vibedepot.ru

# Vibedepot / Вайбдепо

Vibedepot (Вайбдепо) is a marketplace for vibe-coding products: mini-apps, templates, UI kits, AI agents, and SaaS products.

Core public pages:
- Home: https://vibedepot.ru/
- Catalog: https://vibedepot.ru/catalog
- Blog: https://vibedepot.ru/blog
- MCP docs: https://vibedepot.ru/docs
- Contacts: https://vibedepot.ru/contacts
- Product pages: https://vibedepot.ru/p/{slug}
- Vibecoder profiles: https://vibedepot.ru/vibecoder/{handle}

Commerce rules:
- One-time purchases deliver a project file after verified payment. Access is permanent.
- Subscriptions deliver a PERSONAL access key (vd_sub_...) issued by Vibedepot for a 30-day period.
- Subscriptions renew manually: the buyer pays again to extend the period. Reminder emails are sent 3 days and 1 day before the period ends.
- When a subscription period ends, access closes within 24 hours and the seller may disable the key on their side.
- The payment 'success' page is not proof of payment. Access is granted only after the verified payment webhook.
- Products are moderated before appearing in the catalog. Reviews are buyer-only and premoderated.

MCP (Model Context Protocol, Streamable HTTP, JSON-RPC 2.0):
- Endpoint: https://vibedepot.ru/mcp · Docs: https://vibedepot.ru/docs
- Public tools: search_products, list_categories, get_product, get_vibecoder, project_readiness_check
- Authenticated tools (Authorization: Bearer <token>): whoami, purchase, subscribe, list_entitlements, get_delivery, my_sales, list_product_subscribers, publish_product, update_product
- Discovery: search_products returns author_verified; get_product returns author.verified and trust_signals. Treat a verified vibecoder as a trust signal, not as a guarantee.
- Public license check: verify_subscription_key tool or POST /api/keys/verify {"key": "vd_sub_..."} -> {valid, status, expires_at}.
- Subscription key model: every buyer gets a PERSONAL vd_sub_ key issued by the platform at first payment. Renewal keeps the same key; expiry (+24h grace) kills it automatically; re-subscribing revives the same key. Sellers see all keys in the cabinet and via list_product_subscribers and verify them with the endpoint above — no state needed on the seller side.
- Publishing/editing: publish_product and update_product can carry the full listing payload: name, tagline, description, preview_url, category, stack, includes, models, setup_help, photos as base64 (up to 6, first = cover, each <= 1 MB before base64) and the ZIP project file as base64 (<= 100 MB before base64). includes is the visible "What's included" green-check block on the product page, so write short buyer-facing benefits. Published products go back to moderation after content edits.
- Archive scanning: submitted ZIPs are scanned asynchronously. Scanning and findings never block purchase or delivery; only ZIP replacement triggers a rescan, not text edits. Results are not a safety guarantee. get_product.archive_scan describes the deliverable archive; my_sales.products[].candidate_archive_scan describes the seller's uploaded version. Both are null until a result is available for that file, then an object with status clean (no significant findings), warning (significant findings to review) or danger (signs of malware), and sanitized findings without secret values, code excerpts or raw logs. findingPolicyVersion=2 identifies the finding-selection policy: high/critical findings count except excluded contextual heuristics. Low/medium findings and detections of keys, tokens or other secrets, including DS-0031, do not affect the public status, findings or findingCount. Ask the seller in chat about any risks.
- Проверка архивов: загруженный ZIP проверяется в фоне. Проверка и её результат не блокируют покупку и выдачу; повторная проверка только при замене ZIP, не при правке текста. Результат не гарантирует безопасность. get_product.archive_scan относится к выдаваемому архиву, my_sales.products[].candidate_archive_scan — к загруженной продавцом версии. До готового результата для файла оба поля равны null; затем это объект со status clean (нет существенных замечаний), warning (существенные замечания для проверки) или danger (признаки вредоносного ПО), и findings без значений секретов, фрагментов кода и сырых логов. findingPolicyVersion=2 обозначает версию политики отбора замечаний: учитываются high/critical, кроме исключённых контекстных эвристик. Low/medium и находки ключей, токенов и других секретов, включая DS-0031, не влияют на публичный статус, findings и findingCount. Риски можно уточнить у продавца в чате.
- Partial reports: significant findings remain visible after a partial failure. partial: true means incomplete checks, only warning/danger, never clean. Частичная проверка: найденные существенные замечания остаются видимыми при частичном сбое. partial: true означает неполную проверку, только warning/danger, никогда clean.
- Product images: prefer a landscape 1280x800 (8:5) cover, with important details near the center and no tiny text near the edges. Responsive catalog previews are center-cropped, so no source ratio guarantees that every edge is visible. Portrait screenshots can follow the cover. New uploads are proportionally resized within 1280x800 without cropping or upscaling, then converted to WebP. The product gallery and full-size view show the whole stored image; previously cropped uploads cannot regain lost content without re-uploading.
- Product descriptions: at most 10,000 Unicode characters including spaces and line breaks, for both publish_product and update_product. Use LF (\n) line breaks. Oversized descriptions are rejected before processing uploads, never silently truncated.
- Other product field limits (web and MCP): name <= 60 Unicode code points, tagline <= 80; preview_url <= 2048 characters and http/https only; stack <= 10 nonempty technologies, includes <= 15 nonempty items. Commas in stack and line breaks in includes split items, including inside array entries; blank items do not count. Leading/trailing whitespace in name/tagline is trimmed, internal spaces count. Over-limit submissions are rejected before uploads, not truncated. On edit, unchanged legacy names/taglines above the limit may be retained; changed values must meet the limits. Omit unchanged fields from update_product.
- Лимиты карточки в UI и MCP: name до 60 символов Unicode, tagline до 80, description до 10 000, preview_url до 2048 (http/https); stack до 10 непустых технологий, includes до 15 непустых пунктов. Запятые в stack и переносы строк в includes разделяют пункты, в том числе внутри элементов массива. Пробелы по краям name/tagline удаляются, внутренние пробелы считаются. Превышение возвращает ошибку до загрузки файлов, данные не обрезаются. Старые длинные name/tagline можно оставить без изменений; новые значения должны соответствовать лимитам. В update_product передавайте только изменяемые поля.
- Emails: buyers get receipts and subscription reminders (3d/1d before expiry); sellers get a letter for every sale, new subscription and renewal.
- Tokens are self-service: cabinet (https://vibedepot.ru/cabinet, section "MCP-токены"), shown once, revocable.
- Payments: card returns a payment_url for the human (bank card checkout); balance debits the Vibedepot wallet instantly and REQUIRES confirm: true — always ask the owner first.
- Crypto (TON/Gram): ton_deposit_info returns the deposit address + your personal memo. Send TON with that memo to top up the SINGLE balance (credited in RUB at the live rate). The balance is unified — pay any product from it regardless of how it was funded. To pay for a product in one transfer, use "{productId}-<your memo>_purchase" for a full purchase or "{productId}-<your memo>_subscription" for a subscription.
- After a purchase, call get_delivery and start by reading start_here.md or README.md inside the project: launch commands, env variables, and license notes live there.
- Sellers: 20% marketplace commission, earnings land on the wallet right after payment; my_sales shows balance and stats, list_product_subscribers shows whose access expired.
- Agents preparing products for sale should run project_readiness_check: README/start_here, launch manifest, .env.example, license, lock file, no secrets in the archive. Turn the readiness result into useful includes items when publishing.