AI Integrations·mcp.vibgrate.com

Your codebase health,
inside every AI assistant

Vibgrate Cloud MCP is the hosted MCP server over your Vibgrate Cloud workspace data. Connect Cursor, Claude, or ChatGPT with one-click OAuth — the same sign-in as Vibgrate Cloud.14 read-only tools for DriftScores, vulnerabilities, upgrade paths, and modernization planning. Scoped, revocable tokens; your ingest DSN stays on the CLI and CI path only.

MCP connection · illustrative

What is the MCP Server?

MCP (Model Context Protocol) is an open standard for connecting AI assistants to external data sources and tools. The Vibgrate Cloud MCP Server is the hosted server at mcp.vibgrate.com. It gives your AI assistant secure access to the scan data and organization catalog in your Vibgrate Cloud workspace — query DriftScores, vulnerabilities, and upgrade guidance, or manage business units, environments, and applications with write scope. You need a Vibgrate Cloud workspace and an OAuth sign-in or access token to connect.

The server is metadata-only: it exposes scores, versions, package names, CVE identifiers, and project structure collected by the Vibgrate CLI. Your source code stays on your machine. How we handle your data covers the one exception — the remediation agent, which clones your repository only when you ask it to write a fix.

Looking for the local, offline server instead? Vibgrate AI Context (vg serve) serves version-correct library docs plus your code map and offline drift to your AI — no account, nothing uploaded. Vibgrate Skills wire it into Claude Code, Cursor, Copilot, and 18 more assistants with one command.

Quick connection

Recommended

Add https://mcp.vibgrate.com in your MCP client and complete OAuth — sign in at the dashboard, pick workspaces and scopes.

MCP endpoint

url

https://mcp.vibgrate.com

Manual token (optional)

header

Authorization: Bearer vtm_YOUR_TOKEN_HERE

Create tokens and copy mcp.json at Settings → Access Tokens

What you can ask your AI assistant

"Which of our repos have the highest DriftScores right now?"

"Show me all high-severity CVEs detected in the last two weeks."

"How has our main branch drift changed over the last 90 days?"

"Which services are still running on Node 16 or earlier?"

"Give me a list of dependencies we should upgrade this sprint."

"Summarize our current codebase health for a board update."

"Which remediation projects are overdue?"

"What's the safest upgrade path from React 17 to React 19?"

"Compare our frontend and backend DriftScores."

"What's the average DriftScore for everything in the Payments business unit?"

"List all applications in Production and their linked repos."

"Show high-risk scans for the Retail division including sub-units."

Authentication

OAuth for MCP clients, dashboard tokens for manual config. Ingest DSNs are for CLI and CI only.

Method	Use case	Credential
OAuth 2.1 + PKCERecommended	Cursor, Claude Desktop, ChatGPT, and other MCP clients	Sign in at the dashboard (email, social, or enterprise SSO via Clerk)
Vibgrate Cloud access token	Manual mcp.json or HTTP clients	vtm_* Bearer token (max 7 days)
Ingest DSN	CLI vg push and CI uploads only	vibgrate+https://… — not accepted on MCP

OAuth flow

Your MCP client discovers metadata at mcp.vibgrate.com and registers via dynamic client registration.
The client opens the OAuth authorize endpoint with PKCE (S256).
You sign in at the dashboard consent screen — same Clerk account as Vibgrate Cloud (email/password, Google, GitHub, or SAML/OIDC enterprise SSO).
You select one or more workspaces and choose vibgrate:read and/or vibgrate:write per workspace.
The client receives an authorization code and exchanges it for access (vtm_*) and refresh (vtr_*) tokens.

Supported redirects: registered https://, ChatGPT allowlist URLs, cursor://, and local http://127.0.0.1:* / http://localhost:*.

Scopes (per workspace)

vibgrate:read
All read-only MCP tools — repos, scans, drift, vulnerabilities, organization catalog list/get, catalog scans and drift summaries, and more
vibgrate:write
submit_feedback, organization catalog create/update/delete and assign/unassign operations, and other write operations

Enterprise SSO is supported on the consent screen via Clerk (SAML/OIDC).

Manual mcp.json

json

{
  "mcpServers": {
    "vibgrate": {
      "type": "http",
      "url": "https://mcp.vibgrate.com",
      "headers": {
        "Authorization": "Bearer vtm_YOUR_TOKEN_HERE"
      }
    }
  }
}

Generate from Settings → Access Tokens — select workspaces and scopes, then copy the snippet for Cursor or Claude Desktop.

MCP endpoints

MCP JSON-RPC
https://mcp.vibgrate.com
OAuth authorization server
https://mcp.vibgrate.com
Protected resource metadata
https://mcp.vibgrate.com/.well-known/oauth-protected-resource
Authorization server metadata
https://mcp.vibgrate.com/.well-known/oauth-authorization-server

Do not use your ingest DSN for MCP

Do not put vibgrate+https://… in Authorization: Bearer — requests return auth/dsn-not-allowed-use-mcp-token.
Do not paste a DSN on the MCP OAuth screen (removed).
CLI ingest DSNs remain under Settings → Workspaces for vg push only.

14 tools across 6 groups

Every published tool is below. They are goal-level, not one per backend call, and all 14 are read-only. Scan and analysis tools use data collected by the Vibgrate CLI. Organization catalog tools manage business units, environments, applications, and portfolio structure — catalog writes require vibgrate:write per workspace.

Integration guides

Step-by-step setup for all major AI platforms.

Adding Vibgrate to Claude Desktop

1
Open Claude Desktop config
Settings → Developer → Edit Config, or edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS).
2
Connect with OAuth (recommended)
Add an HTTP MCP server pointing at https://mcp.vibgrate.com. Claude Desktop will complete OAuth 2.1 + PKCE and send you to the dashboard consent screen to pick workspaces and scopes.
3
Or use a dashboard access token
Create a token under Settings → Access Tokens at dash.vibgrate.com — choose workspaces, vibgrate:read / vibgrate:write per workspace, then copy the mcp.json snippet.

Manual HTTP config