Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The official Model Context Protocol server for Lovable, an AI-powered full-stack app builder.
Connect Claude, Cursor, Codex, and other MCP-compatible clients to Lovable so they can create, edit, deploy, and manage Lovable projects through natural language.
https://mcp.lovable.devTransport: Streamable HTTP.
OAuth 2.1. MCP clients discover the authorization server via RFC 9728 metadata at https://mcp.lovable.dev/.well-known/oauth-protected-resource and obtain a bearer token automatically. The token is passed as Authorization: Bearer <token>.
Claude, Claude Code, and ChatGPT need only the URL. Any other client must also pass Lovable's public OAuth client ID (6d465f583e1e4ce5801b1616f735670c), shown below.
claude mcp add --transport http lovable https://mcp.lovable.devAdd to claude_desktop_config.json:
{
"mcpServers": {
"lovable": {
"type": "http",
"url": "https://mcp.lovable.dev"
}
}
}Add the URL directly — no client ID needed:
https://mcp.lovable.devAdd to your client's MCP config (~/.cursor/mcp.json, or Windsurf's mcp_config.json):
{
"mcpServers": {
"lovable": {
"type": "http",
"url": "https://mcp.lovable.dev",
"auth": {
"CLIENT_ID": "6d465f583e1e4ce5801b1616f735670c"
}
}
}
}{
"servers": {
"lovable": {
"type": "http",
"url": "https://mcp.lovable.dev",
"auth": {
"CLIENT_ID": "6d465f583e1e4ce5801b1616f735670c"
}
}
}
}codex mcp add lovable --url https://mcp.lovable.dev
codex mcp login lovableUse the same type: http + url + auth.CLIENT_ID shape as the Cursor example above.
The server exposes tools across these areas:
Heads up:create_projectandsend_messageconsume Lovable build credits.deploy_projectpublishes a public URL.query_databaseruns SQL directly against your project's database.
See the Lovable MCP documentation for the full tool reference.
Build and deploy a new app:
1. list_workspaces() → workspace_id
2. create_project(workspace_id, ...) → project_id (uses credits)
3. send_message(project_id, "Add ...") → message_id (uses credits)
4. get_diff(project_id, message_id) → review changes
5. deploy_project(project_id) → live URLMost tools need a workspace_id — call list_workspaces first. read_file needs a git ref; get latest_commit_sha from get_project.
| Symptom | Fix |
|---|---|
401 Unauthorized / expired token | Re-run your client's login flow to refresh the OAuth token |
| OAuth window loops or never completes | Confirm the client passes the auth.CLIENT_ID shown above |
| "Transport not supported" | The client must support Streamable HTTP |
Tool fails on a missing workspace_id | Call list_workspaces first and pass the returned ID |
This repository hosts the server.json entry for the MCP registry.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.