Vibe Check MCP

The evidence confines the server to advice, session-rule management, and a dedicated learning log; the security policy says it neither executes commands nor reads arbitrary files. HTTP defaults restrict origins and hosts to loopback and cap request bodies. Prompt forwarding to third-party LLMs, log storage, configuration writes, and network exposure are clearly disclosed. Installer tests support atomic 0600 writes, managed-entry safeguards, backups, and rollback. Dependency auditing, CI security checks, and the Hono override are documented thoroughly, including the important limitation that the override does not propagate to consumers. Deductions apply because no per-operation confirmation is shown before external transmission, learning-log writes, or client configuration changes. Sensitive-data protection relies substantially on avoidance guidance and an optional disable setting, while input sanitization remains roadmap work. Authorship, repository, research, and license attribution are clear; unknown registry identity is not treated as suspicious.

The README, package manifest, CI, and tests are broadly consistent about Node 20, version 2.9.0, transports, and installer behavior. Tests show understandable handling of unsupported Node versions, invalid configuration shapes, and conflicts with unmanaged entries. Deductions apply because no lockfile, complete implementation, or executed results are supplied, so provider and dependency availability cannot be confirmed statically; only Gemini has a described fallback attempt. The headline claim of harmful actions being reduced by 41% is ambiguous against the later approximately 83% to 42% figures, which represent percentage points rather than a 41% relative reduction, and assertions such as fully functional lack runtime evidence here.

The intended users and scenarios are explicit, including coding, ambiguous work, high-risk actions, and long-running workflows. The material clearly bounds the five tools, absence of code execution, lack of built-in HTTP authentication, maintenance status, and unfinished input sanitization and structured output. Trigger guidance is precise: after planning, before major or irreversible actions, with a suggested 10–20% interrupt dosage. Node requirements, environment variables, model overrides, stdio and HTTP, Docker, multiple clients, and operating-system-specific paths are covered in depth, justifying full scores for these criteria.

The README has strong navigation, quick starts, configuration tables, security guidance, tool-selection help, and documentation links. Installation, runtime requirements, client differences, and removal procedures are detailed. Package, MCP, and tool naming are stable in the supplied files; version 2.9.0 is consistent, and the complete MIT text matches the metadata. Limitations are unusually explicit, including maintenance mode, missing authentication, prompt-injection risk, network exposure, and the scope of the dependency override. Deductions apply because the table of contents advertises Usage Examples and FAQ sections that are not present in the supplied README excerpt. The changelog is referenced but absent, while the release workflow only demonstrates tag-based note generation. A maintainer and issue channel are identified, but feature development has ended and the security policy's claimed package.json email is not present in the supplied manifest.

A second-model review layer, per-session rules, and optional learning history provide plausible incremental value over a single-agent workflow, supported by a stated study sample and effect claims. Setup is lightweight and the documentation recommends limiting interrupt frequency. Deductions apply because each check adds another model call without quantified latency, token, or monetary cost. Output usability is the largest weakness: the roadmap states that structured output is not yet implemented, implying the central advice remains free-form and less dependable for downstream machine processing. The referenced paper and underlying evaluation data are not included for static validation.

Versioning, dependencies, security controls, CI commands, and configuration-write behavior are corroborated across the README, security policy, package manifest, workflows, and tests. Atomic writes, backups, file permissions, and conflict handling receive particularly concrete support. Deductions apply because the research paper, architecture documents, changelog, audit output, lockfile, and complete implementation are not supplied, leaving effectiveness, model compatibility, clean-audit, and runtime-safety claims only partly traceable. The roadmap separates future work reasonably well, but marketing phrases such as enterprise-ready, fully functional, and trusted are not consistently distinguished from independently demonstrated facts.