Pack local or remote codebases into AI-friendly files that LLMs and coding agents can read or search
Tools
check_website
Free legal-compliance check of a public website (no signup). Fetches the URL server-side and detects data processing relevant to compliance — analytics, marketing pixels, payments, generative AI, email collection, third-party sharing — then returns the legal documents and cookie-consent setup the site needs, whether the EU AI Act applies, and suggestedAnswers you can pass straight to generate_poli
url string · required
Website URL or bare domain, e.g. https://myapp.com or myapp.com.
appId string
Optional LexVibe app id of a claimed app. When provided (or when the page already carries the installed LexVibe snippet), the result includes a drift report comparing the current site against the base
A call is made on an account: it counts against an allowance and the publisher sees it, which is why this one asks who you are first.
96/100
trust score
11
downloads a day
remote
via our gateway
431
downloads in 30d
What it does
LexVibe MCP server — one-step legal compliance for vibe-coded apps: privacy policy, terms of service, cookie consent banner and EU AI Act check from Claude Code, Cursor or any MCP client.
Quickstart
# 1 — sign in once: npx mcprush@latest login
# it asks for a key from mcprush.com/dashboard#access
# 2 — install
npx mcprush@latest add lexvibe/lexvibe-mcp
# 3 — ask your agent for something these tools do
# check_website, check_store, generate_policies and 7 more
Windows PowerShell says 'running scripts is disabled on this system'? Run Set-ExecutionPolicy -Scope CurrentUser RemoteSigned once, or type npx.cmd instead of npx (codex.cmd, gemini.cmd, grok.cmd likewise). PowerShell 7 needs neither.
Lexvibe costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publisher
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine — this server runs on the publisher’s own infrastructure behind our gateway, and what you install is the connection to it.
Claude Codedeclared by this listing
Claude Code has its own MCP command, and the key rides on it as a header — the gateway refuses a call that carries none. Claude Code reads MCPRUSH_KEY each time it connects, so the key stays out of its config: export your key from Access in your shell profile (macOS, Linux), or run setx MCPRUSH_KEY <your key> and open a new terminal (Windows). Or let npx mcprush@latest add lexvibe/lexvibe-mcp write the entry with the key for you; --scope user makes it available in every project.
claude mcp add --transport http --scope user lexvibe-mcp https://mcprush.com/gw/lexvibe-mcp/mcp --header 'Authorization: Bearer ${MCPRUSH_KEY}'Reconnect, or start a new session, and the tools appear in the model’s tool list.
Free to install on mcprush: no card. The gateway still answers a key, so you sign in once — which is also what gives you saved lists, release alerts and a budget cap.
What it writes
One config entry pointing at the gateway. The server itself runs on the publisher’s own infrastructure, so nothing from this listing executes on your machine.
What you approve
10 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
Free legal-compliance check of a public website (no signup). Fetches the URL server-side and detects data processing relevant to compliance — analytics, marketing pixels, payments, generative AI, email collection, third-party sharing — then returns the legal documents and cookie-consent setup the site needs, whether the EU AI Act applies, and suggestedAnswers you can pass straight to generate_poli
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | Website URL or bare domain, e.g. https://myapp.com or myapp.com. |
| appId | string | no | Optional LexVibe app id of a claimed app. When provided (or when the page already carries the installed LexVibe snippet), the result includes a drift report comparing the current site against the base |
Free legal-compliance check of a mobile app from its PUBLIC App Store (apps.apple.com) or Google Play (play.google.com) listing URL — no repo or developer-account access needed. Follows the privacy-policy link the developer declared on the listing, analyzes that page, and returns detected data processing, compliance recommendations, whether the EU AI Act applies, and suggestedAnswers for generate_
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | App Store or Google Play listing URL, e.g. https://apps.apple.com/app/id123456789 or https://play.google.com/store/apps/details?id=com.example.app. |
Generate the legal documents (privacy policy, terms of service and, if applicable, an AI disclosure) localized and tailored to the target markets (GDPR, UK GDPR, CCPA…). Returns Markdown drafts. Pass check_website's or check_store's suggestedAnswers as answers so the documents disclose the right processing. Anonymous remote generation is template-based and capped at 3 locales; AI-tailored, hoste
| Parameter | Type | Required | Notes |
|---|---|---|---|
| appName | string | yes | Public / commercial name of the product. |
| entity | string | no | Data controller / legal entity responsible for the app. |
| contactEmail | string | no | Contact email for privacy requests and data-subject rights. |
| markets | array | yes | Regions where the app has users; determines the legal frameworks covered. |
| locales | array | no | Document languages (max 3 for anonymous callers). Defaults to the languages suggested by the chosen markets. |
| answers | object | no | Compliance flags; pass check_website's suggestedAnswers. Recognized keys: usesAnalytics, processesPayments, usesGenerativeAI, collectsEmails, sharesWithThirdParties, platformType. |
Classify a product's risk level under the EU AI Act — minimal, limited, high or prohibited — and return the applicable obligations, each with its compliance deadline (limited-risk transparency duties apply from Aug 2, 2026; Annex III high risk from Dec 2, 2027). The boolean parameters fall into three groups, all optional and defaulting to the safest 'not applicable' value: (1) transparency trigger
