Connect Your IDE to VibeDoctor MCP to Monitor AI-Generated Code Live

Fastest Setup - Say One Sentence

Everything further down this page is the manual path. It still works, and it is the right route if your editor has no terminal. But you no longer have to do any of it yourself. Paste this to Claude Code, Codex, or any agent that can read a URL:

connect to vibedoctor using https://vibedoctor.io/mcp/start

That URL does not return a web page. It returns a short set of instructions written for the agent rather than for you. The agent reads your git remote and your git email, registers the repository, installs the MCP server into its own configuration, and starts the first scan when the repository is public. You do not type a single command and you never open the dashboard.

Before it sends anything, the agent shows you the repository and email it will register and waits for your yes. After that you are left with two things to do. Click the link the agent gives you, which connects the repository on GitHub in one click. Then restart the session so the tools load. On a private repository that click is what makes the code readable at all, so nothing is scanned until you do it.

No signup form and no password. The project token lands in your agent's own configuration file, outside the repository. Nothing is written into your codebase unless you say yes to the optional editor hooks or the rule files from vibedoctor_setup.

Why Live Monitoring Beats Scanning After the Fact

A typical vibe-coded workflow looks like this: build fast with AI, ship, then hope nothing breaks. When something does break - a leaked API key, a SQL injection, an N+1 query destroying performance - you find out from a user complaint or a security alert, not from your tools.

VibeDoctor MCP flips that model. Instead of scanning a finished codebase and producing a report, it integrates directly into the code generation loop. Your AI agent validates each file as it writes it, using the checks from VibeDoctor's full scans that work on single files - but in real time, in your editor, before a single line reaches production.

There is a strong case for this approach. Many AI-generated codebases contain at least one critical or high-severity security vulnerability. These are not subtle issues - they include hardcoded credentials, unprotected API routes, and SQL injection in database queries. Most of them were written by AI tools that did not know any better. The MCP integration gives your AI agent the knowledge it was missing.

How VibeDoctor MCP Works

VibeDoctor implements the Model Context Protocol (MCP), the open standard for connecting AI tools to external services. The connection uses Streamable HTTP - the same transport that Cursor, VS Code Copilot, Claude Code, and Windsurf all support natively.

Each project gets a unique MCP token. That token is embedded in a single URL:

https://vibedoctor.io/mcp/YOUR_PROJECT_TOKEN

You add that URL to your IDE's MCP server list. From that point, your AI agent has access to 5 tools:

The architecture is stateless: every request authenticates with your project token, checks your plan's rate limits, runs the relevant scanners on a temporary copy that is deleted when the check finishes, and returns structured findings. Your code is not stored.

Step 1 - Get Your MCP Token

Log in to your VibeDoctor dashboard at app.vibedoctor.io. Open MCP Connect in the menu and copy your project's MCP server URL - it looks like:

https://vibedoctor.io/mcp/a1b2c3d4e5f6...64_hex_chars

This URL is project-specific. Each project has its own token, so the AI agent's context is always scoped to the right codebase. If you need to revoke access, regenerate the token - the old URL becomes invalid immediately.

Step 2 - Add to Your IDE

Pick your IDE below. Each one needs the MCP URL added in a slightly different place.

Cursor

Open Customize in Cursor's sidebar to add a server, or edit the global config file. Enter:

{
  "mcpServers": {
    "vibedoctor": {
      "url": "https://vibedoctor.io/mcp/YOUR_PROJECT_TOKEN"
    }
  }
}

The global file is ~/.cursor/mcp.json. Keep the URL out of a project-level .cursor/mcp.json, since the URL works as a password. The VibeDoctor tools then appear under Available Tools. If they do not, open the Output panel and pick "MCP Logs".

VS Code with GitHub Copilot

Run the MCP: Open User Configuration command. It opens the mcp.json in your VS Code profile, outside the repository, so the token never ends up in git. Add:

{
  "servers": {
    "vibedoctor": {
      "type": "http",
      "url": "https://vibedoctor.io/mcp/YOUR_PROJECT_TOKEN"
    }
  }
}

Start the server when VS Code asks you to trust it. In Copilot Chat, the VibeDoctor tools appear under the Configure Tools button. Keep the URL out of the workspace .vscode/mcp.json: teams commit that file, and the URL works as a password.

Claude Code

Run the following command in your terminal from the project root:

claude mcp add --transport http vibedoctor \
  "https://vibedoctor.io/mcp/YOUR_PROJECT_TOKEN"

This adds it in local scope, which Claude Code stores under your project's entry in ~/.claude.json, outside the repository. Claude Code will pick up the server on the next session start. You can verify it is connected with claude mcp list.

Windsurf

Windsurf is now called Devin Desktop. In the Cascade panel, open the ... (Actions) menu and click Open MCP config file in the MCPs section. The file is ~/.config/devin/mcp_config.json on macOS and Linux and %APPDATA%\devin\mcp_config.json on Windows. Add:

{
  "mcpServers": {
    "vibedoctor": {
      "serverUrl": "https://vibedoctor.io/mcp/YOUR_PROJECT_TOKEN"
    }
  }
}

Save the file. The vibedoctor tools will be available in Cascade conversations, and the MCPs section has a toggle to turn the server on or off.

