VibeShift Web Tester MCP Server

If you already use VibeShift Web Tester, the vibeshift web tester mcp server is the piece that lets your assistant work with it directly. [MCP Server] The Security Agent for AI assisted coding.

What the server does

1. Automatically Analyze AI-Generated Code: As code is generated or modified by an AI assistant, VibeShift can be triggered to perform security analysis using a suite of tools (SAST, DAST components) and AI-driven checks. 2. Identify Security Vulnerabilities: Pinpoints common and complex vulnerabilities (e.g., XSS, SQLi, insecure configurations, logic flaws) within the AI-generated snippets or larger code blocks. 3. Facilitate AI-Driven Remediation: Provides detailed feedback and vulnerability information directly to the AI coding assistant, enabling it to suggest or even automatically apply fixes.

• MCP Integration: — Seamlessly integrates with Cursor/Windsurf/Github Copilot/Roo Code
• Automated Security Scanning: — Triggers on AI code generation/modification to perform:
• Static Code Analysis (SAST): — Integrates tools like Semgrep to find vulnerabilities in source code
• Dynamic Analysis (DAST Primitives): — Can invoke tools like Nuclei or ZAP for checks against running components (where applicable)
• AI-Assisted Test Recording: — Generate Playwright-based test scripts from natural language descriptions (in automated mode)
• Deterministic Test Execution: — Run recorded JSON test files reliably using Playwright

Installation

mcp on PyPI is all you need. Most clients run it directly, so configuration is a few lines and a restart.

Available tools

The toolset is worth reading before you wire it up, because it tells you what the integration is really for:

• Prerequisites — The Prerequisites tool exposed by this server
• Installation — 1. Clone the repository: bash git clone https://github.com/GroundNG/VibeShift cd VibeShift 2. Create a virtual environment (recommended):
• Configuration — 1. Rename the .env.example to .env file in the project root directory. 2. Add your LLM API key and other necessary details: dotenv # .env

Credentials and setup notes

Configuration is passed through the environment: LLM_API_KEY, YOUR_LLM_API_KEY. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.

• Python 3.10+ * Access to any LLM (gemini 2.0 flash works best for free in my testing) * MCP installed (pip install mcp[cli]) * Playwright browsers installed (patchright install)

Worth knowing first

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
• Keep per-call confirmation enabled while you learn its behaviour; it is the cheapest safeguard you have.

Where it fits

Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. VibeShift Web Tester's toolset — Prerequisites, Installation, Configuration — is a fair guide to whether it matches your workflow. It is maintained by Ilikepizza2; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.