MCP integration · Bolt

Connect Cyfendo to Bolt

Let Bolt check auth, data access and payments code as it writes it. Cyfendo reports only vulnerabilities it proves with a safe test attack in an isolated sandbox, and hands Bolt's agent a tested fix.

  • 2 min setup
  • Free Cyfendo account
  • Sign in with OAuth
  • Never changes your code
Start setup
Server URL https://mcp.cyfendo.com/mcp

Setup · about 2 minutes

Set it up

MCP OAuth (recommended), or API key with a Cyfendo API key.

  1. In a Bolt chat, click + → Connectors → Manage connectors → Custom MCP server.

  2. Name: Cyfendo. URL: https://mcp.cyfendo.com/mcp. Transport: HTTP (not SSE).

  3. Authentication: MCP OAuth. Click Connect, sign in to Cyfendo, and click Allow.

  4. Optional: turn on Auto-enable for all projects.

  5. Add the instruction below to Project Knowledge (or your Global System Prompt).

New to Cyfendo? Choose Continue with Google to create a free account in the same step. If you sign up with email instead, confirm your email first, then start the connection again from your app.

Recommended

Teach your agent when to check

Paste this into Project Knowledge, or Global System Prompt so Bolt calls Cyfendo on its own after risky changes.

Project Knowledge, or Global System Prompt 
When you change authentication, permissions, database queries, payments, uploads, API routes or secrets, check the changed files with Cyfendo (cyfendo_check_changes). For any confirmed issue, get the fix (cyfendo_get_fix), show me the change, apply it, and confirm it with cyfendo_verify_fix. Run cyfendo_scan_project before deploying.

Check it works

Try it

Send one of these to Bolt's agent.

  • Check that it's connectedUse Cyfendo to show my security status.
  • Check a changeCheck the files you just changed with Cyfendo.
  • Before you publishRun a full Cyfendo security scan before we publish.

Good to know

  • Choose the HTTP transport. Cyfendo does not support the older SSE transport.

Troubleshooting

The sign-in window doesn't open

Your browser blocked the popup. Allow popups for your app builder's site, then click the authorize or connect button again.

I can't find my personal workspace

On a business account, your own workspace is your business workspace, so it carries your organization's name. Pick the one marked "your workspace".

The connection test fails

Check the server URL is exactly https://mcp.cyfendo.com/mcp (with /mcp at the end) and, if your app asks, that the transport is HTTP (Streamable HTTP), not SSE.

A check stays "running"

Proving an attack takes a few minutes. Your agent asks Cyfendo for the result in its next step; you can also follow the scan in your Cyfendo dashboard.

Last updated · View as Markdown