What it covers #
Norma ships rules for exactly the stack Lovable produces. A first check on a real project commonly surfaces things like:
- A Supabase service-role key exposed in the client bundle.
- Auth guards with inverted logic.
useEffectloops that freeze the tab.- Missing error boundaries.
- A missing Content Security Policy that blocks compliance sign-off.
Free tier is permanent. Unlimited enforcement in the editor, no trial clock.
Setup #
1. Add Norma as a connector #
In your Lovable project, open the connectors panel and add a custom MCP server:
| Field | Value |
|---|---|
| Name | Norma |
| Server URL | https://api.qualityclouds.ai/mcp |
| Transport | HTTP |
| Auth | OAuth. Your browser opens to sign in on first connection. |
No account yet? Sign up at norma.qualityclouds.com, free, no card required.
2. Set the standing rule #
Send this once, as a normal chat message. Lovable saves it as a standing rule for the project, so you never have to mention Norma again:
From now on, for every file you create or change, run it through Norma and fix the issues it returns.
3. Link your repository #
This step is not optional. Lovable’s internal git remote is a tokenised URL it will not send to a third party, so the audit trail stays empty until you link a public repository yourself. Live checks work without this step; the audit record does not.
Paste your repository URL in chat:
this is my github repo for this app: https://github.com/yourname/yourrepo
Do this at the start of the project. Evidence from tasks run before linking cannot be recovered afterward.
How it changes the build loop #
Nothing slows down. What changes is that the agent stops handing you work it has not checked. A feature-removal request, for example, now comes back with the removal confirmed and a note that Norma flagged and fixed three pre-existing issues in the surrounding code before it was returned to you.
Troubleshooting #
| Symptom | Fix |
|---|---|
| “Link a repository first” | Paste your GitHub URL in chat and ask Lovable to link it. Once per project, at the start. |
| Audit entries reference rules that were not relevant to the change | Add an instruction telling the agent to only reference rules it actually evaluated. See the full guide for the exact wording. |
| A tool result gets truncated on a large ruleset | Do not pull every ruleset up front. Let live_check surface findings with their own rule metadata, and only fetch a full ruleset when you need to read the standards directly. |
Full guide #
Setup detail, the stricter standing-rule wording, an auditing workflow for existing projects, and complete troubleshooting live in the Norma MCP server repository and are kept up to date there:
➜ github.com/qualityclouds/hub-mcp/blob/main/docs/LOVABLE.md
Related #
- MCP and Local Editors — the general MCP setup for any editor.
- Livecheck — checking a single file in real time.
- Norma MCP server on GitHub — the canonical setup and tool reference.
