//Model Context Protocol

Give the AI that wrote it the tool that checks it.

Flare.ai ships an MCP server, so Cursor, Claude Code and Windsurf can scan your app themselves. It works against localhost, which is the whole point: the agent starts your dev server, scans it, fixes what it finds, and rescans. The leak never reaches a commit.

works with

The loop closes without a human in it

Security tooling normally runs after the fact: in CI, in review, or in an audit weeks later. By then the mistake is already in the history. An agent that can scan its own output closes that gap to zero.

Runs before the commit: not in CI, not in review, not after deploy
Findings carry their fix: the agent has everything it needs to act
An explicit stop condition: BLOCKING or CLEAN, no interpretation required

cursor · mcp · flare

agent → flare_scan_url("http://localhost:3000")

VERDICT: BLOCKING, 1 critical

[CRITICAL] OpenAI API key exposed

✓ confirmed live

fix: rotate at provider, move to a

server-only env var

agent → applies the fix, rescans

VERDICT: CLEAN

no findings at or above "critical"

# the human never saw the leak

Three tools

flare_scan_url

Scan a running app, localhost included.

The full external audit against any URL. Because it works against a dev server, the agent can scan code it just wrote before that code has ever been committed, let alone deployed.

args: url, failOn?

flare_scan_repo

Scan the source, get file:line back.

Committed credentials, env-file handling, unsafe migrations and unprotected route handlers. Findings carry the file and line, so an agent can open the right place and fix it directly.

args: path?, failOn?

flare_verify_credential

Is this key still live, or already rotated?

One read-only identity request to the provider that issued the key. This is what separates a real incident from a key you rotated months ago, before the agent escalates to you.

args: credential, kind?

Output an agent can act on

Reports are written for a model, not for a dashboard. Every scan opens with a verdict, so there is no judgement call about whether to continue. Toxic combinations come first because they explain why several findings are worse together, then individual findings with location and fix.

Flare.ai scan of http://localhost:3000/

VERDICT: BLOCKING, 2 finding(s) at or above "critical".
Summary: 2 critical, 5 high, 1 medium

TOXIC COMBINATIONS (fix these first):
1. [CRITICAL] A working backend key is public and the
   backend it unlocks is already exposed
   category: Toxic combination · CWE-522 · confidence:high
   fix: Rotate the key now, assume it is already collected…

FINDINGS:
1. [CRITICAL] Supabase service_role key exposed, confirmed live
   category: Secret leak · CWE-798 · confidence:high
   location: https://example.com/_next/static/chunk.js
   verification: LIVE, service_role key accepted by project abcd…
   fix: Rotate the service_role key in Supabase → Settings → API…

Pass failOn to move the blocking threshold. Compound findings never count toward it, since they are remediated by fixing one of their legs.

Setup

Claude Code

A project-scoped .mcp.json is committed at the repo root, so Flare.ai is picked up automatically when Claude Code runs from this directory. To register it globally instead:

bash

claude mcp add flare -- npx tsx /path/to/flare/src/mcp/server.ts

Cursor

Add to ~/.cursor/mcp.json:

json

{
  "mcpServers": {
    "flare": {
      "command": "npx",
      "args": ["tsx", "/path/to/flare/src/mcp/server.ts"]
    }
  }
}

Claude Desktop & Windsurf

The same block, in claude_desktop_config.json (~/Library/Application Support/Claude/ on macOS) or your Windsurf MCP config.

What it will and won’t do

Read-only, always

No logins, no writes, no attack payloads. Shadow-route probing sends plain GET requests and skips apps that answer 200 to everything.

Keys go to their issuer only

Verification contacts the provider that issued a credential and nowhere else, on free identity endpoints. No model calls, no billable usage.

Bounded by design

Verification is concurrency-capped and budgeted per scan, with timeouts throughout. A failed probe reports unverified rather than guessing.

Or just paste a URL.

The MCP server runs the same engine as the free scan. Try it in the browser first if you’d rather not wire anything up.

Run your free scan Read the docs