# Connect Cyfendo to Google Antigravity

Add Cyfendo to Antigravity's agents.

- Server URL: https://mcp.cyfendo.com/mcp
- Transport: Streamable HTTP
- Sign-in: OAuth: Antigravity signs in to Cyfendo through your browser. As a fallback, add an Authorization: Bearer header with a Cyfendo API key.
- Time: about 2 minutes

## Steps

1. In the Antigravity IDE, open Settings → Antigravity IDE Settings → Customizations. Under Installed MCP Servers, click Open MCP Config. (In the Antigravity app: Settings at the bottom left → Customizations.) The file is ~/.gemini/config/mcp_config.json, shared by the Antigravity app, IDE and CLI.
2. Add the configuration below and save. Back in Customizations, click Refresh: Cyfendo appears under Installed MCP Servers.
3. Click Authenticate next to Cyfendo. Your browser opens Cyfendo: sign in and click Allow. Antigravity then shows a code: copy it, paste it into Customizations and click Submit. Once signed in, Cyfendo shows Sign out.
4. Antigravity asks before each MCP tool call by default. So that Cyfendo's checks run without stopping, add the permission rule mcp(cyfendo/*) to your allow list (in the Antigravity CLI, run /permissions).
5. Add the instruction below to AGENTS.md at the root of your project (the clicks are listed with the instruction). On the first check, Cyfendo gives the project its own ID and the agent saves it in cyfendo.json: commit that file with your code.

New to Cyfendo? Choose Continue with Google to create a free account in the same step. If you sign up with email instead, confirm your email first, then start the connection again from your app.

## Configuration (mcp_config.json)

```json
{
  "mcpServers": {
    "cyfendo": {
      "serverUrl": "https://mcp.cyfendo.com/mcp"
    }
  }
}
```

## Project instruction (paste into AGENTS.md)

How to add it in Antigravity:

1. Click Copy on the instruction below.
2. In the Antigravity IDE, open the Explorer (⇧⌘E on Mac, Ctrl+Shift+E on Windows and Linux). If AGENTS.md already exists in your project, open it and go to step 4.
3. Otherwise, right-click an empty area below the file list, choose New File…, type AGENTS.md and press Enter. It must be at the top level of the project, not inside a folder.
4. Paste the instruction at the end of the file and save (⌘S on Mac, Ctrl+S on Windows and Linux).

- Prefer not to edit files? Send Antigravity's agent the message “Add this to AGENTS.md at the root of the project, word for word:” followed by the instruction.
- To use it in every project instead, paste it into ~/.gemini/AGENTS.md (create the file if it doesn't exist).

```text
## Security checks (Cyfendo)
Cyfendo identifies this project by the project_id in cyfendo.json at the project root. Pass it in every Cyfendo call. If the file doesn't exist, the first check or scan creates the project: save the project_id it returns to cyfendo.json and keep the file with the code.
- At the start of each of my requests, call cyfendo_status and tell me about any earlier_results before doing anything else.
- When you finish a task that changed login, sessions, permissions, database access, payments, file uploads, API routes or secrets, call cyfendo_check_changes once with all the files the task changed (list deleted files under deleted) and a short label. Don't wait for the result.
- For a confirmed issue that is still current, fix it as its fix_steps describe, or call cyfendo_generate_fix and then cyfendo_get_fix for Cyfendo's tested patch and show me the diff before applying it. Then call cyfendo_verify_fix.
- When I say I'm getting ready to release, call cyfendo_scan_project with this repository as a git source if it is pushed to GitHub, GitLab or Bitbucket; otherwise upload the source files in parts. Tell me when it has finished.
```

## Try it

- Check that it's connected: "Use Cyfendo to show my security status."
- Check a change: "Check the files you just changed with Cyfendo."
- Collect finished results: "Collect any Cyfendo results that are ready."
- Before you publish: "I'm getting ready to publish. Run a full Cyfendo security scan."

## Security questions

### Is the code Antigravity writes secure?

Usually it works, and working code can still be exploitable: an endpoint that skips an ownership check, a query built from user input, a file path taken straight from a request. These bugs look normal in review, which is why they ship.

### Doesn't Antigravity already review its code?

Antigravity's agents can review their own work when you ask. A review reads the code and judges whether it looks risky. Cyfendo tries a safe attack against your app's code in an isolated sandbox and reports only issues the attack proves, each with fix steps. Your agent fixes real problems instead of arguing with false alarms.

### When does Antigravity call Cyfendo?

With the instruction in AGENTS.md: once at the end of each task that touched login, permissions, data access, payments, uploads, API routes or secrets, and a full scan when you say you're getting ready to release. Changes to styles, text and tests are skipped.

## Good to know

- Commit cyfendo.json with your code: every clone of the repository, and every coding agent working on it, then shares the project's Cyfendo results. If you copy the code into a separate project, delete cyfendo.json in the copy so it gets its own ID.
- Full scans: when the project is pushed to GitHub, GitLab or Bitbucket, connect that repository in Cyfendo (Settings → Integrations → Git) and Cyfendo reads it directly, whatever its size. Public repositories need no setup. Otherwise the agent uploads the source files in parts of up to 50 files.
- For one workspace only, put the configuration in .agents/mcp_config.json instead.
- To use an API key instead of signing in, add "headers": {"Authorization": "Bearer your key"} to the cyfendo entry.

## Troubleshooting

- **The sign-in window doesn't open.** Your browser blocked the popup. Allow popups for your app builder's site, then click the authorize or connect button again.
- **I can't find my personal workspace.** On a business account, your own workspace is your business workspace, so it carries your organization's name. Pick the one marked "your workspace".
- **The connection test fails.** Check the server URL is exactly https://mcp.cyfendo.com/mcp (with /mcp at the end) and, if your app asks, that the transport is HTTP (Streamable HTTP), not SSE.
- **A check stays "running".** Proving an attack takes several minutes, so checks run in the background. Your agent can only report a result when you send it a message: Cyfendo notifies you when a check finishes, then send your agent "Collect any Cyfendo results that are ready." A check stops testing after about 15 minutes and reports what it has.

More guides: https://cyfendo.com/docs/integration