Connect your AI assistant to FlawPilot

FlawPilot ships an MCP server so the AI tools you already use - Claude, Cursor, ChatGPT, and any MCP-compatible client - can trigger a scan and read the findings back, right inside your editor or chat. This guide walks through connecting one in a couple of minutes.

The server is remote - there's nothing to install locally. With OAuth, there's no key to copy at all.

What is MCP, and why connect it?

The Model Context Protocol (MCP) is an open standard that lets AI assistants talk to external tools. Connecting FlawPilot turns your assistant into a security co-pilot:

• Trigger scans from chat - ask your assistant to scan a URL and it starts a FlawPilot scan for you: no context switch, no dashboard, no copy-pasting links.
• Read findings inline - scores and prioritized findings come straight back into the conversation, so your assistant can explain and act on them where you're already working.
• Turn findings into fixes - because the findings live in the same context as your code, your assistant can draft the header, config, or DNS change that resolves each issue.

Before you start

• A FlawPilot account - create one free from the dashboard.
• An MCP-compatible client: Claude (desktop or Claude Code), Cursor, VS Code Copilot, Antigravity, or any tool that speaks MCP.
• For OAuth-capable clients, nothing else - the connect flow handles auth. For the REST API, CI, or clients without OAuth, a FlawPilot API key from Settings → API keys (the same key works for both).

Two ways to connect

Pick one path. OAuth is the recommended, no-key way if your client supports it. Otherwise use an API key - the same key also works for the REST API and CI.

Option A: Connect with OAuth (recommended)

Nothing to copy. Works with any MCP client that has an "Add connector" / "Connect" flow (Claude Code, Claude.ai, Claude Desktop, and more).

1. Point your client at FlawPilot

In Claude Code, run the claude mcp add command from the config below without a header. In Claude.ai or Claude Desktop, open Settings → Connectors → Add custom connector and paste the MCP server URL (it's in the reference below). No key to create or copy.

2. Approve in your browser

Your browser opens the FlawPilot login, shows which app is asking, and lets you pick a workspace if you belong to more than one. Click Approve and the client is connected - the FlawPilot tools appear in your assistant.

OAuth still creates a key

The connect flow creates an ordinary API key, named after the client. It shows up in Settings → API keys and you can revoke it there later.

3. Scan from your assistant

Ask something like:

Scan example.com with FlawPilot and summarize the critical findings.

It triggers the scan, waits for results, and reports the scores and prioritized fixes back into the conversation:

Overall 82. 1 critical: API key exposed in JS bundle. 2 high on headers. Want the fixes?

Option B: Use an API key

For the REST API, CI/scripts, or an MCP client that doesn't support OAuth yet.

Requires Owner or Admin

Creating keys requires the Owner or Admin role.

1. Generate an API key

Sign in, open Settings → API keys, and click Generate key. Give it a name you'll recognise later - for example Claude Desktop or CI pipeline. The same key works for MCP and the REST API.

2. Copy it and store it safely

FlawPilot shows the key once, in the "Copy your API key" dialog - click Copy and paste it somewhere secure straight away, because you won't be able to see it again. FlawPilot only stores a hash, never the raw key. Revoke a key from the list any time.

3. Add the server to your client

Add a new remote server in your client's connector or MCP settings pointing at the FlawPilot MCP endpoint over the Streamable HTTP transport, and paste your key as its Bearer credential (see the per-client config below). Nothing to install - it's a remote server.

4. Scan from your assistant

Ask something like "Scan example.com with FlawPilot and summarize the critical findings." It triggers the scan and reports the scores and prioritized fixes back into the conversation.

The FlawPilot MCP server

Every client below connects to the same remote MCP endpoint over the Streamable HTTP transport. OAuth-capable clients authenticate through the connect flow (no key to paste); manual setups send an API key as a Bearer token in the Authorization header - the same key works for the REST API too.

Remote MCP server URL

https://mcp.flawpilot.com/mcp

Replace YOUR_API_KEY in every snippet below with your own key.

Rolling out

The MCP endpoint is rolling out. Until it is live for your account, the config below is the exact shape it will take - the URL and key are all that change.

Client-specific setup

The endpoint is the same everywhere - only where you paste it changes.

