Setup · about 2 minutes
Set it up
-
In v0, click + in the prompt form → MCPs and add your own MCP server.
-
Name: Cyfendo. URL:
https://mcp.cyfendo.com/mcp. -
Authentication: OAuth. Sign in to Cyfendo and click Allow.
-
Click + in the prompt form → Instructions → New Instruction. Title it Cyfendo security checks, paste the instruction below, click Add, and keep it checked.
Get the instruction
New to Cyfendo? Choose Continue with Google to create a free account in the same step. If you sign up with email instead, confirm your email first, then start the connection again from your app.
Recommended
Teach your agent when to check
Paste this into + → Instructions → New Instruction so v0 calls Cyfendo on its own after risky changes and tells you when results are ready.
Cyfendo identifies this project by the project_id in cyfendo.json at the project root: pass it in every Cyfendo call. If that file doesn't exist, the first Cyfendo check or scan creates the project; save the project_id it returns to cyfendo.json right away. At the start of each generation, call cyfendo_status and tell me about any finished Cyfendo results first. When a generation changes auth, permissions, data access, payments, uploads, API routes or secrets, call cyfendo_check_changes once at the end with all the files it changed and a short label, without waiting for the result. If Cyfendo confirms an issue that is still current, fix it as its fix_steps describe (or use cyfendo_generate_fix and cyfendo_get_fix for Cyfendo's tested patch), tell me what changed, and confirm it with cyfendo_verify_fix. When I say I'm getting ready to deploy, run cyfendo_scan_project.
Check it works
Try it
Send one of these to v0's agent.
-
Check that it's connected
Use Cyfendo to show my security status.
-
Check a change
Check the files you just changed with Cyfendo.
-
Collect finished results
Collect any Cyfendo results that are ready.
-
Before you publish
I'm getting ready to publish. Run a full Cyfendo security scan.
Before you launch
v0 app security
Is my v0 app secure?
v0 generates Next.js apps, and yours is as secure as the code it generated. The common gaps are Server Actions and route handlers that don't check who is calling, secrets in environment variables that start with NEXT_PUBLIC_ (which ships them to the browser), and database queries that trust an ID sent from the page.
Doesn't Vercel protect my app?
Vercel runs your app on secure infrastructure, but it can't know whether your code checks permissions. A Server Action that updates any user's record when given their ID works exactly as written. Cyfendo tries a safe attack against your app's code in an isolated sandbox and reports only issues the attack proves, each with fix steps.
What does Cyfendo check in a v0 project?
Generations that touch sign-in, data access, payments, uploads, route handlers, Server Actions or secrets. v0 calls Cyfendo before it finishes such a generation, and changes to styles, text and layout are skipped.
Good to know
- Each project gets its own Cyfendo project ID on its first check, and the agent saves it in cyfendo.json for you: don't create that file yourself. If you remix, fork or duplicate a project, delete cyfendo.json in the copy (or ask the agent to), so the copy starts its own check history instead of adding to the original's.
- v0 uses connected tools during generation only, so the instruction asks it to check before finishing.
- Instructions are saved to your account, so this one applies to all your v0 chats while it is checked.
- In v0's default Auto permission mode, Cyfendo's tools run without asking. If you switch to Ask mode, v0 asks before each call.
- Full scans: if your app syncs to a GitHub repository and that repository is connected in Cyfendo (Settings → Integrations → Git), the agent asks Cyfendo to scan the repository directly, whatever its size. Without it, or if Cyfendo can't read the repository, the agent uploads the source files in parts of up to 50 files, which takes longer and uses more of your v0 usage.
- OAuth (recommended), or Bearer Token / Custom Headers with a Cyfendo API key.
Troubleshooting
The sign-in window doesn't open
Your browser blocked the popup. Allow popups for your app builder's site, then click the authorize or connect button again.
I can't find my personal workspace
On a business account, your own workspace is your business workspace, so it carries your organization's name. Pick the one marked "your workspace".
The connection test fails
Check the server URL is exactly https://mcp.cyfendo.com/mcp (with /mcp at the end) and, if your app asks, that the transport is HTTP (Streamable HTTP), not SSE.
A check stays "running"
Proving an attack takes several minutes, so checks run in the background. Your agent can only report a result when you send it a message: Cyfendo notifies you when a check finishes, then send your agent "Collect any Cyfendo results that are ready." A check stops testing after about 15 minutes and reports what it has.