vibe-check-mcp-server — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Recheck a specific changing behavior of github.com/PV-Bhat/vibe-check-mcp-server: Does maintenance-only lifecycle or model-provider transmission change the fitness for continued tracking?

Reviewed Oct 9, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Review agent planning and avoid reasoning lock-in

What we know

Vibe Check is an AI metacognitive review MCP, currently in maintenance mode.

Maintenance / activity evidence

Vibe Check MCP version v2.5 was released on 2026-09-03.

Tracking evidence observed Oct 9, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Maintenance-only; needs chosen model provider API key; may send review data to model provider; not offline by default. Reported action classes: Send review context to a configured model provider; Persist/update advisory feedback or reflections where configured. Complete write authority is not verified.
Authentication not yet verified.
Maintenance-only project: verify ongoing compatibility before relying on it for critical workflows.

Maintenance-only project: verify ongoing compatibility before relying on it for critical workflows.
Advisory/security review not completed; no safety badge.
Write action classes summarize access risk; tool-level completeness and exact operation names are not independently verified. Do not mark them as confirmed documented write inventory.
Unknown vulnerabilities and provider data handling are not certified by this public tracking review.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

501 repository stars

Stars observed Oct 9, 2026.

Repository total for PV-Bhat/vibe-check-mcp-server.

All limitations / Review context

Does maintenance-only lifecycle or model-provider transmission change the fitness for continued tracking?

No identified material blocker to an accurately qualified public tracking entry in the limited cited evidence. This is not an installation safety certification; product-specific cautions must remain visible.

Maintenance-only project: verify ongoing compatibility before relying on it for critical workflows.
Advisory/security review not completed; no safety badge.
Write action classes summarize access risk; tool-level completeness and exact operation names are not independently verified. Do not mark them as confirmed documented write inventory.
Maintenance-only; needs chosen model provider API key; may send review data to model provider; not offline by default.
Reviewed write actions: Send review context to a configured model provider; Persist/update advisory feedback or reflections where configured
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Inputs may be transmitted to configured model provider; public research should not claim continuous feature development.
Unknown vulnerabilities and provider data handling are not certified by this public tracking review.
Release evidence proves attributable activity, not entire installation or tool-level safety.
Current Discovery source binding and atomic apply must be generated using MCP100 existing pipeline.
exact authentication contract
first-party data processing and retention
data retention and permission scope
Write actions/tool inventory not confirmed against exact tool documentation; listed action classes remain illustrative or context-dependent. Empty inventory does not establish read-only.
Maintenance-only lifecycle; provider key and external model processing need disclosure.
Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode and do not invent unresolved facts.

Original activity observations

Vibe Check MCP version v2.5 was released on 2026-09-03.

Technical identity

github.com/PV-Bhat/vibe-check-mcp-server

Exact implementation source: https://github.com/PV-Bhat/vibe-check-mcp-server ↗
Reviewed resource type: MCP Server
Repository identity: PV-Bhat/vibe-check-mcp-server

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 9, 2026 · Latest source observation Oct 9, 2026

GitHub repository ↗
pv-bhat/vibe-check-mcp-server
Recorded repository material and project history.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 12, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Node.js >=20. Configure MCP stdio launch via the publisher-provided client JSON; a standalone stdio terminal launch alone does not register the MCP.
npx -y @pv-bhat/vibe-check-mcp start --stdio
Configure / authenticate
Publisher instructions
Publisher README includes a complete mcpServers entry for Claude Desktop/Cursor/Windsurf. The npx command is launched by the MCP client over stdio. Restart the client after editing its config.
Advanced configuration · mcpServers json
{ "mcpServers": { "vibe-check-mcp": { "args": [ "-y", "@pv-bhat/vibe-check-mcp", "start", "--stdio" ], "command": "npx" } } }
Check connection
Suggested check
Restart the chosen stdio MCP client and verify vibe-check-mcp tools. For a separate HTTP-mode diagnostic only (NOT stdio registration), launch publisher npx -y @pv-bhat/vibe-check-mcp start --http --port 2091 and request 127.0.0.1:2091/healthz. Do not mistake a healthy HTTP instance for verification of the stdio client entry.
Remove / uninstall / revoke
Publisher instructions
Delete only the `vibe-check-mcp` entry in the relevant MCP configuration (`mcpServers` for Claude/Cursor/Windsurf, `servers` for VS Code), if it is tagged `managedBy: vibe-check-mcp-cli`. Alternatively restore the vendor generated `.bak` after inspecting changes. In the MCP client settings remove only the `mcpServers.vibe-check-mcp` entry and restart/reload. This is a concrete client disconnect, separate from uninstalling the local package.

Official Documentation & Sources

What it does

Vibe Check is an AI metacognitive review MCP, currently in maintenance mode.

Capability: Security & Testing
Resource type: MCP Server
Best fit: Review agent planning and avoid reasoning lock-in

Representative uses

vibe_check
vibe_learn
stdio/http

Limitations

Maintenance-only lifecycle; provider key and external model processing need disclosure.
Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode and do not invent unresolved facts.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Not documented in the reviewed sources
Permissions: Maintenance-only; needs chosen model provider API key; may send review data to model provider; not offline by default.
Data handling: Not documented in the reviewed sources
Cost: unknown
Risk and cautions: Maintenance-only project: verify ongoing compatibility before relying on it for critical workflows.

Access scope and cautions

Write actions: Not verified Send review context to a configured model provider Persist/update advisory feedback or reflections where configured
Risk level: moderate
Security notes: Advisory/security review not completed; no safety badge. Write action classes summarize access risk; tool-level completeness and exact operation names are not independently verified. Do not mark them as confirmed documented write inventory.

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-09. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: vibe_check; vibe_learn; stdio/http.

What connection information is established, and what remains unverified?

A complete connection procedure is not verified. Recorded transport: stdio. Client notes: npx @pv-bhat/vibe-check-mcp doctor; alternatively HTTP /healthz when launched with --http. These facts do not supply missing installation commands, credentials or a verified authentication procedure.

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. The partial inventory lists: Send review context to a configured model provider; Persist/update advisory feedback or reflections where configured. Recorded permission context: Maintenance-only; needs chosen model provider API key; may send review data to model provider; not offline by default.

What limitations and risks should I check before use?

Maintenance-only project: verify ongoing compatibility before relying on it for critical workflows. Maintenance-only lifecycle; provider key and external model processing need disclosure. Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode. Advisory/security review not completed; no safety badge. Write action classes summarize access risk; tool-level completeness and exact operation names are not independently verified. Inputs may be transmitted to configured model provider; continuous feature development is not established. Unknown vulnerabilities and provider data handling are not certified by this public tracking review.