# Connect Cyfendo to Lovable (MCP setup guide)

Security checks while Lovable builds your app.

- Server URL: https://mcp.cyfendo.com/mcp
- Transport: Streamable HTTP
- Sign-in: Sign in with OAuth (recommended). If you can't use OAuth, use a Cyfendo API key as a bearer token.
- Time: about 2 minutes

## Steps

1. In Lovable, open Connectors → Personal connectors → New MCP server.
2. Name it Cyfendo and enter the server URL https://mcp.cyfendo.com/mcp.
3. Keep OAuth selected and click Add & authorize.
4. Sign in to Cyfendo and click Allow.
5. Add the project instruction below to your project's Knowledge (or AGENTS.md) so Lovable checks risky changes automatically.

New to Cyfendo? Choose Continue with Google to create a free account in the same step. If you sign up with email instead, confirm your email first, then start the connection again from your app.

## Project instruction (paste into Project Knowledge, or AGENTS.md)

```text
Security: I've connected Cyfendo. After you change login, permissions, database access or Supabase policies, payments, file uploads, API routes or anything with secrets, call cyfendo_check_changes with the files you changed. If Cyfendo reports a confirmed issue, show me the fix from cyfendo_get_fix, apply it once I approve, then run cyfendo_verify_fix. Before we publish, run cyfendo_scan_project.
```

## Try it

- Check that it's connected: "Use Cyfendo to show my security status."
- Check a change: "Check the files you just changed with Cyfendo."
- Before you publish: "Run a full Cyfendo security scan before we publish."

## Good to know

- Connections are personal: once connected, Cyfendo is available in all your Lovable projects.

## Troubleshooting

- **The sign-in window doesn't open.** Your browser blocked the popup. Allow popups for your app builder's site, then click the authorize or connect button again.
- **I can't find my personal workspace.** On a business account, your own workspace is your business workspace, so it carries your organization's name. Pick the one marked "your workspace".
- **The connection test fails.** Check the server URL is exactly https://mcp.cyfendo.com/mcp (with /mcp at the end) and, if your app asks, that the transport is HTTP (Streamable HTTP), not SSE.
- **A check stays "running".** Proving an attack takes a few minutes. Your agent asks Cyfendo for the result in its next step; you can also follow the scan in your Cyfendo dashboard.

More guides: https://cyfendo.com/docs/mcp