Security checks inside your AI coding tools

Cyfendo checks the code your agent writes for security issues an attacker could exploit. It speaks up only when it proves an issue with a safe test attack in an isolated sandbox, and it gives your agent the steps to fix it, or a tested patch on request.

Setup guides

Pick your app

Each guide takes a minute or two, shows every click, and ends with a quick test.

App builders

Lovable Paste URL Security checks while Lovable builds your app. Set up in 2 min Bolt Paste URL Let Bolt check auth, data access and payments code as it writes it. Set up in 2 min Replit One click One click to add Cyfendo to Replit Agent. Set up in 1 min v0 Paste URL Check generations that touch auth, data or payments before v0 finishes. Set up in 2 min

Coding agents and editors

Cursor One click One click to add Cyfendo to Cursor's agent. Set up in 2 min Devin Desktop Config file Add Cyfendo to Devin Desktop (formerly Windsurf) and its Devin Local agent. Set up in 2 min Claude Code One command One command adds Cyfendo to Claude Code. Set up in 2 min VS Code (Copilot) One click One click to add Cyfendo to GitHub Copilot's agent mode. Set up in 2 min OpenAI Codex Two commands Two commands add Cyfendo to Codex. Set up in 2 min Google Antigravity Config file Add Cyfendo to Antigravity's agents. Set up in 2 min

How to set up

Three steps in every app

The guides walk through each step for your app. Here is what they have in common.

  1. Add Cyfendo to your app

    One click in Replit, Cursor and VS Code. In Lovable, Bolt and v0, paste the server URL; in Devin Desktop and Antigravity, add it to the config file; in Claude Code and Codex, run one command.

  2. Sign in and click Allow

    Your app opens Cyfendo in your browser. New to Cyfendo? Continue with Google creates a free account in the same step. If your app asks before each tool call, let it run Cyfendo's tools without asking, so checks don't stop for approval.

  3. Tell your agent when to check

    Paste a short instruction into your project's rules (Knowledge in Lovable and Bolt, Instructions in v0, replit.md, AGENTS.md or CLAUDE.md). Your agent then checks risky changes on its own.

How it works

Your agent builds, Cyfendo checks

  1. Connect once

    Add Cyfendo to your app builder or coding agent and sign in. It takes a minute or two.

  2. Your agent checks risky changes

    When it finishes a task that touched login, data access, payments, uploads or API routes, your agent asks Cyfendo to check, once. Harmless changes are skipped instantly.

  3. Proven issues reach your chat

    Checks run in the background while your agent keeps working. Cyfendo tries a safe attack in an isolated sandbox; only issues it proves reach your chat, each with plain fix steps. Your agent can also ask for a tested patch.

Tools

What your agent can do

  • cyfendo_check_changes

    Starts a check of the files a finished task changed and returns right away; the check runs in the background. Skips changes that can't affect security. Reports only issues Cyfendo proved with a safe test attack, each with plain fix steps.

  • cyfendo_scan_project

    Runs a full scan with exploit confirmation. Use it after connecting and before publishing.

  • cyfendo_get_results

    Gets the progress or results of a check, scan, verification or fix. Finished results also arrive with the agent's next Cyfendo call.

  • cyfendo_generate_fix

    Builds a patch for a confirmed issue against your current code and tests it by replaying the attack.

  • cyfendo_get_fix

    Returns the fix steps, plus the tested diff once one has been built. Your agent shows you the change before applying it.

  • cyfendo_verify_fix

    Replays the original attack against your updated code to confirm the fix works.

  • cyfendo_status

    Shows your connected account, the confirmed issues still open, checks still running, and finished results. Your agent calls it at the start of each request.

Other apps

Using another AI tool?

Cyfendo works with any AI app or coding agent that can add a custom connector by URL. Add the server URL, or a configuration like the one below, then sign in to Cyfendo when the app asks.

Server URL https://mcp.cyfendo.com/mcp
Configuration (JSON) 
{
  "mcpServers": {
    "cyfendo": {
      "url": "https://mcp.cyfendo.com/mcp"
    }
  }
}

Use an API key instead

If your app can't sign in with OAuth, send a Cyfendo API key from Settings → Developer as Authorization: Bearer <key> or the X-Cyfendo-Api-Key header. It carries your own access, so prefer OAuth when you can.

Use a team workspace

Pick the workspace on the sign-in screen. With an API key, also send X-Cyfendo-Workspace-Id; otherwise your default workspace is used.

Scan a private repository

Connect it once in Settings → Git connections with a read-only token.

FAQ

Questions

Do I need a Cyfendo account?

Yes, a free one. When you connect from your app, Continue with Google creates the account and takes you straight to the Allow screen. If you sign up with email, confirm your email address first, then start the connection again from your app.

Which apps work with Cyfendo?

Any AI app or coding agent that can add a custom connector by URL. These guides cover Lovable, Bolt, Replit, v0, Cursor, Devin Desktop (formerly Windsurf), Claude Code, VS Code with GitHub Copilot, OpenAI Codex and Google Antigravity step by step.

Does Cyfendo change my code?

No. Cyfendo only reads the code your app sends. Your app's agent applies fixes after you approve them.

What does Cyfendo report in chat?

Only issues it proved with a safe test attack in an isolated sandbox. Possible issues it could not prove are listed in the Cyfendo dashboard instead.

Why did a check say it was skipped?

Changes to styles, text, images, tests, and layout-only components can't introduce the vulnerabilities Cyfendo tests for, so they are skipped instantly.

Why does a check say it is still running?

Proving an attack takes several minutes, so your agent keeps working while the check runs. The results arrive with its next Cyfendo call, labelled with the check number and whether the code has changed since. Cyfendo notifies you when a check finishes.

When does my agent run Cyfendo?

Once at the end of each task that touched login, data access, payments, uploads, API routes or secrets, and a full scan when you say you're getting ready to publish. It also collects finished results at the start of each request.

How does a full scan see my whole project?

If your app syncs to GitHub and you connect that repository in Cyfendo (Settings → Integrations → Git), Cyfendo reads the repository directly. Otherwise, or if Cyfendo can't read the repository, your agent uploads the source files in parts of up to 50 files; the scan starts when the last part arrives.

How does Cyfendo keep my projects apart?

Each project gets its own Cyfendo project ID the first time it's checked, for example lovable-expense-tracker-k7q2xm. Your agent saves it in cyfendo.json at the project root and sends it with every call, so results never mix between projects, even ones with the same name. Your Cyfendo dashboard lists the project under the same ID. If you remix or copy a project, delete cyfendo.json in the copy so it gets its own ID.

Does Cyfendo write the fix?

Each finding comes with plain fix steps, and most agents write the fix themselves. Your agent can also ask Cyfendo to build a patch and test it against the original attack.

Can I use an API key instead of signing in?

Yes. Use a Cyfendo API key from Settings → Developer as a bearer token, or as the X-Cyfendo-Api-Key header. The key gives the app the same access you have, so prefer OAuth when the app supports it.

How do I disconnect an app?

Settings → Connected apps → Disconnect. The app loses access immediately. If the app uses an API key, delete the key in Settings → Developer.

Last updated · View as Markdown