@supersafe/mcp

MCP server for scanning URLs for security vulnerabilities. Works with Claude Code, Cursor, Windsurf, and any MCP-compatible AI tool.

No signup required -- just add it and start scanning.

Setup

Claude Code

Add to your project config (.mcp.json):

{
  "mcpServers": {
    "supersafe": {
      "command": "npx",
      "args": ["@supersafe/mcp"]
    }
  }
}

Or add it globally in ~/.claude.json:

{
  "mcpServers": {
    "supersafe": {
      "command": "npx",
      "args": ["@supersafe/mcp"]
    }
  }
}

Restart Claude Code after adding the config.

Cursor / Windsurf

Add the same config to your editor's MCP settings. Refer to your editor's docs for the config file location.

Tools

| Tool | Description | |------|-------------| | scan_url | Scan a URL for security vulnerabilities (SAFE mode, passive checks) | | get_findings | Get findings for a scan by job_id | | get_remediation | Get fix guidance for a finding type | | get_scan_diff | Compare a scan to the previous scan on the same target | | login | Authenticate via browser -- upgrades anonymous to persistent scans | | whoami | Check your current identity and auth method |

Usage

Once set up, just ask your AI tool:

"Scan example.com for security issues"

Results include severity, evidence, remediation steps, and an agent_prompt field your AI can use to help you fix each finding.

Authentication

Anonymous (default)

Works out of the box. Scans are rate-limited (10 per 15 minutes) and not persisted to an account.

Browser login (recommended)

Ask your AI tool to log in:

"Log in to SuperSafe"

This opens your browser where you can sign up or log in. Your session is stored locally at ~/.supersafe/mcp-tokens.json and persists across restarts -- no config changes needed.

API Key

For CI/CD or headless environments, set your API key:

{
  "mcpServers": {
    "supersafe": {
      "command": "npx",
      "args": ["@supersafe/mcp"],
      "env": {
        "SUPERSAFE_API_KEY": "your-api-key"
      }
    }
  }
}

Environment Variables

| Variable | Description | Default | |----------|-------------|---------| | SUPERSAFE_API_KEY | API key for authenticated access | (anonymous) | | SUPERSAFE_URL | API base URL | https://supersafe.dev |

Requirements

Node.js >= 22

License

MIT