Skip to content

io.github.marcosnovo/lexvibe

by marcosnovo · remote · local (npm) · no sign-in to list tools · v1.0.4 · published by GitHub user marcosnovo

One-step legal compliance for vibe-coded apps: privacy, terms, cookie banner and EU AI Act check.

Changes · 7

10 tools: 7 change things and 3 only read.

Scanned Oct 21, 2026

3 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http lexvibe https://golexvibe.com/api/mcp

Findings

Matches of fixed checks, with the text they matched.

3 warn
  • The server marks "check_store" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "check_store" says "store": a word for a change.

    What this check looks for
  • The server marks "generate_policies" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "generate_policies" says "generate": a word for a change.

    What this check looks for
  • The server marks "get_claim_status" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "get_claim_status" says "get": a word for reading.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

10 tools

Changes things 7Claude Code: ask
  • applicable_frameworksGiven the markets a product serves, return every framework that applies, the documents it must publish, the strictest cookie-consent regime across those markets, and whether a univ…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Given the markets a product serves, return every framework that applies, the documents it must publish, the strictest cookie-consent regime across those markets, and whether a universal opt-out signal (Global Privacy Control) has to be honoured. This is the read-only version of what generate_policies uses internally, so the answer matches the documents LexVibe would actually produce. Use it to answer 'I sell to the EU and Texas — what do I need?'. Read-only, instant.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • check_ai_actClassify a product's risk level under the EU AI Act — minimal, limited, high or prohibited — and return the applicable obligations, each with its compliance deadline (limited-risk …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Classify a product's risk level under the EU AI Act — minimal, limited, high or prohibited — and return the applicable obligations, each with its compliance deadline (limited-risk transparency duties apply from Aug 2, 2026; Annex III high risk from Dec 2, 2027). The boolean parameters fall into three groups, all optional and defaulting to the safest 'not applicable' value: (1) transparency triggers — usesAI, interactsWithPeople, generatesContent, automatedDecisions; (2) the eight prohibited practices of art. 5 — socialScoring, realtimeBiometricPublic + realtimeBiometricLawEnforcement, emotionRecognitionWorkEducation, biometricCategorisationSensitive, untargetedFaceScraping, manipulativeOrExploitative, individualPredictivePolicing; (3) high-risk triggers — embeddedInRegulatedProduct, annexIII domains. Answer the boolean questions about what the system does; leave unknowns at their defaults, which never over-report risk. Read-only and instant.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • check_storeFree legal-compliance check of a mobile app from its PUBLIC App Store (apps.apple.com) or Google Play (play.google.com) listing URL — no repo or developer-account access needed.1 finding

    Why it is in this group

    • The name "check_store" says "store": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "check_store" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "check_store" says "store": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Free legal-compliance check of a mobile app from its PUBLIC App Store (apps.apple.com) or Google Play (play.google.com) listing URL — no repo or developer-account access needed. Follows the privacy-policy link the developer declared on the listing, analyzes that page, and returns detected data processing, compliance recommendations, whether the EU AI Act applies, and suggestedAnswers for generate_policies. Read-only.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • check_websiteFree legal-compliance check of a public website (no signup).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Free legal-compliance check of a public website (no signup). Fetches the URL server-side and detects data processing relevant to compliance — analytics, marketing pixels, payments, generative AI, email collection, third-party sharing — then returns the legal documents and cookie-consent setup the site needs, whether the EU AI Act applies, and suggestedAnswers you can pass straight to generate_policies. Result contract: `fetched` is true only when the page HTML was actually read; when false, `fetchError` says why ("unreachable": the URL could not be resolved or connected; "blocked": the server answered with an error status) and the detected signals are NOT meaningful — report the check as inconclusive, not as clean. Run it again after adding any SDK, analytics, payment, auth or AI integration: when an appId is passed (or read from the installed LexVibe snippet) the result ALWAYS includes a `drift` key — status "in_sync", "outdated" (listing processing the hosted legal documents don't cover yet) or "unavailable" with a bounded `reason` (no-database, app-not-found, no-baseline, domain-mismatch, page-not-fetched) when the comparison could not be made; treat "unavailable" as unknown, never as in sync. Read-only.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • claim_appCreate a REAL LexVibe app in the user's account (replaces any YOUR_APP_ID placeholder).No findings

