Setup · about 2 minutes
Set it up
-
In Bolt, click + in the chat box → Connectors → Manage connectors, then click Custom MCP server.
-
Name: Cyfendo. URL:
https://mcp.cyfendo.com/mcp. Transport: HTTP (not SSE). -
Authentication: MCP OAuth. Click Connect, sign in to Cyfendo, and click Allow.
-
Turn on Auto-enable for all projects. For a project you already have, open it, click + in the chat box → Connectors and turn Cyfendo on.
-
Open Project settings (the gear icon at the top of your project → All project settings), go to Knowledge and paste the instruction below. To use it in every project, paste it into Account Knowledge instead.
Get the instruction
New to Cyfendo? Choose Continue with Google to create a free account in the same step. If you sign up with email instead, confirm your email first, then start the connection again from your app.
Recommended
Teach your agent when to check
Paste this into Project settings → Knowledge so Bolt calls Cyfendo on its own after risky changes and tells you when results are ready.
Cyfendo identifies this project by the project_id in cyfendo.json at the project root: pass it in every Cyfendo call. If that file doesn't exist, the first Cyfendo check or scan creates the project; save the project_id it returns to cyfendo.json right away. At the start of each of my requests, call cyfendo_status and tell me about any finished Cyfendo results first. When you finish a task that changed authentication, permissions, database queries, payments, uploads, API routes or secrets, call cyfendo_check_changes once with all the files the task changed and a short label, without waiting for the result. For any confirmed issue that is still current, fix it as its fix_steps describe or get Cyfendo's tested patch (cyfendo_generate_fix, then cyfendo_get_fix), show me the change, and confirm it with cyfendo_verify_fix. When I say I'm getting ready to deploy, run cyfendo_scan_project.
Check it works
Try it
Send one of these to Bolt's agent.
-
Check that it's connected
Use Cyfendo to show my security status.
-
Check a change
Check the files you just changed with Cyfendo.
-
Collect finished results
Collect any Cyfendo results that are ready.
-
Before you publish
I'm getting ready to publish. Run a full Cyfendo security scan.
Before you launch
Bolt app security
Is my Bolt app secure?
Bolt writes the whole app, from the pages to the database and sign-in, so its security depends on the code and permissions Bolt wrote for your app. The usual gaps are tables without row-level security or with policies that let any signed-in user read everyone's rows, API routes that don't check who is calling, and secret keys that end up in browser code.
Doesn't Bolt already run a security audit?
Bolt checks for security problems when you publish, and on paid plans you can run a full security audit from the Publish menu that reviews your code and database and fixes most problems itself. Like any review, it judges the code by reading it. Cyfendo tries a safe attack against your app's code in an isolated sandbox and reports only issues the attack proves, each with fix steps. You know which issues are real before you launch.
What does Cyfendo check in a Bolt app?
Changes that touch sign-in, permissions, database queries and policies, payments, file uploads, API routes and secrets. Bolt calls Cyfendo once at the end of each such task, and changes to styles, text and layout are skipped. Say you're getting ready to deploy and Bolt runs a full Cyfendo scan.
Good to know
- Each project gets its own Cyfendo project ID on its first check, and the agent saves it in cyfendo.json for you: don't create that file yourself. If you remix, fork or duplicate a project, delete cyfendo.json in the copy (or ask the agent to), so the copy starts its own check history instead of adding to the original's.
- Choose the HTTP transport. Cyfendo does not support the older SSE transport.
- Bolt turns on all of Cyfendo's tools when you connect. Keep them all on: turning a tool off (… → Edit) applies to every project. Only a project's owner can connect a server and ask Bolt to use it.
- Full scans: if your app syncs to a GitHub repository and that repository is connected in Cyfendo (Settings → Integrations → Git), the agent asks Cyfendo to scan the repository directly, whatever its size. Without it, or if Cyfendo can't read the repository, the agent uploads the source files in parts of up to 50 files, which takes longer and uses more of your Bolt usage.
- Sign in with OAuth (recommended), or use a Cyfendo API key.
Troubleshooting
The sign-in window doesn't open
Your browser blocked the popup. Allow popups for your app builder's site, then click the authorize or connect button again.
I can't find my personal workspace
On a business account, your own workspace is your business workspace, so it carries your organization's name. Pick the one marked "your workspace".
The connection test fails
Check the server URL is exactly https://mcp.cyfendo.com/mcp (with /mcp at the end) and, if your app asks, that the transport is HTTP (Streamable HTTP), not SSE.
A check stays "running"
Proving an attack takes several minutes, so checks run in the background. Your agent can only report a result when you send it a message: Cyfendo notifies you when a check finishes, then send your agent "Collect any Cyfendo results that are ready." A check stops testing after about 15 minutes and reports what it has.