Setup · about 2 minutes
Set it up
-
In Lovable, open Connectors, click + at the top right of the catalog, and choose MCP server (not Custom connector, which is for describing an API).
-
Server name: Cyfendo. Keep Direct connection, and enter the server URL
https://mcp.cyfendo.com/mcp. -
Keep OAuth selected and click Add & authorize.
-
Sign in to Cyfendo and click Allow.
-
Back in Lovable, Cyfendo's settings open. Turn on Always allow all tools from this connection, so Lovable runs Cyfendo's checks at the end of a task without stopping to ask you. Cyfendo's tools never change your code.
-
In your project, open Project settings (press ⌘ . or Ctrl . , or click + next to the chat box → Project → Settings), go to the Knowledge tab and paste the instruction below, so Lovable checks risky changes automatically.
Get the instruction
New to Cyfendo? Choose Continue with Google to create a free account in the same step. If you sign up with email instead, confirm your email first, then start the connection again from your app.
Recommended
Teach your agent when to check
Paste this into Project settings → Knowledge so Lovable calls Cyfendo on its own after risky changes and tells you when results are ready.
Security: I've connected Cyfendo. Cyfendo identifies this project by the project_id in cyfendo.json at the project root: pass it in every Cyfendo call. If that file doesn't exist, the first Cyfendo check or scan creates the project; save the project_id it returns to cyfendo.json right away. At the start of each of my requests, call cyfendo_status and tell me about any finished Cyfendo results (earlier_results) before doing anything else. When you finish a task that changed login, permissions, database access or Supabase policies, payments, file uploads, API routes or anything with secrets, call cyfendo_check_changes once with all the files the task changed and a short label, and don't wait for the result. For a confirmed issue that is still current, fix it as its fix_steps describe (or ask for Cyfendo's tested patch with cyfendo_generate_fix, then cyfendo_get_fix), show me the change once I approve, then run cyfendo_verify_fix. When I say I'm getting ready to publish, run cyfendo_scan_project.
Check it works
Try it
Send one of these to Lovable's agent.
-
Check that it's connected
Use Cyfendo to show my security status.
-
Check a change
Check the files you just changed with Cyfendo.
-
Collect finished results
Collect any Cyfendo results that are ready.
-
Before you publish
I'm getting ready to publish. Run a full Cyfendo security scan.
Before you launch
Lovable app security
Is my Lovable app secure?
That depends on what Lovable built for your app. Lovable sets up hosting, sign-in and a Supabase database, but the rules that decide who can read and change your data are written for each app. The most common hole in Lovable apps is a table that anyone with the app's public key can read or change, because row-level security (RLS) is off or a policy is too loose. That was the cause of CVE-2025-48757. Check every table, keep secret keys out of the browser, and make sure your edge functions check who is calling.
Doesn't Lovable already scan for security issues?
Yes. Lovable runs a quick scan when you open the publish dialog, covering database access rules, critical dependency vulnerabilities and unprotected MCP servers, and a deep scan you start from its Security view reviews all your code. Those scans read your code and settings. Cyfendo does a different job: it tries a safe attack against your app's code in an isolated sandbox and reports only issues the attack proves, each with fix steps. Use both.
Can Cyfendo test my Supabase policies?
Yes, when your project's Supabase migration files (usually in supabase/migrations) are part of the code it checks. Cyfendo starts a stand-in Supabase with two test users and tries to read or change one user's rows as the other, or with only the public key. Policies it can't interpret are treated as locked, so it never reports a leak it hasn't shown.
Good to know
- Each project gets its own Cyfendo project ID on its first check, and the agent saves it in cyfendo.json for you: don't create that file yourself. If you remix, fork or duplicate a project, delete cyfendo.json in the copy (or ask the agent to), so the copy starts its own check history instead of adding to the original's.
- Custom servers work on every Lovable plan, including Free. If MCP server is greyed out in the + menu, a workspace admin has turned off custom servers for your workspace: ask them to turn it back on.
- Connections are personal: once connected, Cyfendo is available in all your Lovable projects. The instruction is per project: add it to the Knowledge of each project you want checked.
- If your project is connected to GitHub, you can commit the instruction as AGENTS.md at the root of the repository instead. Lovable reads that file on every message too.
- Tool permissions: Lovable runs Cyfendo's read-only tools (status, results, fix steps) without asking, and by default asks before the others. To approve full scans yourself, set Scan project to ask (the ? icon) under Manage my agent's permissions. To change any of this later, open Connectors and select Cyfendo. If you skipped the step above, choose Always allow on the approval card the first time Lovable asks.
- Full scans: if your app syncs to a GitHub repository and that repository is connected in Cyfendo (Settings → Integrations → Git), the agent asks Cyfendo to scan the repository directly, whatever its size. Without it, or if Cyfendo can't read the repository, the agent uploads the source files in parts of up to 50 files, which takes longer and uses more of your Lovable usage.
- Sign in with OAuth (recommended). If you can't use OAuth, use a Cyfendo API key as a bearer token.
Troubleshooting
The sign-in window doesn't open
Your browser blocked the popup. Allow popups for your app builder's site, then click the authorize or connect button again.
I can't find my personal workspace
On a business account, your own workspace is your business workspace, so it carries your organization's name. Pick the one marked "your workspace".
The connection test fails
Check the server URL is exactly https://mcp.cyfendo.com/mcp (with /mcp at the end) and, if your app asks, that the transport is HTTP (Streamable HTTP), not SSE.
A check stays "running"
Proving an attack takes several minutes, so checks run in the background. Your agent can only report a result when you send it a message: Cyfendo notifies you when a check finishes, then send your agent "Collect any Cyfendo results that are ready." A check stops testing after about 15 minutes and reports what it has.