# Connect Cyfendo to Bolt (MCP setup guide)

Let Bolt check auth, data access and payments code as it writes it.

- Server URL: https://mcp.cyfendo.com/mcp
- Transport: Streamable HTTP
- Sign-in: MCP OAuth (recommended), or API key with a Cyfendo API key.
- Time: about 2 minutes

## Steps

1. In a Bolt chat, click + → Connectors → Manage connectors → Custom MCP server.
2. Name: Cyfendo. URL: https://mcp.cyfendo.com/mcp. Transport: HTTP (not SSE).
3. Authentication: MCP OAuth. Click Connect, sign in to Cyfendo, and click Allow.
4. Optional: turn on Auto-enable for all projects.
5. Add the instruction below to Project Knowledge (or your Global System Prompt).

New to Cyfendo? Choose Continue with Google to create a free account in the same step. If you sign up with email instead, confirm your email first, then start the connection again from your app.

## Project instruction (paste into Project Knowledge, or Global System Prompt)

```text
When you change authentication, permissions, database queries, payments, uploads, API routes or secrets, check the changed files with Cyfendo (cyfendo_check_changes). For any confirmed issue, get the fix (cyfendo_get_fix), show me the change, apply it, and confirm it with cyfendo_verify_fix. Run cyfendo_scan_project before deploying.
```

## Try it

- Check that it's connected: "Use Cyfendo to show my security status."
- Check a change: "Check the files you just changed with Cyfendo."
- Before you publish: "Run a full Cyfendo security scan before we publish."

## Good to know

- Choose the HTTP transport. Cyfendo does not support the older SSE transport.

## Troubleshooting

- **The sign-in window doesn't open.** Your browser blocked the popup. Allow popups for your app builder's site, then click the authorize or connect button again.
- **I can't find my personal workspace.** On a business account, your own workspace is your business workspace, so it carries your organization's name. Pick the one marked "your workspace".
- **The connection test fails.** Check the server URL is exactly https://mcp.cyfendo.com/mcp (with /mcp at the end) and, if your app asks, that the transport is HTTP (Streamable HTTP), not SSE.
- **A check stays "running".** Proving an attack takes a few minutes. Your agent asks Cyfendo for the result in its next step; you can also follow the scan in your Cyfendo dashboard.

More guides: https://cyfendo.com/docs/mcp