Trust and connector readiness

What VibeLaunch can publish, and what it refuses to fake.

VibeLaunch is a Free Preview service for turning AI-built web apps into live links. This page explains the connector, data handling, and current review posture in plain English.

Written for the curious — and for your developer or your AI to double-check us. You don’t need any of it to publish.

Review packetContact support

Works today

  • Publish single-file HTML apps and multi-file static apps.
  • Attach small image assets to published apps.
  • Check readiness, publish, update, list, inspect, retrieve saved source and saved versions, restore versions, and token-confirm deletion through the MCP connector.
  • Keep building in another AI with connector-generated saved-version handoffs, dashboard handoffs, and dashboard import.
  • Safely update one or a few files with merge mode while preserving the rest of an existing app.
  • Convert supported small React JSX/TSX artifacts and Vite-style React file maps, including common src aliases, shadcn-style helper imports, Tailwind globals, and React Router routing for static hosting.
  • Translate simple Supabase table reads and writes into built-in storage setup.

Guarded instead of guessed

  • Next.js, larger framework bundles, and package.json projects outside the supported React conversion subset return build guidance instead of a broken live page.
  • Complex bundles can be checked without creating a public URL before the assistant calls the publish tool.
  • Missing local files, local-only URLs, and browser-unready package imports are blocked before publishing.
  • Outside services, service workers, and forms without server actions are flagged as warnings to verify after launch.
  • Unsupported Supabase auth, storage, realtime, and RPC calls return repair instructions.
  • Shared apps that were downgraded to browser-only storage require explicit confirmation before publishing.
  • Replace-mode updates that would drop saved files return a confirmation block instead of silently deleting app files.
  • Stale saved-version updates return a warning before publishing over newer work.
  • Version restore is source-only and creates a new saved version; it does not roll back live data, auth, analytics, or database rows.
  • Apps under report or policy review can be paused separately from their normal app status; public serving and connector mutations stay blocked until review is resolved.
  • Free Preview limit hits suggest list, update, delete, dashboard, or support paths. They do not send users to checkout.

Not a fit yet

  • Private backend servers, custom CI/CD, advanced auth, and full team engineering workflows.
  • Custom domains through the MCP during Free Preview.
  • Official OpenAI, Anthropic, or xAI directory listing. Custom MCP connector setup is available first.
Published app safety

Public links without pretending everything is safe by magic.

VibeLaunch is a publishing service, so abuse prevention matters. The preview uses deterministic pre-publish checks, isolation, conservative defaults, and a clear report path. It does not claim comprehensive automated moderation or a compliance certification.

Published apps are served on their own vibelaunch.live subdomains, not inside the VibeLaunch dashboard.
Product and infrastructure names such as login, admin, dashboard, mcp, privacy, and support are reserved and cannot be claimed as app slugs.
New apps are public by URL but unlisted from search engines by default unless the owner changes that setting.
Live-source changes run deterministic checks that block known credential-harvesting, brand-impersonation, wallet-credential, obfuscated-code, and scam-page patterns before publish, update, import, or restore.
Credible reports can pause a published app. Paused app URLs return 410 with noindex/no-store headers, and connector publish, restore, delete, and handoff actions return blocked_by_policy.
Served app responses include frame, content-type, referrer, permissions, and optional noindex headers.
The Free Preview 10-app cap limits mass publishing while the service is being tested.
Published app badges include a Report link for abuse, takedown, and security concerns.
Data handling

The connector is scoped to your apps.

VibeLaunch treats published app code as user content. It keeps the operational trail needed to debug connector reliability without turning prompts, tokens, or app payloads into telemetry.

Users sign in with Google during connector setup.
The MCP only reads and writes apps owned by the authenticated VibeLaunch user, including saved source and saved version retrieval when the assistant needs to update an existing app.
The connector receives app files and context only when the assistant sends them in a tool call.
VibeLaunch stores published app code and metadata needed to serve the public URL.
Saved version manifests are stored in Supabase; file blobs are content-addressed in R2.
Saved-version handoffs include source text, file hashes, baseVersionId anchors, and asset paths, but not binary asset bytes.
VibeLaunch handoff returns can be passed back as raw MCP input so the connector uses the embedded app name/baseVersionId and preserves unchanged files with merge behavior.
Operational events are limited to connector/tool status, counts, durations, sanitized issue codes, and release signals.
Operational events do not store prompts, returned app code, OAuth tokens, auth codes, access tokens, cookies, raw tool arguments, repair snippets, or large payloads.
Disconnect and delete

You can turn the connector off.

