Agents

Vibiz Stack is built to be driven by agents. An agent holds an agent key: it can create projects, deploy, send email, use AI and do everything in development, and it can never read a production secret or move live money. When it hits something only a person may do, it gets 403 owner_only with details.next_step, the step to tell you.

There are four ways in, and they share one API:

#Paste to your agent

Set up once, from one line. Paste this into Claude Code, Codex or Cursor (or press Paste to your agent at app.vibiz.app/get-started):

Set up Vibiz for me: follow https://app.vibiz.app/get-started.md

/get-started.md is a playbook for the agent: install the CLI and log in, add the skills (vibiz skills add --global), connect the MCP server (vibiz mcp add --clients "<client>", with a manual route per client), check the connection with vibiz_docs and vibiz_project_status, and report what is set up. It pauses only for your sign-in.

Then ask for what you want, in an empty folder:

Use Vibiz (https://app.vibiz.app/llms.txt) to build and deploy <what you want>.

Already set up somewhere else? One prompt also works on its own: add "Log in with npx @vibiz/cli login and show me the link."

Logging in. npx @vibiz/cli login prints a link and a code. The person opens the link, signs in with their Vibiz account and clicks Authorize; a Vibiz Stack account is opened on the way if they have none. The CLI then holds its own agent key (cli · <computer name>). If the shell times out first, run vibiz login again: it keeps waiting on the same code. Never ask the person to paste a key into the chat. A tool that answers unauthorized with reason: not_logged_in means exactly this step.

#Remote MCP: nothing to install

claude mcp add --transport http vibiz https://app.vibiz.app/mcp

Your client finds the sign-in on its own (OAuth 2.1 with PKCE): the first time it calls a tool, it opens the browser on the same Authorize page. The connection gets its own agent key, named after the client ("Claude Code"), listed on the API keys page, where revoking it disconnects the client. Tokens refresh on their own.

• Any of them, from the CLI: vibiz mcp add --clients "Claude Code" (or Codex, Cursor, "VS Code with Copilot", Windsurf, "Gemini CLI", OpenCode; several, comma-separated). It runs the client's own CLI where there is one and otherwise merges only the vibiz entry into its user config.
• Cursor: .cursor/mcp.json → { "mcpServers": { "vibiz": { "url": "https://app.vibiz.app/mcp" } } }
• Codex: codex mcp add vibiz --url https://app.vibiz.app/mcp, then codex mcp login vibiz
• Headless (CI): send a key instead, --header "Authorization: Bearer $VIBIZ_API_KEY".

The remote server has every tool of the local one. The two that read files on your machine (vibiz_deploy, vibiz_speech_transcribe) answer with the CLI command to run instead (npx @vibiz/cli deploy --project <id>), and write_to isn't available: use the local server or the CLI for those.

#Install

The CLI and the MCP server are one npm package, @vibiz/cli (Node 20+): npx @vibiz/cli … runs the CLI and npx -y @vibiz/cli mcp the MCP server, with nothing to install first. Apps install @vibiz/app; scripts and servers that drive the API itself use @vibiz/sdk. An app that can't add a dependency calls the same HTTP routes with fetch: see @vibiz/app.

The local MCP server reads VIBIZ_API_KEY and VIBIZ_API_URL from its environment, or the CLI's saved login (vibiz login). Leave VIBIZ_API_URL out for production (https://app.vibiz.app). Without a key it still starts, and every tool answers unauthorized with details.next_step: run npx @vibiz/cli login and show the person the link.

#Claude Code

claude mcp add --transport http vibiz https://app.vibiz.app/mcp   # remote, sign in on first use
claude mcp add vibiz -- npx -y @vibiz/cli mcp                           # local, uses `vibiz login`

Or commit a project .mcp.json without the key (${VIBIZ_API_KEY} is read from your shell):

{
  "mcpServers": {
    "vibiz": {
      "command": "npx",
      "args": ["-y", "@vibiz/cli", "mcp"],
      "env": { "VIBIZ_API_KEY": "${VIBIZ_API_KEY}" }
    }
  }
}

#Codex

codex mcp add vibiz --env VIBIZ_API_KEY=vz_sk_… -- npx -y @vibiz/cli mcp

Or in ~/.codex/config.toml:

[mcp_servers.vibiz]
command = "npx"
args = ["-y", "@vibiz/cli", "mcp"]
env = { VIBIZ_API_KEY = "vz_sk_…" }

codex exec (non-interactive) refuses tools it can't ask you to approve; add -c mcp_servers.vibiz.default_tools_approval_mode="approve" to let it call them.

#Cursor

.cursor/mcp.json in the project, or ~/.cursor/mcp.json for every project:

{
  "mcpServers": {
    "vibiz": {
      "command": "npx",
      "args": ["-y", "@vibiz/cli", "mcp"],
      "env": { "VIBIZ_API_KEY": "${env:VIBIZ_API_KEY}" }
    }
  }
}

#The tools

Tools default to the development environment (vibiz_files reads production unless env says otherwise). The project id is in ./vibiz.json in a linked app folder, or vibiz_project_status lists them. Set VIBIZ_USER in the server's env to attribute an agent's calls to an end user.

#The docs tool

vibiz_docs (and vibiz docs <topic> in the CLI) serves the agent guides: short pages written from what real Claude Code and Codex runs got wrong (the 7-day hold, the fee example ($100 → $94.80 with the default 2% Vibiz fee), wiring webhooks, the @vibiz/app calls, company fees in cents). They are the same text as on this site and in /llms-full.txt, generated from one source.

#For agents reading this site

• /llms.txt: the index of every page, as markdown links.
• /llms-full.txt: every page in one file.
• Any page as markdown: add .md to its URL (/docs/payments.md).

#What agents can and can't do

Never paste an owner key into an agent's environment: an agent with a shell can read what the owner's machine can.