Back to Browse

Vicecityhub MCP Server

Developer ToolsUse Caution4.6MCP RegistryLocalRemote
Free

Server data from the Official MCP Registry

GTA VI news, GTA RP servers, Web3 domains and merch for AI agents, plus crypto donations.

About

GTA VI news, GTA RP servers, Web3 domains and merch for AI agents, plus crypto donations.

Remote endpoints: streamable-http: https://lpglkglhjdqnktybksth.supabase.co/functions/v1/agent-api/mcp

Security Report

4.6
Use Caution4.6High Risk

Vice City Hub is a GTA VI fan hub with an MCP server that exposes catalog, news, and RP data tools; paid and donation actions require a self-registered API key with spend limits, and the frontend uses Supabase auth. The main concerns are the agent-driven purchase and donation flows, which allow autonomous spending by AI agents and depend on the agent's principal authorization, plus an unauthenticated register_agent tool that issues keys to anyone. Code shows no shell execution, no hardcoded secrets, and permissions broadly match the purpose of a developer/fan-site tool. Supply chain analysis found 9 known vulnerabilities in dependencies (0 critical, 4 high severity).

4 files analyzed ยท 13 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

database

Check that this permission is expected for this type of plugin.

env_vars

Check that this permission is expected for this type of plugin.

clipboard

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

How to Install & Connect

Available as Local & Remote

This plugin can run on your machine or connect to a hosted endpoint. during install.

Documentation

View on GitHub

From the project's GitHub README.

Vice City Hub ๐ŸŒด โ€” v12 "Open to Agents"

The GTA VI fan hub for humans and AI agents. Neon UI for people, MCP + REST + llms.txt + safe auto-buy for machines.

Live: https://vicecityhub.github.io/vicecityhub ยท Agent docs: /llms.txt ยท Agent console: /agents.html

What v12 adds

LayerWhatWhere
Agent API (REST)catalog, news, RP data, search, quotes, orders, intentssupabase/functions/agent-api/
MCP server17 tools, stateless streamable-HTTPโ€ฆ/agent-api/mcp
Discoveryllms.txt, llms-full.txt, .well-known/{agent.json,mcp.json,api-catalog,ai-plugin.json,security.txt}, openapi.jsongenerated โ†’ public/
Static feedsdata/{news,catalog,rp-*}.json + manifest data/index.jsongenerated โ†’ public/data/
Per-page SEO/agent markup<link> hints, one JSON-LD @graph, <noscript> contentvite-plugins/agent-surface.ts
Agent purchasesprice-locked quotes โ†’ idempotent orders โ†’ PayPal or on-chain stablecoin, human-set spend mandatesorders.ts, verify.ts, owner.ts
Human consolemint/revoke spend-limited keys, browse catalog, track orderssrc/pages/Agents.tsx

Humans keep the full neon UI (React SPA per page). Nothing was removed from the human experience.

Single source of truth

site.config.json โ€” name, URLs, page list (titles, descriptions, priorities, feeds). The generator, the Vite plugin, llms.txt, the sitemap and all JSON-LD read from it. Add a page โ†’ add one entry there.

Build pipeline

npm run build
 โ”œโ”€ prebuild  scripts/gen-agent-surface.mjs   live API โ†’ public/{llms*.txt, openapi.json, sitemap.xml, .well-known/*, data/*}
 โ”œโ”€ tsc -b
 โ””โ”€ vite build   (agentSurface plugin injects discovery links + JSON-LD + <noscript> into every HTML entry)

The generator never fails a build: if the API is unreachable it keeps the previous files (--strict to fail instead). CI (.github/workflows/deploy.yml) rebuilds on push, manually, and every 6 h after the news agent so feeds stay fresh, then verifies the agent files exist in dist/.

Project map

site.config.json            โ† edit pages/URLs here
vite-plugins/agent-surface.ts
scripts/
  gen-agent-surface.mjs     โ† llms.txt, .well-known, feeds, sitemap
  test-agent-api.mjs        โ† 30-check safe smoke test (never moves money)
  news-agent.mjs            โ† scheduled news ingestion
  selftest-verify.mjs       โ† on-chain verifier self-test
public/                     โ† robots.txt + generated agent files (committed so Pages works even if generation fails)
src/{pages,components,lib,rp-hub}
supabase/functions/{agent-api,paypal-checkout,printful-hub,link-preview,โ€ฆ}
docs/legacy/                โ† old one-off notes/scripts (kept, not used)

Agent purchase protocol (short)

  1. POST /v1/agents/register โ†’ key ($100/order, $250/day) โ€” or a human mints a bigger mandate in the console.
  2. POST /v1/quotes โ†’ price locked 15 min.
  3. POST /v1/orders + Idempotency-Key โ†’ next_action (PayPal approve_url or exact-amount stablecoin transfer).
  4. Crypto (no PayPal, fully automatic): send exactly amount_due in USDT/USDC. pg_cron runs the reconciler every minute (/v1/internal/reconcile): it finds the transfer by its unique amount tag, verifies it on-chain, marks the order paid and, for merch, submits the Printful order (PRINTFUL_AUTO_CONFIRM=0 keeps it as a draft). Failed Printful calls are retried by the reconciler. payment-proof is an optional shortcut. PayPal: capture โ†’ GET /v1/orders/{id}/status until paid.

Peer listings (partner products, community servers) are intent-only โ€” the Hub never custodies funds for them.

Develop

npm ci
npm run dev            # Vite
npm run gen:agent      # regenerate agent surface
npm run typecheck
npm run test:agent     # smoke-test the live Agent API
npm run build

Deploy the edge function: npx supabase functions deploy agent-api --no-verify-jwt --use-api

Known platform limits (GitHub Pages project site)

robots.txt, llms.txt and /.well-known/* are served under /vicecityhub/, not at the host root. Crawlers and some agents look at https://vicecityhub.github.io/robots.txt (root). For full spec-compliant discovery use a custom domain, or publish the same files from a vicecityhub.github.io user-site repo. The Agent API itself (Supabase) serves /v1 index, OpenAPI and MCP from its own root, so it is discoverable regardless.

ko-fi

Reviews

No reviews yet

Be the first to review this server!