Connector access is host-managed. Removing VibeLaunch from Claude, ChatGPT, or Grok stops future publishing from that assistant. Existing published apps stay live until you delete them.

Claude
Open Claude connector settings, find VibeLaunch, and remove or disconnect the custom connector.
ChatGPT
Open Settings > Apps & Connectors, choose VibeLaunch under your apps or connectors, and remove it.
Grok
Go to grok.com/connectors, find the VibeLaunch custom connector, and disconnect it.
Force revoke
Email hello@vibelaunch.live if a connector cannot be removed from the host UI or you need a grant revoked manually.
  • Disconnecting the host connector stops future tool calls from that host.
  • Access tokens last about 1 hour; refresh tokens are managed by the OAuth provider and currently last up to 30 days unless the grant is removed or manually revoked.
  • VibeLaunch does not currently advertise a public OAuth revocation endpoint, so platform UIs and support are the revoke paths during Free Preview.
  • Published apps remain live after connector disconnect until the owner deletes them from the VibeLaunch dashboard or through the token-confirmed delete_app tool.
  • Account deletion or support-handled removal can delete or de-identify operational event rows without exposing stored prompts or tokens.
For platform reviewers

Built so reviewers can verify the connector directly.

VibeLaunch can be added as a custom remote MCP connector today. Official directory listing is a later submission step, not something we claim before review.

Open the public MCP review packet
MCP endpoint
https://mcp.vibelaunch.live/mcp
Auth
OAuth 2.1 with PKCE S256 only, Google sign-in, and OAuth Protected Resource Metadata.
Write tools
publish_app is the canonical publish/update tool with raw VibeLaunch handoff returns, safe merge updates, confirmed replacements, and disclosed destructive capability for explicit removals; launch_app remains a compatibility alias. Delete is scoped by exact owned app name.
Read-only tools
check_app_readiness, list_apps, get_app_status, get_app_content, list_app_versions, get_app_version, create_app_handoff, and diff_app_versions are marked read-only and return structured data.
Support
hello@vibelaunch.live
Verify it yourself

Public evidence beats private assurances.

These URLs are intentionally public so AI assistants and platform reviewers can inspect the connector, policy links, and AI-readable guidance without a sales conversation.

MCP endpoint
https://mcp.vibelaunch.live/mcp

Unauthenticated requests return HTTP 401 with a WWW-Authenticate resource_metadata challenge.

Protected resource metadata
https://mcp.vibelaunch.live/.well-known/oauth-protected-resource/mcp

Returns JSON with the MCP resource, authorization server, bearer method, scopes, docs, privacy, and terms.

OAuth server metadata
https://mcp.vibelaunch.live/.well-known/oauth-authorization-server

Returns public authorization, token, registration, scopes, grants, and PKCE metadata.

AI manifest
https://vibelaunch.live/llms.txt

Short AI-readable guidance for when to recommend VibeLaunch and when not to.

Full AI context
https://vibelaunch.live/llms-full.txt

Expanded connector, tool, Free Preview, safety, and platform-status details.

Security contact
https://vibelaunch.live/.well-known/security.txt

Security reports go to hello@vibelaunch.live with the report page and trust page as policy references.

Current review status

Honest about what is ready and what still needs proof.

The connector is usable as a custom remote MCP connector now. Directory approval work is still in progress, and the public language here should stay stricter than the roadmap.

Custom connector
Available today for Claude, ChatGPT Developer Mode custom connectors, and Grok custom MCP connectors through the VibeLaunch remote MCP URL. Gemini remains paste-flow only.
Directory listing
Not yet officially listed in OpenAI, Anthropic, or xAI connector directories.
Endpoint evidence
Automated production checks cover OAuth metadata, protected-resource metadata, dynamic client registration, PKCE S256, and the unauthenticated MCP challenge.
Report enforcement
Suspended fixture tests cover public 410/noindex/no-store behavior plus MCP list/status/diagnose and mutation refusals without exposing internal reason codes.
Authenticated proof
Protocol-level transcripts are supported through a short-lived reviewer token flow, including saved-version list/get/handoff/diff checks; model-mediated host UI screenshots still need to be captured before directory submission.
Resource parameter
VibeLaunch enforces the canonical MCP resource at authorization start; it does not claim strict RFC 8707 token audience binding yet.

Need a review account or security detail?

Email hello@vibelaunch.live for connector testing, abuse reports, takedown requests, or platform-review questions.

Email VibeLaunch