Skip to content

MCP Catalog

Jump to bottom
Sia edited this page Jun 2, 2026 · 9 revisions

MCP Catalog

60 curated MCP (Model Context Protocol) servers across 10 categories. The catalog is a marketplace of cards — each card has its own Install/Remove button and a status pill, with inline token forms and live install progress.

/env-setup/mcp in the web UI.

Category overview

Category Count Notable
🛠 Dev tools 6 filesystem ★, git ★, memory ★, sequential thinking, time, everything
🌐 Git hosting 5 GitHub ★, GitLab, Gitea, Bitbucket, Azure DevOps
🗄 Database 8 SQLite ★, Postgres, MySQL, MongoDB, Redis, Elasticsearch, Supabase, Firebase
🔎 Search / web 6 Brave ★, Tavily, Perplexity, Firecrawl, Google Maps, Context7 ★
🖥 Browser 2 Playwright ★, Puppeteer
✅ Productivity 13 Notion ★, Linear, Jira, Confluence, Slack, Discord, Trello, Asana, ClickUp, Airtable, Monday, Google Drive, Obsidian
☁ Cloud 6 AWS KB, Cloudflare, Vercel, Heroku, Railway, Docker Hub
📨 Communications 5 SendGrid, Twilio, Telegram, Stripe, Sentry
📱 App publish (Experimental) 4 Google Play Publisher, App Store Connect, Fastlane, App Publish (Play + App Store)
🧠 AI assist 5 OpenAI Bridge, YouTube Transcript, Wikipedia, ArXiv, Everart

★ = recommended for first-time setup (9 entries).

Trust tiers

  • VERIFIED — Anthropic-official @modelcontextprotocol/* or a 1st-party vendor (Notion, Cloudflare, GitHub-via-Anthropic). Package name is stable.
  • COMMUNITY — Popular 3rd-party packages. Package names can change as the maintainer publishes new versions.
  • EXPERIMENTAL — Package name not yet finalized or install behavior unverified. May fail; recommended to manually fine-tune .mcp.json after install.

"준비중 / Coming soon" badge

Some MCPs require an interactive browser OAuth callback as part of their first call (not just a key/token up front). vibe-coder runs MCP servers as non-interactive child processes — there's no way for the browser-callback step to happen inside that flow. These MCPs are listed in the catalog with a ⏳ 준비중 badge, the checkbox is disabled, and the server refuses install requests for them (400 coming_soon).

Currently affected:

  • Google Drive (@modelcontextprotocol/server-gdrive) — Even after you upload the OAuth client JSON, the first call needs a user to open a browser, sign in, and approve scopes. There's no "Service Account" path for Drive in the standard MCP server.

Workarounds if you really need them today:

  1. Run the MCP server once on a desktop (npx -y @modelcontextprotocol/server-gdrive) to complete the OAuth dance and produce a refresh-token file.
  2. Copy that token file into the container (docker cp) at the path the MCP server expects.
  3. Register the MCP entry manually in ~/.claude/.mcp.json.

Otherwise wait for a future release that wraps the OAuth flow server-side.

Installation flow (per card)

Each catalog entry is a card with a status pill (Installed / Registered only / Not installed):

  1. Fill the inline token/URL fields on the card if it needs credentials (GitHub PAT, Slack Bot token, etc.). Required fields are marked with *.
  2. Click the card's Install (or Reinstall) button. Server runs npm install -g <pkg> and registers it via the standard user scope (claude mcp add-json <name> '<json>' -s user → .claude.json's mcpServers). User scope (not ${CLAUDE_CONFIG_DIR}/.mcp.json, which Claude Code does not read) so the server is recognized consistently by the console, sub-agents, the terminal, and claude mcp list.
  3. Live progress at /env-setup/tasks/{taskId} (or via WS).
  4. After install, the MCP is available in the next Claude turn (no need to restart the per-project child — Claude re-reads user scope per request).
  5. Installed/registered cards show a Remove button (see below).

Under the hood the same endpoints are used — each card posts a single-entry select to POST /api/env-setup/mcp/install (or …/unregister).

Per-project recognized MCP + connection status

The per-project MCP tab (/projects/{id}/mcp) shows a live status card at the top: the MCP servers Claude actually recognizes in that project and their connection state, parsed from claude mcp list run in the project cwd — Connected (✓), Failed to connect (✗), Needs auth (!), Pending (⏸). A ↻ refresh button re-runs the health check. It loads as a separate ajax fragment (GET /projects/{id}/mcp/status) because the health check can take a few seconds. Unlike the disk-parsed chip lists (which show "is it registered"), this card shows "did Claude load it and connect".

Binary-backed MCP servers

Some MCP servers are native binaries, not npm packages. These are bundled into the image (e.g. the official Gitea MCP gitea-mcp, a Go static binary downloaded from gitea.com/gitea/gitea-mcp releases into /usr/local/bin). For such entries Install skips npm install -g and only registers user scope; "Installed" is judged by the binary being present on PATH. The catalog pins the absolute command path (/usr/local/bin/gitea-mcp) to avoid any stale PATH shadow. Config follows the official convention: GITEA_HOST (instance root URL — not /api/v1) + GITEA_ACCESS_TOKEN (+ optional GITEA_INSECURE).

