as unknown, never as in sync. Read-only.

ParametersurlrequiredappId

check_store

Check app-store listing compliance

Free legal-compliance check of a mobile app from its PUBLIC App Store (apps.apple.com) or Google Play (play.google.com) listing URL — no repo or developer-account access needed. Follows the privacy-policy link the developer declared on the listing, analyzes that page, and returns detected data processing, compliance recommendations, whether the EU AI Act applies, and suggestedAnswers for generate_policies. Read-only.

Parametersurlrequired

generate_policies

Generate legal documents

Generate the legal documents (privacy policy, terms of service and, if applicable, an AI disclosure) localized and tailored to the target markets (GDPR, UK GDPR, CCPA…). Returns Markdown drafts. Pass check_website's or check_store's suggestedAnswers as `answers` so the documents disclose the right processing. Anonymous remote generation is template-based and capped at 3 locales; AI-tailored, hosted and auto-updated documents require a LexVibe account (https://golexvibe.com).

ParametersentityanswersappNamerequiredlocalesmarketsrequiredcontactEmail

check_ai_act

Classify EU AI Act risk

Classify a product's risk level under the EU AI Act — minimal, limited, high or prohibited — and return the applicable obligations, each with its compliance deadline (limited-risk transparency duties apply from Aug 2, 2026; Annex III high risk from Dec 2, 2027). The boolean parameters fall into three groups, all optional and defaulting to the safest 'not applicable' value: (1) transparency triggers — usesAI, interactsWithPeople, generatesContent, automatedDecisions; (2) the eight prohibited practices of art. 5 — socialScoring, realtimeBiometricPublic + realtimeBiometricLawEnforcement, emotionRecognitionWorkEducation, biometricCategorisationSensitive, untargetedFaceScraping, manipulativeOrExploitative, individualPredictivePolicing; (3) high-risk triggers — embeddedInRegulatedProduct, annexIII domains. Answer the boolean questions about what the system does; leave unknowns at their defaults, which never over-report risk. Read-only and instant.

ParametersusesAIannexIIIsocialScoringgeneratesContentautomatedDecisionsinteractsWithPeopleuntargetedFaceScrapingrealtimeBiometricPublicembeddedInRegulatedProductmanipulativeOrExploitativeindividualPredictivePolicingemotionRecognitionWorkEducation+2 more

get_install_snippet

Get install snippet

Return what to install for a LexVibe app id. For web: the one-line <script> snippet (cookie banner with real script blocking + hosted policy links) to paste before </head>, plus a JSX variant for React/Next.js layouts. For iOS/Android: the hosted privacy-policy URL and the exact App Store Connect / Google Play Console fields to paste it into. No app id yet? Call claim_app to create one in the user's account.

ParametersappIdrequiredaccentplatform

claim_app

Claim a real LexVibe app

Create a REAL LexVibe app in the user's account (replaces any YOUR_APP_ID placeholder). Returns a claim link: show it to the user so they can sign in and confirm — the link stays valid for 7 days, so the user can open it later. On confirmation LexVibe creates the app, scans the URL (if given), generates and hosts the legal documents. After the user confirms, call get_claim_status with the returned code to retrieve the real app id and install snippet. Provide at least `url` or `appName`.

ParametersurlaiActanswersappNamemarketsplatform

get_claim_status

Get claim status

Check whether the user has confirmed a claim created with claim_app. While the user hasn't confirmed yet it returns {status: 'pending'} — wait a few seconds and call again (the link stays valid for 7 days). Once claimed it returns the REAL app id, the install snippet and the hosted privacy-policy URL: replace any placeholder (YOUR_APP_ID) snippet with the real one.

Parameterscoderequired

lookup_framework

Look up a privacy or AI framework

Look up a privacy or AI law by id and get structured, primary-sourced facts: full name, jurisdiction, effective date, applicability threshold, the documents it requires, the rights it grants, its cookie-consent regime, whether it requires honouring Global Privacy Control, key articles, and a link to the OFFICIAL text (plus the supervisory authority). Use it to answer 'what does the TDPSA require?' or 'when does the EU AI Act apply?' with citations instead of guesses. Call list_frameworks first if you don't know the id. Read-only, instant, no signup.

Parametersidrequired

list_frameworks

List the frameworks LexVibe tracks

List every privacy and AI framework LexVibe generates documents against — 55 laws across 46 jurisdictions, including GDPR, ePrivacy, the EU AI Act, UK GDPR and PECR, Swiss nFADP, 17 US state privacy laws modelled individually (CCPA/CPRA among them), PIPEDA and Quebec Law 25, LGPD and other LatAm regimes, APPI, PIPA, PDPA, Australia's Privacy Act, India's DPDP, China's PIPL, Saudi and UAE PDPL, POPIA and more. Each entry carries its id, jurisdiction, effective date and official-text URL. Optionally filter by market pack or by jurisdiction. Read-only, instant.

Parametersmarketjurisdiction

applicable_frameworks

Which laws apply to my markets

Given the markets a product serves, return every framework that applies, the documents it must publish, the strictest cookie-consent regime across those markets, and whether a universal opt-out signal (Global Privacy Control) has to be honoured. This is the read-only version of what generate_policies uses internally, so the answer matches the documents LexVibe would actually produce. Use it to answer 'I sell to the EU and Texas — what do I need?'. Read-only, instant.

Parametersmarketsrequired

Version history

2
  1. v1.0.4LatestOct 18, 2026
  2. v1.0.3Sep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts