# Security Scanner for AI App Builders and Coding Agents

Cyfendo checks the code your agent writes for security issues an attacker could exploit. It speaks up only when it proves an issue with a safe test attack in an isolated sandbox, and it gives your agent the steps to fix it, or a tested patch on request.

- Server URL: https://mcp.cyfendo.com/mcp
- Transport: Streamable HTTP
- Sign-in: OAuth 2.1, or a Cyfendo API key

## Setup guides

- [Lovable](https://cyfendo.com/docs/integration/lovable) (https://cyfendo.com/docs/integration/lovable.md): Security checks while Lovable builds your app.
- [Bolt](https://cyfendo.com/docs/integration/bolt) (https://cyfendo.com/docs/integration/bolt.md): Let Bolt check auth, data access and payments code as it writes it.
- [Replit](https://cyfendo.com/docs/integration/replit) (https://cyfendo.com/docs/integration/replit.md): One click to add Cyfendo to Replit Agent.
- [v0](https://cyfendo.com/docs/integration/v0) (https://cyfendo.com/docs/integration/v0.md): Check generations that touch auth, data or payments before v0 finishes.
- [Cursor](https://cyfendo.com/docs/integration/cursor) (https://cyfendo.com/docs/integration/cursor.md): One click to add Cyfendo to Cursor's agent.
- [Devin Desktop](https://cyfendo.com/docs/integration/devin-desktop) (https://cyfendo.com/docs/integration/devin-desktop.md): Add Cyfendo to Devin Desktop (formerly Windsurf) and its Devin Local agent.
- [Claude Code](https://cyfendo.com/docs/integration/claude-code) (https://cyfendo.com/docs/integration/claude-code.md): One command adds Cyfendo to Claude Code.
- [VS Code (Copilot)](https://cyfendo.com/docs/integration/vscode) (https://cyfendo.com/docs/integration/vscode.md): One click to add Cyfendo to GitHub Copilot's agent mode.
- [OpenAI Codex](https://cyfendo.com/docs/integration/codex) (https://cyfendo.com/docs/integration/codex.md): Two commands add Cyfendo to Codex.
- [Google Antigravity](https://cyfendo.com/docs/integration/antigravity) (https://cyfendo.com/docs/integration/antigravity.md): Add Cyfendo to Antigravity's agents.

## How to set up

1. **Add Cyfendo to your app.** One click in Replit, Cursor and VS Code. In Lovable, Bolt and v0, paste the server URL; in Devin Desktop and Antigravity, add it to the config file; in Claude Code and Codex, run one command.
2. **Sign in and click Allow.** Your app opens Cyfendo in your browser. New to Cyfendo? Continue with Google creates a free account in the same step. If your app asks before each tool call, let it run Cyfendo's tools without asking, so checks don't stop for approval.
3. **Tell your agent when to check.** Paste a short instruction into your project's rules (Knowledge in Lovable and Bolt, Instructions in v0, replit.md, AGENTS.md or CLAUDE.md). Your agent then checks risky changes on its own.

## How it works

1. **Connect once.** Add Cyfendo to your app builder or coding agent and sign in. It takes a minute or two.
2. **Your agent checks risky changes.** When it finishes a task that touched login, data access, payments, uploads or API routes, your agent asks Cyfendo to check, once. Harmless changes are skipped instantly.
3. **Proven issues reach your chat.** Checks run in the background while your agent keeps working. Cyfendo tries a safe attack in an isolated sandbox; only issues it proves reach your chat, each with plain fix steps. Your agent can also ask for a tested patch.

