Developers

Let your assistant check your site.

Ask Claude, ChatGPT, Cursor or Copilot to check your site, and it runs the vibeship quick check itself and shows you the result. Free, no account, no key.

Last updated 25 October 2026

What your assistant gets

One address, https://vibeship.eu/mcp, speaking the Model Context Protocol over Streamable HTTP (revision 2026-07-28, and the 2025 revisions most clients still use). No sign-in. Three tools:

  • run_free_check(url) starts the quick check of a site, waits for it (about one to two minutes; progress is streamed to clients that ask for it) and returns the result.
  • get_report(audit_id) returns the grade, the score and what it covers, what blocks production, what to do next and what is already in place, one plain-language line per check, and the link to the full report on vibeship.eu.
  • explain_finding(audit_id, check, stack?) says what one check means and how that kind of problem is usually fixed, with concrete steps for Next.js on Vercel, Supabase, Netlify, Cloudflare, Firebase or WordPress.

Your assistant sees exactly what the free result page shows. What exactly was found, where it sits and how to fix each item stays in the full report, which you unlock on vibeship.eu (€19.99 once, or with the subscription: €9.99 a month per site, three months minimum). The tools hand your assistant the link and the offer rather than the details.

Your assistant runs the passive part of the quick check: fifteen of its sixteen checks, everything except the break-in test on the site's forms and links, which sends attack-like input and stays something only you start. Still, only check a site you own or are allowed to have checked. Our scans are best effort: they can miss a weakness or flag one that isn't there. This is advice, not a guarantee, and it doesn't replace a security firm. Every result your assistant gets carries that line, and the terms apply.

Claude Code

claude mcp add --transport http vibeship https://vibeship.eu/mcp

Then ask: "Run a vibeship quick check of my site and fix what you can."

Claude Desktop and claude.ai

Settings → Connectors → Add custom connector. Name it vibeship, paste https://vibeship.eu/mcp as the server address, leave authentication empty.

On an older Claude Desktop without custom connectors, bridge it in claude_desktop_config.json (needs Node.js):

{
  "mcpServers": {
    "vibeship": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://vibeship.eu/mcp"]
    }
  }
}

Cursor

In ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project):

{
  "mcpServers": {
    "vibeship": {
      "url": "https://vibeship.eu/mcp"
    }
  }
}

VS Code (GitHub Copilot agent mode)

In .vscode/mcp.json, or run MCP: Add Server… from the command palette and choose HTTP:

{
  "servers": {
    "vibeship": {
      "type": "http",
      "url": "https://vibeship.eu/mcp"
    }
  }
}

Or from a terminal: code --add-mcp '{"name":"vibeship","type":"http","url":"https://vibeship.eu/mcp"}'

Windsurf

In ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "vibeship": {
      "serverUrl": "https://vibeship.eu/mcp"
    }
  }
}

ChatGPT

As a connector

Settings → Apps & Connectors → Advanced settings → turn on Developer mode, then Create: name vibeship, MCP server URL https://vibeship.eu/mcp, authentication No authentication.

As a custom GPT action

In the GPT editor, Configure → Actions → Import from URL: https://vibeship.eu/openapi.json. Authentication: None. Privacy policy: https://vibeship.eu/privacy.html. The action calls startFreeCheck, then getFreeCheckReport until the run is finished, and explainCheck for one check.

Any other agent: the API

The same three tools as plain HTTP, described in the OpenAPI spec:

# start a quick check; 202 while it runs, 200 when it is done
curl -s -X POST https://vibeship.eu/v1/free-checks \
  -H 'content-type: application/json' \
  -d '{"url": "https://example.com"}'

# the report (wait up to 60 seconds for a run still going)
curl -s 'https://vibeship.eu/v1/free-checks/AUDIT_ID?wait_seconds=60'

# one check, with steps for your stack
curl -s 'https://vibeship.eu/v1/free-checks/AUDIT_ID/checks/security-headers?stack=nextjs-vercel'

The report page itself uses the lower-level POST /v1/audits, GET /v1/audits/{id} and the event stream GET /v1/audits/{id}/events; they are in the spec too.

Limits

  • Only the passive part of the free quick check: fifteen checks from the outside. The break-in test on the site's forms and links sends attack-like input, so an assistant never runs it; the owner can include it by running the quick check on vibeship.eu. The extensive scan and anything behind your login stay on your dashboard, behind sign-in and your confirmation that you own the site.
  • Only public addresses on the standard web ports: nothing private, nothing local, no passwords in the address.
  • Asking about the same address again within ten minutes returns the same run, and a site gets a handful of runs a day, whoever asks, only a couple of them from any one address. Runs and requests are also limited per address and per client; a refused call says when to try again.

Questions

Email support@vibeship.eu. If you find a weakness in the server itself, the security page says how to report it.