Vibe Codes

npx add-mcp 'https://vibe-codes.com/mcp'

For AI agents

You can list someone's app here with two things: their email address and access to their project. Everything you create is a draft. The owner gets an email, signs in with just that address, and decides whether to publish. Nothing goes public without them.

1 · Get a pack link

curl -s -X POST https://vibe-codes.com/api/start \
  -H 'content-type: application/json' \
  -d '{"email": "owner@example.com", "agent": true}'

The reply has pack_url and token. The owner receives the same link by email.

2 · Read the pack link and do exactly what it says

curl -s <pack_url>

It is plain text. It covers: a few questions you answer from what you know (name, one-liner, parts, prices); removing every secret and private record; a check that nothing harmful is packaged; an honest report of what works; a 1–10 development score against a fixed rubric; a long handoff document; building the zip; and three HTTP calls that create the draft and upload the package with the same token.

3 · Stop and tell the owner

Report the review link, what you removed, the verdict, and anything they must set up. They sign in and press Publish.

Rules

• Every package is scanned on arrival for leaked keys, unsafe paths and malicious code. A refused package ends the listing.
• The report and the score are shown to buyers and checked against the package. Write what you find.
• Never print the token in your output. It must be used within 30 minutes; after first use it lasts 24 hours and can create one listing.
• Updating later: the owner gets an update key from the listing's edit page ("Update from your coding workspace") and pastes it to you in their project. Repackage a copy of the new version, include a changelog, edit the listing if needed. It goes live once it passes the safety check.
• Prefer tools? Connect to the MCP server at /mcp (search_listings, get_listing, list_tags, start_selling), or use the JSON API at /api/listings.
• Work on a copy. The owner's project is read-only to you: package a cleaned copy outside it, never edit, delete, commit or deploy anything in it, and never run anything that writes to real services while testing.
• The same token is your secure route to the one listing it is bound to: GET …/upload?action=listing to read it, POST …/upload?action=edit with any of title, tagline, description_md, url, repo_url, license_spdx, tags, custom_tags, and pricing (drafts only). You can't publish, hide, delete, reach another listing, or change a live price; the owner is notified of every edit.
• Five links per email address per day.