flarehq-mcp

flarehq-mcp

Security scanning for AI coding agents. Lets Claude Code, Cursor or Windsurf check what your app actually exposes — before you commit.

{
  "mcpServers": {
    "flare": { "command": "npx", "args": ["-y", "flarehq-mcp"] }
  }
}

No account, no API key, no local path into anyone's repo.

Tools

flare_scan_url(url, failOn?) — full external audit of a running app. Fetches the page and its JS bundles, enumerates routes, checks headers, DNS and storage, and probes any credential it finds against the provider that issued it. Works against http://localhost:3000, because the server runs on your machine.

flare_scan_repo(path?, failOn?) — static analysis of source and git history: committed secrets, NEXT_PUBLIC_ mistakes, unsafe migrations, unprotected route handlers. Reports file:line.

flare_verify_credential(credential, kind?) — asks the issuer whether a key is still live. Read-only, non-billable, nineteen providers.

flare_authz_test(ownerUrls, ownerHeaders, otherHeaders, adminUrls?) — tests for IDOR and broken function-level authorization, the top OWASP API risk. Give it URLs returning one account's objects and the session headers for two accounts; it requests each URL as the other account and reports a finding only when the second account receives the first's exact data — an API that safely scopes to its own caller is correctly reported as safe. Reads only, and localhost only: testing a deployed origin needs an ownership-verification step that does not exist yet, by design, so Flare can't be pointed at someone else's app.

Every scan opens with VERDICT: BLOCKING or VERDICT: CLEAN at the failOn threshold, so an agent does not have to interpret anything.

Why it runs locally

The scan needs two things a hosted endpoint cannot have: your localhost, and your .git directory. Running in-process means neither your source nor your history is uploaded anywhere.

What it sends, and where

Nothing to us. This package makes no call to any Flare service. Our domain appears in it exactly once, inside the User-Agent string it identifies itself with when fetching your app. There is no telemetry, no usage reporting and no account check — you are welcome to verify that before installing, which is rather the point of shipping a security tool as readable source.

It makes outbound requests to exactly two kinds of host:

• The app you asked it to scan — its pages and JavaScript bundles.

• The issuer of a credential it found, and only that issuer, to ask whether the key still works. One read-only identity request, never a billable one:

  api.stripe.com · api.openai.com · api.anthropic.com · api.github.com slack.com · maps.googleapis.com · api.resend.com · api.sendgrid.com huggingface.co · api.replicate.com · api.groq.com · api.telegram.org api.notion.com · api.airtable.com · api.linear.app · registry.npmjs.org discord.com · api.mapbox.com · firestore.googleapis.com · firebasestorage.googleapis.com · osv.dev (dependency advisories)

A credential found in your bundle is already public — it is sitting in a file anyone can download. Asking its issuer whether it still works is the only way to tell a real emergency from a key you rotated last month.

Links

• Docs: https://flarehq.dev/mcp
• What it checks: https://flarehq.dev/coverage
• Live-key verification: https://flarehq.dev/verification