# Cyfendo MCP server for Lovable, Bolt, Replit and v0

Cyfendo checks the code your agent writes for security issues an attacker could exploit. It speaks up only when it proves an issue with a safe test attack in an isolated sandbox, and it hands your agent a tested fix.

- Server URL: https://mcp.cyfendo.com/mcp
- Transport: Streamable HTTP
- Sign-in: OAuth 2.1, or a Cyfendo API key

## Setup guides

- [Lovable](https://cyfendo.com/docs/mcp/lovable) (https://cyfendo.com/docs/mcp/lovable.md): Security checks while Lovable builds your app.
- [Bolt](https://cyfendo.com/docs/mcp/bolt) (https://cyfendo.com/docs/mcp/bolt.md): Let Bolt check auth, data access and payments code as it writes it.
- [Replit](https://cyfendo.com/docs/mcp/replit) (https://cyfendo.com/docs/mcp/replit.md): One click to add Cyfendo to Replit Agent.
- [v0](https://cyfendo.com/docs/mcp/v0) (https://cyfendo.com/docs/mcp/v0.md): Check generations that touch auth, data or payments before v0 finishes.

## How it works

1. **Connect once.** Add Cyfendo to your app builder and sign in. It takes a minute or two.
2. **Your agent checks risky changes.** After it edits login, data access, payments, uploads or API routes, your agent asks Cyfendo to check. Harmless changes are skipped instantly.
3. **Proven issues come with a tested fix.** Cyfendo tries a safe attack in an isolated sandbox. Only issues it proves reach your chat, each with a fix your agent shows you before applying it.

## Tools

- `cyfendo_check_changes`: Checks the files your agent just changed. Skips changes that can't affect security. Reports only issues Cyfendo proved with a safe test attack.
- `cyfendo_scan_project`: Runs a full scan with exploit confirmation and tested fixes. Use it after connecting and before publishing.
- `cyfendo_get_results`: Gets the results of a check or scan that is still running.
- `cyfendo_get_fix`: Returns a tested fix as a diff, plus plain steps. Your agent shows you the change before applying it.
- `cyfendo_verify_fix`: Replays the original attack against your updated code to confirm the fix works.
- `cyfendo_status`: Shows your connected account and the confirmed issues still open.

## Other MCP clients

Many MCP clients accept a configuration like this:

```json
{
  "mcpServers": {
    "cyfendo": {
      "url": "https://mcp.cyfendo.com/mcp"
    }
  }
}
```

## Use an API key instead

Use a Cyfendo API key from Settings → Developer as `Authorization: Bearer <key>` or the `X-Cyfendo-Api-Key` header. To use a team workspace, also send `X-Cyfendo-Workspace-Id`. An API key gives the app the same access you have, so prefer OAuth when the app supports it.

## Questions

### Do I need a Cyfendo account?

Yes, a free one. When you connect from your app, Continue with Google creates the account and takes you straight to the Allow screen. If you sign up with email, confirm your email address first, then start the connection again from your app.

### Which apps work with Cyfendo?

Any app that supports remote MCP servers over Streamable HTTP. This guide covers Lovable, Bolt, Replit and v0 step by step.

### Does Cyfendo change my code?

No. Cyfendo only reads the code your app sends. Your app's agent applies fixes after you approve them.

### What does Cyfendo report in chat?

Only issues it proved with a safe test attack in an isolated sandbox. Possible issues it could not prove are listed in the Cyfendo dashboard instead.

### Why did a check say it was skipped?

Changes to styles, text, images, tests, and layout-only components can't introduce the vulnerabilities Cyfendo tests for, so they are skipped instantly.

### Why does a check say it is still running?

Proving an attack takes a little while. Your agent asks Cyfendo for the result in its next step.

### Can I use an API key instead of signing in?

Yes. Use a Cyfendo API key from Settings → Developer as a bearer token, or as the X-Cyfendo-Api-Key header. The key gives the app the same access you have, so prefer OAuth when the app supports it.

### How do I disconnect an app?

Settings → Connected apps → Disconnect. The app loses access immediately. If the app uses an API key, delete the key in Settings → Developer.