MCP integration · Lovable

Connect Cyfendo to Lovable

Security checks while Lovable builds your app. Cyfendo reports only vulnerabilities it proves with a safe test attack in an isolated sandbox, and hands Lovable's agent a tested fix.

  • 2 min setup
  • Free Cyfendo account
  • Sign in with OAuth
  • Never changes your code
Start setup
Server URL https://mcp.cyfendo.com/mcp

Setup · about 2 minutes

Set it up

Sign in with OAuth (recommended). If you can't use OAuth, use a Cyfendo API key as a bearer token.

  1. In Lovable, open Connectors → Personal connectors → New MCP server.

  2. Name it Cyfendo and enter the server URL https://mcp.cyfendo.com/mcp.

  3. Keep OAuth selected and click Add & authorize.

  4. Sign in to Cyfendo and click Allow.

  5. Add the project instruction below to your project's Knowledge (or AGENTS.md) so Lovable checks risky changes automatically.

New to Cyfendo? Choose Continue with Google to create a free account in the same step. If you sign up with email instead, confirm your email first, then start the connection again from your app.

Recommended

Teach your agent when to check

Paste this into Project Knowledge, or AGENTS.md so Lovable calls Cyfendo on its own after risky changes.

Project Knowledge, or AGENTS.md 
Security: I've connected Cyfendo. After you change login, permissions, database access or Supabase policies, payments, file uploads, API routes or anything with secrets, call cyfendo_check_changes with the files you changed. If Cyfendo reports a confirmed issue, show me the fix from cyfendo_get_fix, apply it once I approve, then run cyfendo_verify_fix. Before we publish, run cyfendo_scan_project.

Check it works

Try it

Send one of these to Lovable's agent.

  • Check that it's connectedUse Cyfendo to show my security status.
  • Check a changeCheck the files you just changed with Cyfendo.
  • Before you publishRun a full Cyfendo security scan before we publish.

Good to know

  • Connections are personal: once connected, Cyfendo is available in all your Lovable projects.

Troubleshooting

The sign-in window doesn't open

Your browser blocked the popup. Allow popups for your app builder's site, then click the authorize or connect button again.

I can't find my personal workspace

On a business account, your own workspace is your business workspace, so it carries your organization's name. Pick the one marked "your workspace".

The connection test fails

Check the server URL is exactly https://mcp.cyfendo.com/mcp (with /mcp at the end) and, if your app asks, that the transport is HTTP (Streamable HTTP), not SSE.

A check stays "running"

Proving an attack takes a few minutes. Your agent asks Cyfendo for the result in its next step; you can also follow the scan in your Cyfendo dashboard.

Last updated · View as Markdown