Claude Code

Claude Code detects OAuth support: run the command without a header and it opens your browser to approve - nothing to copy. If you'd rather paste a key, add the --header form instead.

Terminal - OAuth (recommended)

claude mcp add flawpilot --transport http https://mcp.flawpilot.com/mcp

Terminal - with an API key

claude mcp add flawpilot --transport http https://mcp.flawpilot.com/mcp \
  --header "Authorization: Bearer YOUR_API_KEY"

Claude Desktop

OAuth (recommended): open Settings → Connectors → Add custom connector and paste the MCP server URL; approve in your browser, no key needed.

To use a key instead, open Settings → Developer → Edit Config and add the block below to claude_desktop_config.json.

claude_desktop_config.json

{
  "mcpServers": {
    "flawpilot": {
      "url": "https://mcp.flawpilot.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

VS Code

Add a .vscode/mcp.json in your workspace (or your user MCP config). VS Code prompts for the key once and stores it securely rather than writing it into the file. GitHub Copilot's agent mode then lists the FlawPilot tools.

.vscode/mcp.json

{
  "inputs": [
    {
      "type": "promptString",
      "id": "flawpilot-api-key",
      "description": "FlawPilot API key (Bearer token)",
      "password": true
    }
  ],
  "servers": {
    "flawpilot": {
      "type": "http",
      "url": "https://mcp.flawpilot.com/mcp",
      "headers": {
        "Authorization": "Bearer ${input:flawpilot-api-key}"
      }
    }
  }
}

Antigravity

Open Agent Manager → settings (gear icon) → Manage MCP Servers → Add custom server. This opens Antigravity's MCP config file; add FlawPilot as a remote HTTP server.

MCP config

{
  "mcpServers": {
    "flawpilot": {
      "serverUrl": "https://mcp.flawpilot.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

If it doesn't connect

Rename serverUrl to url - Google's MCP config schema has used both keys across editor versions.

Any other MCP client

Any client that supports the Streamable HTTP transport works the same way: point it at the FlawPilot MCP URL and set the Authorization header. There's no vendor-specific setup on FlawPilot's side.

Remote (HTTP) client

URL:    https://mcp.flawpilot.com/mcp
Header: Authorization: Bearer YOUR_API_KEY

What your assistant can do once connected

The FlawPilot MCP server exposes these tools to your AI assistant.

Tool	What it does
list_projects	Lists your workspace's projects with their project ID, name, and status - so your assistant can pick which project a scan belongs to.
trigger_scan	Queues a scan for a URL against one of your projects. Always confirms the project, pillars, and report email first - it won't assume defaults on your behalf.
get_scan_status	Checks a scan's progress and, once complete, returns its scores - so your assistant can report back when it's done.

Frequently asked questions

What's the difference between OAuth and a manual API key?

OAuth is just an easier way to get a key into your client - your browser opens the FlawPilot login, you approve, and the client is connected with no key to copy. It still creates an ordinary API key behind the scenes (named after the client), which shows up in Settings → API keys and can be revoked there. A manual key is the same kind of credential, you just create and paste it yourself. Both authenticate the same way; neither expires on its own.

Does disconnecting the app in my client revoke the key?

No. Disconnecting in your MCP client doesn't revoke the key on FlawPilot's side. If you're done with an integration, also revoke its key from Settings → API keys - including the key an OAuth connection created for you.

Is my API key sensitive?

Yes. Your API key authenticates as your whole workspace - anyone with it can trigger scans and read results. Treat it like a password: never commit it to a repo or paste it into a public chat, and use one key per integration. FlawPilot shows the key only once when you generate it, so store it securely. If it leaks, revoke it from Settings → API keys and generate a new one.

Does connecting over MCP change what a scan sees?

No. Scans triggered over MCP use the exact same public-signals engine as the website. MCP is just a different way to start a scan and read the results - the checks and scoring are identical.

Which clients are supported?

Any MCP-compatible client. We test against Claude (desktop and Claude Code), Cursor, and ChatGPT, but the connection works with any tool that supports remote MCP servers.

Can I revoke access later?

Yes. Revoke the API key in your FlawPilot Settings → API keys at any time. The connected assistant immediately loses access until you issue and configure a new key.