@supersafe/mcp

@supersafe/mcp

MCP server for scanning URLs for security vulnerabilities. Works with Claude Code, Cursor, Windsurf, and any MCP-compatible AI tool.

No signup required -- just add it and start scanning.

Setup

Claude Code

Add to your project config (.mcp.json):

{
  "mcpServers": {
    "supersafe": {
      "command": "npx",
      "args": ["@supersafe/mcp"]
    }
  }
}

Or add it globally in ~/.claude.json:

{
  "mcpServers": {
    "supersafe": {
      "command": "npx",
      "args": ["@supersafe/mcp"]
    }
  }
}

Restart Claude Code after adding the config.

Cursor / Windsurf

Add the same config to your editor's MCP settings. Refer to your editor's docs for the config file location.

Tools

Tool	Description
scan_url	Scan a URL for security vulnerabilities (SAFE mode, passive checks)
get_findings	Get findings for a scan by job_id
get_remediation	Get fix guidance for a finding type
get_scan_diff	Compare a scan to the previous scan on the same target
login	Authenticate via browser -- upgrades anonymous to persistent scans
whoami	Check your current identity and auth method

Usage

Once set up, just ask your AI tool:

"Scan example.com for security issues"

Results include severity, evidence, remediation steps, and an agent_prompt field your AI can use to help you fix each finding.

Authentication

Anonymous (default)

Works out of the box. Scans are rate-limited (10 per 15 minutes) and not persisted to an account.

Browser login (recommended)

Ask your AI tool to log in:

"Log in to SuperSafe"

This opens your browser where you can sign up or log in. Your session is stored locally at ~/.supersafe/mcp-tokens.json and persists across restarts -- no config changes needed.

API Key

For CI/CD or headless environments, set your API key:

{
  "mcpServers": {
    "supersafe": {
      "command": "npx",
      "args": ["@supersafe/mcp"],
      "env": {
        "SUPERSAFE_API_KEY": "your-api-key"
      }
    }
  }
}

Environment Variables

Variable	Description	Default
SUPERSAFE_API_KEY	API key for authenticated access	(anonymous)
SUPERSAFE_URL	API base URL	https://supersafe.dev

Requirements

Node.js >= 22

License

MIT