Vibefilo

Vibefilo provides security and GDPR checks for apps built with AI coding tools. Checks run inside the developer's coding agent through an MCP server, and Vibefilo says only the rule, file, line and a masked snippet reach its service, with secret values never sent. Findings sync to a shared dashboard and close only after a re-check passes.

What It Is

Vibefilo is an MCP-based audit service for vibe-coded applications. It targets recurring gaps such as publicly readable Supabase tables, live Stripe keys in browser bundles, API routes that trust the URL, analytics loading before consent, template privacy policies, and missing account deletion. The site says it understands apps built with Lovable, Bolt, v0, Replit, Cursor or Claude Code, typically on Next.js or Vite with Supabase or Firebase, Stripe, Vercel or Netlify.

How the Workflow Runs

A developer runs npx @vibefilo/mcp init in the project, which detects and connects supported agents. Sign-in is approved with a device code in the browser. The developer then asks the agent to check the app. The agent calls MCP tools such as status, estimate, start audit and submit findings, fixes the issues, and re-checks to verify. Each run is saved as a Markdown report in a vibefilo-scans/ folder in the repo.

Check Depths and Team Dashboard

Three modes are offered: Lite for blocker-level rules on current code and config, Normal for all code-level security and privacy checks plus key accessibility rules, and Full for full depth including git history, live checks, a Ready verdict and a PDF report. Teams can invite members to an organization to see projects, findings and fixes in one dashboard with a readiness score. Vibefilo states its guidance is not legal advice.