# Connect Cyfendo to v0 (MCP setup guide)

Check generations that touch auth, data or payments before v0 finishes.

- Server URL: https://mcp.cyfendo.com/mcp
- Transport: Streamable HTTP
- Sign-in: OAuth (recommended), or Bearer Token / Custom Headers with a Cyfendo API key.
- Time: about 2 minutes

## Steps

1. In the v0 prompt form, click + → MCPs → Add MCP (or open MCP Connections in settings).
2. Name: Cyfendo. URL: https://mcp.cyfendo.com/mcp.
3. Authentication: OAuth. Sign in to Cyfendo and click Allow.
4. Add the instruction below to your project instructions.

New to Cyfendo? Choose Continue with Google to create a free account in the same step. If you sign up with email instead, confirm your email first, then start the connection again from your app.

## Project instruction (paste into Project instructions)

```text
Before you finish a generation that touches auth, permissions, data access, payments, uploads, API routes or secrets, call cyfendo_check_changes with the files you changed. If Cyfendo confirms an issue, use cyfendo_get_fix, tell me what it changes, apply it, and confirm it with cyfendo_verify_fix. Ask Cyfendo for a full scan (cyfendo_scan_project) before I deploy.
```

## Try it

- Check that it's connected: "Use Cyfendo to show my security status."
- Check a change: "Check the files you just changed with Cyfendo."
- Before you publish: "Run a full Cyfendo security scan before we publish."

## Good to know

- v0 uses MCP tools during generation only, so the instruction asks it to check before finishing.

## Troubleshooting

- **The sign-in window doesn't open.** Your browser blocked the popup. Allow popups for your app builder's site, then click the authorize or connect button again.
- **I can't find my personal workspace.** On a business account, your own workspace is your business workspace, so it carries your organization's name. Pick the one marked "your workspace".
- **The connection test fails.** Check the server URL is exactly https://mcp.cyfendo.com/mcp (with /mcp at the end) and, if your app asks, that the transport is HTTP (Streamable HTTP), not SSE.
- **A check stays "running".** Proving an attack takes a few minutes. Your agent asks Cyfendo for the result in its next step; you can also follow the scan in your Cyfendo dashboard.

More guides: https://cyfendo.com/docs/mcp