    Why it is in this group

    • The description's first verb is "create": a word for a change.
    Description, as the server wrote it
    Create a REAL LexVibe app in the user's account (replaces any YOUR_APP_ID placeholder). Returns a claim link: show it to the user so they can sign in and confirm — the link stays valid for 7 days, so the user can open it later. On confirmation LexVibe creates the app, scans the URL (if given), generates and hosts the legal documents. After the user confirms, call get_claim_status with the returned code to retrieve the real app id and install snippet. Provide at least `url` or `appName`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
  • generate_policiesGenerate the legal documents (privacy policy, terms of service and, if applicable, an AI disclosure) localized and tailored to the target markets (GDPR, UK GDPR, CCPA…).1 finding

    Why it is in this group

    • The name "generate_policies" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "generate_policies" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "generate_policies" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Generate the legal documents (privacy policy, terms of service and, if applicable, an AI disclosure) localized and tailored to the target markets (GDPR, UK GDPR, CCPA…). Returns Markdown drafts. Pass check_website's or check_store's suggestedAnswers as `answers` so the documents disclose the right processing. Anonymous remote generation is template-based and capped at 3 locales; AI-tailored, hosted and auto-updated documents require a LexVibe account (https://golexvibe.com).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • get_claim_statusCheck whether the user has confirmed a claim created with claim_app.1 finding

    Why it is in this group

    • The name "get_claim_status" says "get": a word for reading.
    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "get_claim_status" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "get_claim_status" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Check whether the user has confirmed a claim created with claim_app. While the user hasn't confirmed yet it returns {status: 'pending'} — wait a few seconds and call again (the link stays valid for 7 days). Once claimed it returns the REAL app id, the install snippet and the hosted privacy-policy URL: replace any placeholder (YOUR_APP_ID) snippet with the real one.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
Only reads 3Claude Code: allow
  • get_install_snippetReturn what to install for a LexVibe app id.No findings

    Why it is in this group

    • The name "get_install_snippet" says "get": a word for reading.
    Description, as the server wrote it
    Return what to install for a LexVibe app id. For web: the one-line <script> snippet (cookie banner with real script blocking + hosted policy links) to paste before </head>, plus a JSX variant for React/Next.js layouts. For iOS/Android: the hosted privacy-policy URL and the exact App Store Connect / Google Play Console fields to paste it into. No app id yet? Call claim_app to create one in the user's account.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • list_frameworksList every privacy and AI framework LexVibe generates documents against — 55 laws across 46 jurisdictions, including GDPR, ePrivacy, the EU AI Act, UK GDPR and PECR, Swiss nFADP, 1…No findings

    Why it is in this group

    • The name "list_frameworks" says "list": a word for reading.
    Description, as the server wrote it
    List every privacy and AI framework LexVibe generates documents against — 55 laws across 46 jurisdictions, including GDPR, ePrivacy, the EU AI Act, UK GDPR and PECR, Swiss nFADP, 17 US state privacy laws modelled individually (CCPA/CPRA among them), PIPEDA and Quebec Law 25, LGPD and other LatAm regimes, APPI, PIPA, PDPA, Australia's Privacy Act, India's DPDP, China's PIPL, Saudi and UAE PDPL, POPIA and more. Each entry carries its id, jurisdiction, effective date and official-text URL. Optionally filter by market pack or by jurisdiction. Read-only, instant.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • lookup_frameworkLook up a privacy or AI law by id and get structured, primary-sourced facts: full name, jurisdiction, effective date, applicability threshold, the documents it requires, the rights…No findings

    Why it is in this group

    • The name "lookup_framework" says "lookup": a word for reading.
    Description, as the server wrote it
    Look up a privacy or AI law by id and get structured, primary-sourced facts: full name, jurisdiction, effective date, applicability threshold, the documents it requires, the rights it grants, its cookie-consent regime, whether it requires honouring Global Privacy Control, key articles, and a link to the OFFICIAL text (plus the supervisory authority). Use it to answer 'what does the TDPSA require?' or 'when does the EU AI Act apply?' with citations instead of guesses. Call list_frameworks first if you don't know the id. Read-only, instant, no signup.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.4. Values in angle brackets are yours to fill in.

claude mcp add --transport http lexvibe https://golexvibe.com/api/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__lexvibe__get_install_snippet",
      "mcp__lexvibe__lookup_framework",
      "mcp__lexvibe__list_frameworks"
    ],
    "ask": [
      "mcp__lexvibe__check_website",
      "mcp__lexvibe__check_store",
      "mcp__lexvibe__generate_policies",
      "mcp__lexvibe__check_ai_act",
      "mcp__lexvibe__claim_app",
      "mcp__lexvibe__get_claim_status",
      "mcp__lexvibe__applicable_frameworks"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as lexvibe. Review it before you use it.