# Connect Cyfendo to Lovable

Security checks while Lovable builds your app.

- Server URL: https://mcp.cyfendo.com/mcp
- Transport: Streamable HTTP
- Sign-in: Sign in with OAuth (recommended). If you can't use OAuth, use a Cyfendo API key as a bearer token.
- Time: about 2 minutes

## Steps

1. In Lovable, open Connectors, click + at the top right of the catalog, and choose MCP server (not Custom connector, which is for describing an API).
2. Server name: Cyfendo. Keep Direct connection, and enter the server URL https://mcp.cyfendo.com/mcp.
3. Keep OAuth selected and click Add & authorize.
4. Sign in to Cyfendo and click Allow.
5. Back in Lovable, Cyfendo's settings open. Turn on Always allow all tools from this connection, so Lovable runs Cyfendo's checks at the end of a task without stopping to ask you. Cyfendo's tools never change your code.
6. In your project, open Project settings (press ⌘ . or Ctrl . , or click + next to the chat box → Project → Settings), go to the Knowledge tab and paste the instruction below, so Lovable checks risky changes automatically.

New to Cyfendo? Choose Continue with Google to create a free account in the same step. If you sign up with email instead, confirm your email first, then start the connection again from your app.

## Project instruction (paste into Project settings → Knowledge)

```text
Security: I've connected Cyfendo. Cyfendo identifies this project by the project_id in cyfendo.json at the project root: pass it in every Cyfendo call. If that file doesn't exist, the first Cyfendo check or scan creates the project; save the project_id it returns to cyfendo.json right away. At the start of each of my requests, call cyfendo_status and tell me about any finished Cyfendo results (earlier_results) before doing anything else. When you finish a task that changed login, permissions, database access or Supabase policies, payments, file uploads, API routes or anything with secrets, call cyfendo_check_changes once with all the files the task changed and a short label, and don't wait for the result. For a confirmed issue that is still current, fix it as its fix_steps describe (or ask for Cyfendo's tested patch with cyfendo_generate_fix, then cyfendo_get_fix), show me the change once I approve, then run cyfendo_verify_fix. When I say I'm getting ready to publish, run cyfendo_scan_project.
```

## Try it

- Check that it's connected: "Use Cyfendo to show my security status."
- Check a change: "Check the files you just changed with Cyfendo."
- Collect finished results: "Collect any Cyfendo results that are ready."
- Before you publish: "I'm getting ready to publish. Run a full Cyfendo security scan."

## Lovable app security

### Is my Lovable app secure?

That depends on what Lovable built for your app. Lovable sets up hosting, sign-in and a Supabase database, but the rules that decide who can read and change your data are written for each app. The most common hole in Lovable apps is a table that anyone with the app's public key can read or change, because row-level security (RLS) is off or a policy is too loose. That was the cause of CVE-2025-48757. Check every table, keep secret keys out of the browser, and make sure your edge functions check who is calling.

### Doesn't Lovable already scan for security issues?

Yes. Lovable runs a quick scan when you open the publish dialog, covering database access rules, critical dependency vulnerabilities and unprotected MCP servers, and a deep scan you start from its Security view reviews all your code. Those scans read your code and settings. Cyfendo does a different job: it tries a safe attack against your app's code in an isolated sandbox and reports only issues the attack proves, each with fix steps. Use both.

### Can Cyfendo test my Supabase policies?

Yes, when your project's Supabase migration files (usually in supabase/migrations) are part of the code it checks. Cyfendo starts a stand-in Supabase with two test users and tries to read or change one user's rows as the other, or with only the public key. Policies it can't interpret are treated as locked, so it never reports a leak it hasn't shown.

## Good to know

- Each project gets its own Cyfendo project ID on its first check, and the agent saves it in cyfendo.json for you: don't create that file yourself. If you remix, fork or duplicate a project, delete cyfendo.json in the copy (or ask the agent to), so the copy starts its own check history instead of adding to the original's.
- Custom servers work on every Lovable plan, including Free. If MCP server is greyed out in the + menu, a workspace admin has turned off custom servers for your workspace: ask them to turn it back on.
- Connections are personal: once connected, Cyfendo is available in all your Lovable projects. The instruction is per project: add it to the Knowledge of each project you want checked.
- If your project is connected to GitHub, you can commit the instruction as AGENTS.md at the root of the repository instead. Lovable reads that file on every message too.
- Tool permissions: Lovable runs Cyfendo's read-only tools (status, results, fix steps) without asking, and by default asks before the others. To approve full scans yourself, set Scan project to ask (the ? icon) under Manage my agent's permissions. To change any of this later, open Connectors and select Cyfendo. If you skipped the step above, choose Always allow on the approval card the first time Lovable asks.
- Full scans: if your app syncs to a GitHub repository and that repository is connected in Cyfendo (Settings → Integrations → Git), the agent asks Cyfendo to scan the repository directly, whatever its size. Without it, or if Cyfendo can't read the repository, the agent uploads the source files in parts of up to 50 files, which takes longer and uses more of your Lovable usage.

## Troubleshooting

- **The sign-in window doesn't open.** Your browser blocked the popup. Allow popups for your app builder's site, then click the authorize or connect button again.
- **I can't find my personal workspace.** On a business account, your own workspace is your business workspace, so it carries your organization's name. Pick the one marked "your workspace".
- **The connection test fails.** Check the server URL is exactly https://mcp.cyfendo.com/mcp (with /mcp at the end) and, if your app asks, that the transport is HTTP (Streamable HTTP), not SSE.
- **A check stays "running".** Proving an attack takes several minutes, so checks run in the background. Your agent can only report a result when you send it a message: Cyfendo notifies you when a check finishes, then send your agent "Collect any Cyfendo results that are ready." A check stops testing after about 15 minutes and reports what it has.

More guides: https://cyfendo.com/docs/integration