Unregister vs uninstall

  • Unregister / Remove (POST /api/env-setup/mcp/unregister): removes the entry from .mcp.json only. The npm package stays on disk; pressing the card's Install again brings it back instantly.
  • Hard uninstall: docker exec -it --user vibe vibe-coder-server npm uninstall -g <pkg>. Useful only to reclaim disk space.

configFields[] shape (for client implementers)

Each MCP entry exposes zero or more config fields through McpEntryDto.configFields[]. The schema is fixed — clients can render a generic form by iterating these keys:

Key Type Required Default Meaning
key String ✅ — Env var name stored verbatim in .mcp.json env block (e.g. GITHUB_PERSONAL_ACCESS_TOKEN).
label String ✅ — Human-readable form label.
placeholder String? — null HTML placeholder for the input.
isSecret Boolean — false Mask the value (password-style input).
required Boolean — true Server 400 missing_config if empty at install time.
help String? — null Tooltip / sub-label / one-line explanation.
isFile Boolean — false Use the file-upload endpoint and pass back the returned path.
acceptMime String? — null When isFile=true, value for <input accept="...">.

There is intentionally no type, default, or description field.

  • All values are transmitted as String on the wire.
  • "Default" values are baked into McpEntry.argsTemplate server-side (e.g. --workspace-root /workspace for filesystem) and are not client-controllable.
  • The longer-form description belongs on the entry (McpEntryDto.description), not on individual fields.

.mcp.json format

Generated by the catalog:

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_..."
      }
    },
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/workspace"]
    },
    ...
  }
}

You can hand-edit this file inside the container (docker exec -it --user vibe vibe-coder-server vi ~/.claude/.mcp.json) for entries the catalog doesn't cover. Survives image upgrades.

Adding MCPs not in the catalog

Two ways:

Via docker exec (one-off)

docker exec -it --user vibe vibe-coder-server bash
npm install -g some-mcp-package
# Edit ~/.claude/.mcp.json to add the entry

Both paths (/home/vibe/.local + /home/vibe/.claude) are bind-mounted so the install + registration survive image upgrades.

Permanently (PR to the catalog)

Add an entry to server/.../env/McpCatalog.kt. The 50-line snippet includes id / package / category / trust tier / configFields. Send a PR.

Secret-file authentication (Service Account JSON, Apple .p8, …)

Some MCPs authenticate with a key file instead of a token string:

MCP File format Where to get it
Google Play Publisher .json (Service Account) Play Console → Setup → API access → Service accounts → Create key
App Store Connect .p8 App Store Connect → Users and Access → Keys → Generate API Key
App Publish (Play + App Store) .json (Service Account) and/or .p8 Unified server (mikusnuz/app-publish-mcp) — fill only the platform(s) you use; both keys are optional
Firebase .json (Service Account) GCP Console → IAM → Service Accounts → Keys
Google Drive .json (OAuth client) GCP Console → APIs & Services → Credentials → OAuth client ID → Download

How it works (browser UI)

  1. Check the box of the MCP that needs a file. The config block expands.
  2. The field shows a file picker (<input type="file">), not a text input.
  3. Pick the file. As soon as you select it, the browser uploads it via POST /env-setup/mcp/{mcpId}/file/{fieldKey} (multipart) immediately — no separate "upload" button.
  4. The server saves it to /home/vibe/.config/mcp-secrets/<mcpId>-<fieldKey>.<ext> (0600 permissions, directory 0700) and returns the absolute path.
  5. The path appears below the field. Clicking "Install selected" includes the path in .mcp.json's env block automatically — the MCP server reads it on first call.

Limits

  • 128 KB max per file. Service Account JSON and .p8 keys are a few KB; a larger file is rejected as suspicious.
  • File extension is taken from the original filename (preferred) or acceptMime.
  • Filename is sanitized ([^A-Za-z0-9._-] → _) to prevent path traversal.

Replacing a file

Simply pick a new file in the same field. The server atomic-moves it over the old one (same <mcpId>-<fieldKey> slot).

Manual placement (alternative)

If you'd rather drop the file in via docker cp:

docker cp ./play-sa.json vibe-coder-server:/home/vibe/.config/mcp-secrets/google-play-publisher-GOOGLE_PLAY_SERVICE_ACCOUNT_JSON.json
docker exec --user vibe vibe-coder-server chmod 600 /home/vibe/.config/mcp-secrets/google-play-publisher-GOOGLE_PLAY_SERVICE_ACCOUNT_JSON.json

Then in the catalog UI, the existing path will show — no upload needed, just check the box and click Install.

Recommended starter pack

For most users:

★ What it does
filesystem Read/write under the workspace
git Git log/diff/status (read-only)
memory Knowledge graph across sessions
sqlite Query the SQLite under .vibecoder/
context7 Up-to-date library docs
GitHub Issues/PRs/repo browsing (needs PAT)
Notion Workspace pages (needs Integration token)
Brave Search Web search (free API key)

After this 9-pack, install Playwright or Puppeteer only if you actually need browser automation (~300 MB Chromium download).

Clone this wiki locally