Step 3 - Generate IDE Instruction Files (Recommended)

Adding the MCP server gives your AI agent the ability to use VibeDoctor tools. But by default, it will not know when to call them. The vibedoctor_setup tool solves this by generating IDE-specific instruction files that tell your AI agent exactly when and how to use each tool automatically.

Once connected, ask your AI agent:

Run vibedoctor_setup for cursor

The tool returns ready-to-create files for your IDE, and your agent creates them. For Cursor that is .cursor/rules/vibedoctor.mdc. For VS Code it is .github/copilot-instructions.md and a scoped instruction file. For Claude Code it is CLAUDE.md and hooks in .claude/settings.json (Stop, UserPromptSubmit and PostToolUse) that call the free vibedoctor_status. For Codex it is AGENTS.md, and for Windsurf .windsurfrules. Cursor, VS Code, Codex and Windsurf also get a small hooks file. For Cursor, VS Code and Windsurf the hook scripts read the project link from a .vibedoctor file at the repository root: add it to .gitignore before it is created, because the link is a credential.

These files contain instructions like:

• Call vibedoctor_status at the start of every coding session
• Call vibedoctor_check with category: "security" after writing auth, API routes, or database queries
• Call vibedoctor_check with category: "imports" after adding new dependencies
• Call vibedoctor_check with category: "performance" after writing loops or I/O code
• Do not mark a task complete without running at least one check on modified files

Once these files exist in your repo, your AI agent is told to validate code without you asking it to, and the hooks add VibeDoctor's project context on their own.

What Gets Checked in Real Time

The vibedoctor_check tool runs the checks that work on single files: the vibe rules, AST security checks for JavaScript and TypeScript, Gitleaks for secrets, OpenGrep rules, and a dependency lookup when you pass a manifest such as package.json. It supports five check categories:

Security (category: "security")

Detects SQL injection via string interpolation, XSS vectors (dangerouslySetInnerHTML, innerHTML), unprotected API routes with no auth middleware, hardcoded credentials, CORS wildcard origins, insecure cookie settings, and eval() usage. These are the checks that matter most when an AI agent is writing auth or database code.

Imports (category: "imports")

Catches hallucinated npm packages - packages that an AI model invented but do not actually exist on npm. This is one of the most common problems with AI-generated code and one of the hardest to spot in a code review. The import checker cross-references your imports against a known-bad package database.

Performance (category: "performance")

Finds await inside Array.map() (sequential instead of parallel), synchronous file I/O in async code, N+1 database query patterns (query inside a loop), and three or more sequential awaits that could be Promise.all().

Structure (category: "structure")

Identifies god files (500+ lines), overly long functions (over 75 lines, or 120 in .tsx/.jsx), empty functions, .then() chains with no .catch(), incomplete implementations (throw new Error('Not implemented')), and mixed async patterns in the same file.

All (category: "all" - default)

Runs all categories at once. Best for general-purpose validation after any significant code change.

Using vibedoctor_status at Session Start

The vibedoctor_status tool is the best way to start any coding session. It pulls from your project's latest scan and returns:

• Overall health score (0-100)
• Per-section scores (Security, Code Quality, Performance, etc.)
• Top findings by severity across the entire project
• File-specific findings if you pass a filePath argument
• Known dismiss patterns (issues you have already reviewed and dismissed)
• Hotspot symbols - functions with the highest finding concentrations
• Remaining MCP calls for the day (free plan) or unlimited status (paid plans)

This gives your AI agent immediate context about what is already wrong in the codebase before it starts generating code. An agent that knows about a pre-existing SQL injection in src/db/queries.ts will not make the same pattern worse.

Asking Questions About Your Codebase

The vibedoctor_ask tool connects to VibeDoctor's Code Intelligence Q&A pipeline. It works after you have at least one code scan with Code Intelligence data. You can ask questions like:

• "What broke in the last scan?" - returns regressions since the previous version
• "What is the riskiest module right now?" - returns modules sorted by finding density
• "What does the auth handler depend on?" - returns blast radius analysis
• "Tell me about src/routes/payments.ts" - returns file-level findings and symbols
• "Is the code getting better or worse over time?" - returns health score trend

The Q&A system classifies your question, retrieves the relevant data from stored snapshots and diffs, and generates a structured answer. Over MCP, each AI-written answer counts against your daily Q&A limit. When the AI does not answer, the question is given back.

Rate Limits by Plan

Calls to vibedoctor_check, vibedoctor_ask and vibedoctor_graph count toward your daily limit; vibedoctor_status and vibedoctor_setup never do. The limit resets at midnight UTC.

vibedoctor_check, vibedoctor_ask and vibedoctor_graph each count as 1 call. Every AI-written vibedoctor_ask answer also counts against the daily Q&A limit shown above.

Revoking Access

If your MCP token is ever compromised or shared accidentally, open MCP Connect in your VibeDoctor dashboard and regenerate the project's URL. This immediately invalidates the old URL. Anyone still using the old token gets a 404 "Invalid MCP token" error. Your scan data and project settings are unaffected - only the token changes.

Because each project has its own token, you can revoke access for one project without affecting any others.

FAQ