@checkvibe/mcp-server

MCP (Model Context Protocol) server for CheckVibe security scanning. Run automated security audits on any web application directly from your AI coding agent.

Setup

1. Get an API key

Create an API key at checkvibe.dev/dashboard/api-keys.

2. Add to your AI coding agent

Claude Code — run in your project directory:

claude mcp add checkvibe -- npx -y @checkvibe/mcp-server

Then set the env var in your MCP config (.mcp.json):

{
  "mcpServers": {
    "checkvibe": {
      "command": "npx",
      "args": ["-y", "@checkvibe/mcp-server"],
      "env": {
        "CHECKVIBE_API_KEY": "cvd_live_..."
      }
    }
  }
}

Cursor — add to .cursor/mcp.json:

{
  "mcpServers": {
    "checkvibe": {
      "command": "npx",
      "args": ["-y", "@checkvibe/mcp-server"],
      "env": {
        "CHECKVIBE_API_KEY": "cvd_live_..."
      }
    }
  }
}

Tools

| Tool | Description | Required Scope | |------|-------------|----------------| | run_scan | Trigger a security scan on a URL. Auto-detects or creates a project so scans use saved credentials and appear in project history. | scan:write + project:read + project:write | | get_scan_results | Get detailed results for a specific scan by ID. | scan:read | | list_scans | List recent scans with status and scores. | scan:read | | list_projects | List all projects with scores and monitoring status. | project:read | | get_project | Get project configuration details. | project:read | | update_project | Update project settings (name, URL, backend, email). | project:write | | dismiss_finding | Dismiss a finding with a reason. | dismissal:write | | list_dismissals | List dismissed findings for a project. | dismissal:read | | restore_finding | Un-dismiss a finding (restore to active). | dismissal:write |

Environment Variables

| Variable | Required | Description | |----------|----------|-------------| | CHECKVIBE_API_KEY | Yes | Your CheckVibe API key (cvd_live_...) | | CHECKVIBE_BASE_URL | No | API base URL (default: https://checkvibe.dev) |

License

MIT