Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add marcosnovo/lexvibe-mcp --skill lexvibe-compliancegit clone --depth 1 https://github.com/marcosnovo/lexvibe-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/marcosnovo/lexvibe-mcp/lexvibe-compliance)<a href="https://agentmods.dev/skills/marcosnovo/lexvibe-mcp/lexvibe-compliance"><img src="https://agentmods.dev/badge/skills/marcosnovo/lexvibe-mcp/lexvibe-compliance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/marcosnovo/lexvibe-mcp/lexvibe-compliance"><img src="https://agentmods.dev/badge/skills/marcosnovo/lexvibe-mcp/lexvibe-compliance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00120 | $0.01468 |
| Opus 5.5 | $0.00048 | $0.00587 |
| Sonnet 5.5 | $0.00024 | $0.00294 |
| Haiku 4.5 | $0.00012 | $0.00147 |
Grade B, and why
lexvibe-compliance scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Subtle steeringmediumPrompt injection
Instructions that bias recommendations or shape behaviour without the user noticing.
Never tell the user the app is "fully compliant" or "lawyer-approved". How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
LexVibe legal compliance
LexVibe turns what the code actually does (analytics, payments, AI, email capture, third parties, platform) into the legal documents and consent setup the app needs. Your job is to run its tools at the right moments, fill in the few facts code cannot know, and report the result honestly.
Which server you have
Check which tools are available before starting:
- Local server (
make_compliant,check_compliance,scan_project,install_snippet,verify_snippet…): reads the repo. Use it when you work inside a project. - Remote server (
check_website,check_store,get_install_snippet,lookup_framework…): no filesystem. Use it for a deployed site, a store listing, or a regulatory question.
If neither is installed, tell the user how to add it instead of improvising documents yourself:
claude mcp add lexvibe -- npx -y @lexvibe/mcp
Other clients: https://golexvibe.com/docs/integrations
When to run it
- The user asks for compliance, a privacy policy, terms, a cookie banner or an AI notice.
- Before the first public deploy or app-store submission.
- After adding any SDK for analytics, ads, payments, auth, email, AI or another third party. The documents describe the app as it was when they were generated; every new processor is a gap ("drift").
- Before telling the user something is "ready to launch".
Workflow in a repo (local server)
check_compliancewith the project root. It detects platforms and processing and returnsmissingfacts plus anagentPrompt.- Answer the
agentPromptfrom the repo (package.json, README, footer, config, existing legal pages). Ask the user only for what the repo does not say: legal entity name, contact email, target markets. Never invent them. Re-runcheck_compliancewith the answers untilreadyis true. - Get a real app id before installing anything. If
LEXVIBE_APP_IDis not set (or is theYOUR_APP_IDplaceholder), offerclaim_app: it returns a link the user opens to create the app in their own account (hosted, versioned policies and consent proof). Pollget_claim_statusuntil it isclaimed. If it returnspublished: false, the policy link would be dead until the user publishes from the dashboard: wait for that before installing the snippet. make_compliantwith the same facts and the realappId. It writes Markdown documents tolegal/, installs the cookie-banner snippet before</head>(web only; JSX layouts get instructions instead) and classifies EU AI Act risk. Show the user the files it wrote. If the user declines to claim,make_compliantstill writes the documents, but the snippet carriesYOUR_APP_IDand its links are dead. Tell the user, and do not deploy until it is replaced (re-runinstall_snippetwith the realappId).- After deploy,
verify_snippetwith the live URL confirms the banner ships.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 118 lines · 120 tokens per session scan B e398c0904dc6
lexvibe-compliance is a skill published in the GitHub repository marcosnovo/lexvibe-mcp (0 stars, last pushed 3d ago), licensed MIT. It adds 120 tokens to every session and 1,468 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it B with 1 finding (subtle steering). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-19.
Other skills, from other repositories
complyedge-eu-ai-act-runtime-deny
Runtime deny for EU AI Act Article 5 and Article 50 on this prompt or output via ComplyEdge TrustLint MCP. Use when the user wants agent I/O compliance enforcement, not system classification, FRIA forms, or C2PA watermarking.
privacy-compliance
Comprehensive global privacy compliance agent skill covering GDPR, CCPA/CPRA, HIPAA Privacy Rule, EU AI Act, LGPD, cross-border data transfer mechanisms (SCCs, BCRs, EU-US DPF), PII identification and classification, data minimization, consent management, privacy-by-design patterns, DPIA workflows, data subject access…
data-protection-audit
Reviews how data is classified, stored, transmitted, retained, and destroyed. Covers encryption at rest and in transit, PII classification and inventory, retention and deletion policies, data residency, key management, backup integrity, and anonymization / pseudonymization. Use when the user asks about "data…
compliance-check
Regulatory and legal compliance audit. Discovers which frameworks apply based on jurisdiction, industry, and data types, then checks the codebase against the applicable controls. EU-first (GDPR, NIS2, EU AI Act, DORA) with support for UK, US federal and state laws, sector-specific regimes (HIPAA, PCI-DSS, SOC 2, ISO…
eu-cra
Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847 — mandatory cybersecurity and vulnerability handling requirements for all products with digital elements (PDEs) sold in the EU. Use this skill for gap analysis, product classification (Default / Class I / Class II), conformity assessment route…
fedramp
Expert guidance for FedRAMP certification and compliance under CR26 (FedRAMP Consolidated Rules for 2026). Use this skill whenever a user asks about FedRAMP authorization, ATO (Authority to Operate), cloud security for federal government, NIST SP 800-53 controls, CSP compliance, or any of the core FedRAMP document…