chifu-mcp

An MCP server for chifu — the vulnerability scanner for vibe-coded sites. It lets your AI editor (Claude, Cursor, …) scan your site and fix what it finds without copy-pasting reports: the agent gets structured findings, fixes them in your code, and re-scans to verify.

Tools

| Tool | What it does | | --- | --- | | scan_site(domain) | Run a scan against a verified domain. Returns the risk score + all findings. | | get_scan(scan_id) | Fetch a previous scan's full result. |

Setup

1. Get your API key. It's shown once in the chifu dashboard right after signup. (Settings → see docs.)

2. Add the server to your MCP client.

   Claude Desktop / Claude Code (claude_desktop_config.json or .mcp.json):

   {
     "mcpServers": {
       "chifu": {
         "command": "npx",
         "args": ["-y", "chifu-mcp"],
         "env": { "CHIFU_API_KEY": "your-key-here" }
       }
     }
   }

   Cursor (.cursor/mcp.json): same shape.

3. Use it. Ask your agent:

   Scan myapp.com with chifu and fix the critical findings.

   Pair it with the chifu-security skill (in skill/SKILL.md) for the full scan → fix → re-scan playbook.

Configuration

| Env var | Default | Purpose | | --- | --- | --- | | CHIFU_API_KEY | (required) | Your chifu API key (Bearer auth). | | CHIFU_API_URL | https://api.marshell.dev | chifu API origin. Point at http://localhost:7331 for local dev. |

Develop

bun install      # or npm install
bun run build    # tsc → dist/
bun run start    # run the built server over stdio

The site must be a domain you've verified in the chifu dashboard — scans only run against domains you own.