| Parameter | Type | Required | Notes |
|---|---|---|---|
| usesAI | boolean | no | Does the product use AI at all (LLM calls, recommendations, computer vision…)? false ⇒ minimal risk, the AI Act does not apply. |
| interactsWithPeople | boolean | no | Do people interact directly with the AI (chatbot, voice assistant…)? Triggers the art. 50 duty to disclose they are talking to an AI. |
| generatesContent | boolean | no | Does it generate text, images, audio or video shown to users? Triggers the art. 50 duty to label AI-generated content. |
| automatedDecisions | boolean | no | Does it make automated decisions with legal or similarly significant effects on people (credit, hiring, admissions…)? Adds GDPR art. 22 duties; high risk only if an Annex III domain applies. |
| socialScoring | boolean | no | Does it score people's social behavior or traits causing detrimental treatment in unrelated contexts, or disproportionate to the behavior (art. 5.1.c)? Prohibited. A seller rating or fitness points ap |
| realtimeBiometricPublic | boolean | no | Real-time remote biometric identification in publicly accessible spaces (e.g. live face recognition)? High risk (Annex III biometrics) — prohibited only when combined with realtimeBiometricLawEnforcem |
| emotionRecognitionWorkEducation | boolean | no | Does it infer emotions (frustration, attention, mood…) from employees at work or students in education, e.g. to flag disengaged staff or bored students (art. 5.1.f)? Prohibited. Emotion inference on e |
| biometricCategorisationSensitive | boolean | no | Does it use biometric data (face, voice, gait…) to infer sensitive attributes — race, political opinion, religion, trade-union membership, sexual orientation (art. 5.1.g)? Prohibited. Ordinary face-un |
| realtimeBiometricLawEnforcement | boolean | no | Only if realtimeBiometricPublic: is it used FOR LAW ENFORCEMENT purposes? That combination is prohibited under art. 5.1.h and already in force; any other use of public real-time biometric ID is high r |
| untargetedFaceScraping | boolean | no | Does it untargetedly scrape facial images from the internet or CCTV footage to build or expand a face-recognition database (art. 5.1.e)? Prohibited. Matching a user's own consented selfie against thei |
| manipulativeOrExploitative | boolean | no | Does it use subliminal techniques beyond a person's consciousness, or exploit a known vulnerability (age, disability, specific social or economic situation) to materially distort behavior and cause ha |
| individualPredictivePolicing | boolean | no | Predicting an individual's criminal risk based solely on profiling or personality traits (art. 5.1.d)? Prohibited. |
| embeddedInRegulatedProduct | boolean | no | Is the AI a safety component embedded in an Annex I regulated product (toys, machinery, medical devices…)? High risk via art. 6.1, deadline Aug 2, 2028. |
| annexIII | array | no | Annex III high-risk domains that apply. Only these exact values count; anything else is not Annex III and must be left out. |
Return what to install for a LexVibe app id. For web: the one-line <script> snippet (cookie banner with real script blocking + hosted policy links) to paste before </head>, plus a JSX variant for React/Next.js layouts. For iOS/Android: the hosted privacy-policy URL and the exact App Store Connect / Google Play Console fields to paste it into. No app id yet? Call claim_app to create one in the user
| Parameter | Type | Required | Notes |
|---|---|---|---|
| appId | string | yes | LexVibe app id from the dashboard. |
| platform | string | no | Target platform. Defaults to web. |
| accent | string | no | Optional brand color for the banner, as a hex value like #4f46e5. |
Create a REAL LexVibe app in the user's account (replaces any YOUR_APP_ID placeholder). Returns a claim link: show it to the user so they can sign in and confirm — the link stays valid for 7 days, so the user can open it later. On confirmation LexVibe creates the app, scans the URL (if given), generates and hosts the legal documents. After the user confirms, call get_claim_status with the returned
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | no | Public URL of the app: a website URL, or an App Store / Google Play listing URL for a mobile-only product. LexVibe scans whichever kind is provided on confirmation. If you don't have a listing URL yet |
| appName | string | no | App / business name (required if no url is provided). |
| markets | array | no | Regions where the app has users; each market pack cites its own frameworks: eu → GDPR/ePrivacy, uk → UK GDPR/PECR, us → CCPA/CPRA, ca → PIPEDA, latam → LGPD…; 'global' is NOT a union of the others — i |
| answers | object | no | Compliance flags you already know (pass check_website's suggestedAnswers): usesAnalytics, processesPayments, usesGenerativeAI, collectsEmails, sharesWithThirdParties, platformType, companyEntity, cont |
| platform | string | no | Target platform when there is no url to infer it from. |
| aiAct | object | no | If you already ran check_ai_act for this product, pass the SAME answers object here. The EU AI Act classification is then saved against the app on confirmation and shown in the user's dashboard, inste |
Check whether the user has confirmed a claim created with claim_app. While the user hasn't confirmed yet it returns {status: 'pending'} — wait a few seconds and call again (the link stays valid for 7 days). Once claimed it returns the REAL app id, the install snippet and the hosted privacy-policy URL: replace any placeholder (YOUR_APP_ID) snippet with the real one.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| code | string | yes | The claim code returned by claim_app. |
Look up a privacy or AI law by id and get structured, primary-sourced facts: full name, jurisdiction, effective date, applicability threshold, the documents it requires, the rights it grants, its cookie-consent regime, whether it requires honouring Global Privacy Control, key articles, and a link to the OFFICIAL text (plus the supervisory authority). Use it to answer 'what does the TDPSA require?'
