MCP integration
Security checks inside your AI app builder
Cyfendo checks the code your agent writes for security issues an attacker could exploit. It speaks up only when it proves an issue with a safe test attack in an isolated sandbox, and it hands your agent a tested fix.
- 1–2 min setup
- Free Cyfendo account
- Sign in with OAuth
- Never changes your code
https://mcp.cyfendo.com/mcp
Setup guides
Pick your app builder
Each guide takes a minute or two and ends with a quick test.
Lovable
Security checks while Lovable builds your app.
Set up in 2 min →
Bolt
Let Bolt check auth, data access and payments code as it writes it.
Set up in 2 min →
Replit
One click to add Cyfendo to Replit Agent.
Set up in 1 min →
v0
Check generations that touch auth, data or payments before v0 finishes.
Set up in 2 min →How it works
Your agent builds, Cyfendo checks
Connect once
Add Cyfendo to your app builder and sign in. It takes a minute or two.
Your agent checks risky changes
After it edits login, data access, payments, uploads or API routes, your agent asks Cyfendo to check. Harmless changes are skipped instantly.
Proven issues come with a tested fix
Cyfendo tries a safe attack in an isolated sandbox. Only issues it proves reach your chat, each with a fix your agent shows you before applying it.
Tools
What your agent can do
cyfendo_check_changes
Checks the files your agent just changed. Skips changes that can't affect security. Reports only issues Cyfendo proved with a safe test attack.
cyfendo_scan_project
Runs a full scan with exploit confirmation and tested fixes. Use it after connecting and before publishing.
cyfendo_get_results
Gets the results of a check or scan that is still running.
cyfendo_get_fix
Returns a tested fix as a diff, plus plain steps. Your agent shows you the change before applying it.
cyfendo_verify_fix
Replays the original attack against your updated code to confirm the fix works.
cyfendo_status
Shows your connected account and the confirmed issues still open.
Other MCP clients
Connect any MCP client
Cyfendo works with any app that supports remote MCP servers over Streamable HTTP. Many accept a configuration like this:
{
"mcpServers": {
"cyfendo": {
"url": "https://mcp.cyfendo.com/mcp"
}
}
}
Use an API key instead
If your app can't sign in with OAuth, send a Cyfendo API key from Settings → Developer
as Authorization: Bearer <key> or the X-Cyfendo-Api-Key header. It carries your own access,
so prefer OAuth when you can.
Use a team workspace
Pick the workspace on the sign-in screen. With an API key, also send X-Cyfendo-Workspace-Id; otherwise your
default workspace is used.
Scan a private repository
Connect it once in Settings → Git connections with a read-only token.
FAQ
Questions
Do I need a Cyfendo account?
Yes, a free one. When you connect from your app, Continue with Google creates the account and takes you straight to the Allow screen. If you sign up with email, confirm your email address first, then start the connection again from your app.
Which apps work with Cyfendo?
Any app that supports remote MCP servers over Streamable HTTP. This guide covers Lovable, Bolt, Replit and v0 step by step.
Does Cyfendo change my code?
No. Cyfendo only reads the code your app sends. Your app's agent applies fixes after you approve them.
What does Cyfendo report in chat?
Only issues it proved with a safe test attack in an isolated sandbox. Possible issues it could not prove are listed in the Cyfendo dashboard instead.
Why did a check say it was skipped?
Changes to styles, text, images, tests, and layout-only components can't introduce the vulnerabilities Cyfendo tests for, so they are skipped instantly.
Why does a check say it is still running?
Proving an attack takes a little while. Your agent asks Cyfendo for the result in its next step.
Can I use an API key instead of signing in?
Yes. Use a Cyfendo API key from Settings → Developer as a bearer token, or as the X-Cyfendo-Api-Key header. The key gives the app the same access you have, so prefer OAuth when the app supports it.
How do I disconnect an app?
Settings → Connected apps → Disconnect. The app loses access immediately. If the app uses an API key, delete the key in Settings → Developer.