# CodeLifter Forum > CodeLifter Forum collects real questions and worked answers on vibe coding prompts, AI-generated code provenance, project AI policies and MCP tools. Threads open with a short, self-contained answer, then the discussion. Posts marked Staff are written by the forum team and cite primary sources. Dates on every post are machine-readable. Each thread is also available as Markdown: replace the trailing slash of its URL with `.md`. ## [Vibe coding prompts](https://forum.codelifter.com/f/prompts/) Prompts that keep producing bad code: innerHTML, missing keyboard support, extra libraries. Answers show the prompt line that fixes it. - [Do the CodeLifter prompts work with local models?](https://forum.codelifter.com/posts/do-the-codelifter-prompts-work-with-local-models/): Nothing in them is tied to one vendor. - [How do I stop a coding assistant from using innerHTML?](https://forum.codelifter.com/posts/how-do-i-stop-a-coding-assistant-from-using-innerhtml/): Name the ban and its replacement in the prompt itself, for example "write text with textContent, never innerHTML", and say how to build structure instead. - [How do I prompt for JavaScript that works with a keyboard?](https://forum.codelifter.com/posts/how-do-i-prompt-for-javascript-that-works-with-a-keyboard/): Spell it out in the prompt, control by control: real button and link elements for anything clickable, which keys do what, where focus goes after an action, and that the focus outline stays visible. ## [Code provenance](https://forum.codelifter.com/f/provenance/) Who or what wrote a piece of code, how to show it, and what detectors can and cannot tell you. Answers cite the papers and records they rely on. - [What should a provenance record for copied code include?](https://forum.codelifter.com/posts/what-should-a-provenance-record-for-copied-code-include/): Record five things beside the copied code: where it came from, who or what wrote it, its licence as an SPDX identifier, a link to the exact source with the date you copied it, and the date someone las - [A detector flagged code written in 2019 as AI. What now?](https://forum.codelifter.com/posts/a-detector-flagged-code-written-in-2019-as-ai-what-now/): Treat the score as a claim, not a finding, and answer it with records made at the time. - [Can you prove you wrote a piece of code yourself?](https://forum.codelifter.com/posts/can-you-prove-you-wrote-a-piece-of-code-yourself/): Not with certainty, and not with a detector score. ## [AI code policies](https://forum.codelifter.com/f/policy/) Project and workplace rules for AI-written code: which projects ban it, how to disclose it in commits, and how teams enforce a rule. - [Which open source projects ban AI-generated contributions?](https://forum.codelifter.com/posts/which-open-source-projects-ban-ai-generated-contributions/): Six projects in the CodeLifter tracker had a written ban when it was last checked on 15 October 2026: Gentoo, NetBSD, QEMU, Servo, Zig and the GNOME Shell extensions review. - [Who is the author of a commit made through an MCP server?](https://forum.codelifter.com/posts/who-is-the-author-of-a-commit-made-through-an-mcp-server/): In Git terms, whoever the commit names: the account or identity the server used, which is usually yours. - [How can a team enforce an Assisted-by trailer on commits?](https://forum.codelifter.com/posts/how-can-a-team-enforce-an-assisted-by-trailer-on-commits/): Check for the trailer in two places: a commit-msg hook that stops the commit on the developer's machine, and a CI job that checks every commit in a pull request and blocks the merge. ## [MCP and tools](https://forum.codelifter.com/f/mcp-and-tools/) MCP servers, agent skills and coding agents: what each can read, write or reach, how to scope them, and how to keep a mistake contained. - [Which token scopes does the GitHub MCP server need?](https://forum.codelifter.com/posts/which-token-scopes-does-the-github-mcp-server-need/): Only the scopes for the tools you turn on. - [How do you sandbox the Filesystem MCP server?](https://forum.codelifter.com/posts/how-do-you-sandbox-the-filesystem-mcp-server/): Give it one project folder and nothing more. - [Is Playwright MCP worth it for testing vibe-coded apps?](https://forum.codelifter.com/posts/is-playwright-mcp-worth-it-for-testing-vibe-coded-apps/): Yes for exploring, no as your test suite. - [Remote or local GitHub MCP server: which should you run?](https://forum.codelifter.com/posts/remote-or-local-github-mcp-server-which-should-you-run/): Run the remote server if you use github.com and your client supports remote MCP servers: there is nothing to install, and OAuth asks for scopes as tools need them. ## [Script Shelf](https://forum.codelifter.com/f/script-shelf/) The old cut-and-paste scripts from the original library: what happened to them, what replaced them, and whether old snippets still run. - [Do old cut-and-paste scripts still work in current browsers?](https://forum.codelifter.com/posts/do-old-cut-and-paste-scripts-still-work-in-current-browsers/): Some run unchanged, many half work, and a few fail without any error on screen. - [What happened to the old image rollover script?](https://forum.codelifter.com/posts/what-happened-to-the-old-image-rollover-script/): It was not restored, because the editors cannot trace a CodeLifter rollover page in the surviving link records, and the effect no longer needs a script. - [Is it safe to paste a script from an old tutorial site?](https://forum.codelifter.com/posts/is-it-safe-to-paste-a-script-from-an-old-tutorial-site/): Reading it is safe, pasting it unchanged is a manageable risk, and linking to the copy on the old site is the real danger. ## Site - [Posting guidelines](https://forum.codelifter.com/guidelines/) - [About and who answers](https://forum.codelifter.com/about/) - [Contact](https://forum.codelifter.com/contact/) - [Atom feed](https://forum.codelifter.com/rss.xml) - [Sitemap](https://forum.codelifter.com/sitemap.xml)