| Parameter | Type | Required | Notes |
|---|---|---|---|
| id | string | yes | Framework id, e.g. "gdpr", "eu-ai-act", "ccpa", "tdpsa", "lgpd", "pipl", "dpdp", "popia". Get the full list from list_frameworks. |
List every privacy and AI framework LexVibe generates documents against — 55 laws across 46 jurisdictions, including GDPR, ePrivacy, the EU AI Act, UK GDPR and PECR, Swiss nFADP, 17 US state privacy laws modelled individually (CCPA/CPRA among them), PIPEDA and Quebec Law 25, LGPD and other LatAm regimes, APPI, PIPA, PDPA, Australia's Privacy Act, India's DPDP, China's PIPL, Saudi and UAE PDPL, POP
| Parameter | Type | Required | Notes |
|---|---|---|---|
| market | string | no | Optional market pack to filter by (eu, uk, us, latam, apac…). |
| jurisdiction | string | no | Optional jurisdiction id to filter by, e.g. "us-tx", "br", "eu". |
Given the markets a product serves, return every framework that applies, the documents it must publish, the strictest cookie-consent regime across those markets, and whether a universal opt-out signal (Global Privacy Control) has to be honoured. This is the read-only version of what generate_policies uses internally, so the answer matches the documents LexVibe would actually produce. Use it to ans
| Parameter | Type | Required | Notes |
|---|---|---|---|
| markets | array | yes | Markets the product serves, e.g. ["eu", "us"]. |
Free
$0 forever
- Every tool, no call limit, and mcprush charges nothing
- A buyer key from your dashboard — the gateway refuses a call without one
- Answers through our gateway, so every call is in your log
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install Lexvibe or to call it, and its free tier carries no monthly call limit.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
ATrust score 96 / 100
Release 1.0.4 · scanned 18 Oct 2026
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score100
Client score96
Findings0 threat · 4 capability
Capabilitymoderate
Coveragesource
Verificationrepo
Surface digestc7bddbea82d33f94d4f9f4984e2581cda5daf3b860b59136cbccefabb565f27f
Score vectorthreat 100 → client 96
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | moderate | capability blast radius (moderate) — client exposure if the model is manipulated | −3 |
| verification-discount | repo | publisher verification (public source) — no provenance, but the source is public and inspectable | −1 |
| coverage-honesty | source | inspection depth (source) — how much of the target the scan could see | −0 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
Tool surfaceread
Implementation sourceread
Package metadataread
Live transportnot available
Tools were statically extracted from the published source (10 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| scan_project | no tags | |
| check_compliance | no tags | |
| generate_policies | untrusted-inputexternal-sink | untrusted-input: declares openWorldHint: true (interacts with entities outside the server); external-sink: handler sends an HTTP POST (apiFetch(${API}/api/generate) at dist/index.js:391 |
| install_snippet | state-write | state-write: declares readOnlyHint: false |
| check_ai_act | untrusted-inputexternal-sink | untrusted-input: declares openWorldHint: true (interacts with entities outside the server); external-sink: handler sends an HTTP POST (apiFetch(${API}/api/ai-act/classify) at dist/index.js:587 |
| check_website | untrusted-inputexternal-sink | untrusted-input: declares openWorldHint: true (interacts with entities outside the server); external-sink: handler sends an HTTP POST (apiFetch(${API}/api/check) at dist/index.js:612 |
| verify_snippet | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| make_compliant | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true, handler sends an HTTP POST (apiFetch(${API}/api/generate) at dist/index.js:790, handler sends an HTTP POST (apiFetch(${API}/api/ai-act/classify) at dist/index.js:874 |
| claim_app | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true, handler sends an HTTP POST (apiFetch(${API}/api/claim/start) at dist/index.js:986 |
| get_claim_status | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
flow-1
Untrusted input can drive an external action even though no sensitive source is exposed.
Supply chain and provenance
Integrityfirst-seen
Surface digestc7bddbea82d33f94
Scanned2026-10-18
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
The gateway serves every install the publisher’s current release, so a release cannot be pinned or rolled back to here yet. The history below is for reading; the current release on file is 1.0.4.
1.0.4
18 Oct 2026
latestNo release note was published with this version.
1.0.3
undated
- The version this listing was on when mcprush began following its releases. The registry was not asked when it shipped, so this row carries no date.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish Lexvibe can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.