## Tools

- `cyfendo_check_changes`: Starts a check of the files a finished task changed and returns right away; the check runs in the background. Skips changes that can't affect security. Reports only issues Cyfendo proved with a safe test attack, each with plain fix steps.
- `cyfendo_scan_project`: Runs a full scan with exploit confirmation. Use it after connecting and before publishing.
- `cyfendo_get_results`: Gets the progress or results of a check, scan, verification or fix. Finished results also arrive with the agent's next Cyfendo call.
- `cyfendo_generate_fix`: Builds a patch for a confirmed issue against your current code and tests it by replaying the attack.
- `cyfendo_get_fix`: Returns the fix steps, plus the tested diff once one has been built. Your agent shows you the change before applying it.
- `cyfendo_verify_fix`: Replays the original attack against your updated code to confirm the fix works.
- `cyfendo_status`: Shows your connected account, the confirmed issues still open, checks still running, and finished results. Your agent calls it at the start of each request.

## Other apps

Cyfendo works with any AI app or coding agent that can add a custom connector by URL. Add the server URL (https://mcp.cyfendo.com/mcp), or a configuration like this:

```json
{
  "mcpServers": {
    "cyfendo": {
      "url": "https://mcp.cyfendo.com/mcp"
    }
  }
}
```

## Use an API key instead

Use a Cyfendo API key from Settings → Developer as `Authorization: Bearer <key>` or the `X-Cyfendo-Api-Key` header. To use a team workspace, also send `X-Cyfendo-Workspace-Id`. An API key gives the app the same access you have, so prefer OAuth when the app supports it.

## Questions

### Do I need a Cyfendo account?

Yes, a free one. When you connect from your app, Continue with Google creates the account and takes you straight to the Allow screen. If you sign up with email, confirm your email address first, then start the connection again from your app.

### Which apps work with Cyfendo?

Any AI app or coding agent that can add a custom connector by URL. These guides cover Lovable, Bolt, Replit, v0, Cursor, Devin Desktop (formerly Windsurf), Claude Code, VS Code with GitHub Copilot, OpenAI Codex and Google Antigravity step by step.

### Does Cyfendo change my code?

No. Cyfendo only reads the code your app sends. Your app's agent applies fixes after you approve them.

### What does Cyfendo report in chat?

Only issues it proved with a safe test attack in an isolated sandbox. Possible issues it could not prove are listed in the Cyfendo dashboard instead.

### Why did a check say it was skipped?

Changes to styles, text, images, tests, and layout-only components can't introduce the vulnerabilities Cyfendo tests for, so they are skipped instantly.

### Why does a check say it is still running?

Proving an attack takes several minutes, so your agent keeps working while the check runs. The results arrive with its next Cyfendo call, labelled with the check number and whether the code has changed since. Cyfendo notifies you when a check finishes.

### When does my agent run Cyfendo?

Once at the end of each task that touched login, data access, payments, uploads, API routes or secrets, and a full scan when you say you're getting ready to publish. It also collects finished results at the start of each request.

### How does a full scan see my whole project?

If your app syncs to GitHub and you connect that repository in Cyfendo (Settings → Integrations → Git), Cyfendo reads the repository directly. Otherwise, or if Cyfendo can't read the repository, your agent uploads the source files in parts of up to 50 files; the scan starts when the last part arrives.

### How does Cyfendo keep my projects apart?

Each project gets its own Cyfendo project ID the first time it's checked, for example lovable-expense-tracker-k7q2xm. Your agent saves it in cyfendo.json at the project root and sends it with every call, so results never mix between projects, even ones with the same name. Your Cyfendo dashboard lists the project under the same ID. If you remix or copy a project, delete cyfendo.json in the copy so it gets its own ID.

### Does Cyfendo write the fix?

Each finding comes with plain fix steps, and most agents write the fix themselves. Your agent can also ask Cyfendo to build a patch and test it against the original attack.

### Can I use an API key instead of signing in?

Yes. Use a Cyfendo API key from Settings → Developer as a bearer token, or as the X-Cyfendo-Api-Key header. The key gives the app the same access you have, so prefer OAuth when the app supports it.

### How do I disconnect an app?

Settings → Connected apps → Disconnect. The app loses access immediately. If the app uses an API key, delete the key in Settings → Developer.