Scan Your App for Security From Inside Cursor and Claude

Quick answer: SimplyScan's Model Context Protocol (MCP) server allows AI assistants like Claude, Cursor, and Windsurf to run security, speed, and AI-visibility scans directly from your editor. By connecting to api.simplyscan.io/mcp, your agent can find vulnerabilities, write fixes, and verify them in a single conversation, closing the gap between vibe-coding and secure shipping.

By Daniel A · Kraftwire Software

Can Your AI Assistant Scan Your App for Security Issues?

Yes, your AI assistant can now perform full security audits directly within your IDE using the Model Context Protocol (MCP). By connecting SimplyScan’s MCP server to editors like Cursor, Claude Desktop, or Windsurf, you enable your agent to run live security, speed, and SEO scans on your deployed URL. This allows the AI to identify vulnerabilities, write the necessary code fixes, and verify the resolution through a re-scan · all without you ever leaving the chat interface or switching tabs.

SimplyScan provides a remote MCP server at https://api.simplyscan.io/mcp that exposes seven specialized tools. These tools allow your AI assistant to check for exposed API keys, missing Supabase RLS policies, broken authentication, and AI-visibility (AEO) signals in ~30 seconds.

Why Security Scanning Inside the Editor is Essential

The rise of "vibe-coding" · building applications rapidly using AI prompts · has created a significant security gap. While tools like Cursor and Lovable allow for unprecedented speed, they often generate code that overlooks critical security configurations.

When security checks are separated from the development environment, they are often skipped until it is too late. By integrating scanning into the editor, security becomes a continuous part of the "vibe" rather than an afterthought.

What Is the Model Context Protocol (MCP)?

The Model Context Protocol (MCP) is an open standard introduced by Anthropic that allows AI assistants to connect to external data sources and tools. Traditionally, an LLM is limited to the data it was trained on or the files you manually upload. MCP changes this by providing a "plug-and-play" way for assistants to call external APIs and read structured results.

Instead of you running a scan on a website and copy-pasting the results back to Claude or Cursor, the assistant uses the MCP server to "see" the security state of your app directly. It treats the security scanner as a native capability, much like its ability to read a local file or run a terminal command.

SimplyScan MCP Tools: What Your Assistant Can Do

Once you add the SimplyScan endpoint to your configuration, your AI assistant gains access to the following seven tools:

• scan_website · Performs a comprehensive security audit and speed scan. It detects exposed secrets, missing Supabase RLS, frontend leaks, and performance bottlenecks.
• check_security_headers · Analyzes and grades your security headers (CSP, HSTS, X-Frame-Options) on an A-F scale.
• check_ai_visibility · An AEO (Answer Engine Optimization) check to ensure your site can be crawled and cited by ChatGPT, Claude, and Perplexity.
• check_seo · A technical on-page SEO audit to ensure search engines can index your vibe-coded SPA.
• check_ssl · Validates certificate health, including issuer, expiration dates, and protocol versions.
• check_email_security · Checks for SPF, DKIM, and DMARC records to prevent domain spoofing.
• check_exposed_files · Probes for sensitive files that should never be public, such as .env, .git, or database backups.

Solving the "Vibe-Coding" Security Gap

AI assistants are excellent at logic but often fail at infrastructure-level security. For example, an AI might build a perfect React dashboard but forget to enable Row Level Security (RLS) on the backend, or it might accidentally include a process.env variable in a client-side bundle.

By using the MCP server, you can automate the vibe-coding security checklist. You can give your assistant a command like:

"Scan my deployed staging URL at https://myapp-staging.vercel.app. If you find any high-severity security issues or missing headers, update the next.config.js or Supabase schema to fix them, then re-scan to verify."

This creates a closed-loop system where the AI is responsible for both the creation and the validation of the code.

How to Connect SimplyScan to Cursor, Claude, and Windsurf

Connecting to the remote MCP server is straightforward and requires no local installation.

1. For Claude Desktop

Open your claude_desktop_config.json file and add SimplyScan as a mcpServers entry:

2. For Cursor

Go to Settings > Models > MCP (or the equivalent MCP configuration pane in the latest version). Add a new "Remote" or "Streamable-HTTP" server with the URL:

https://api.simplyscan.io/mcp

3. For Windsurf

In the Windsurf configuration, add the SimplyScan endpoint to your list of active MCP servers. Once connected, you can ask the assistant to "list available tools from SimplyScan" to confirm the connection is active.

Beyond Security: AEO and Performance

Security isn't the only dimension where AI-built apps struggle. Slow load times don't just hurt user experience; they negatively impact how AI agents perceive your site.

As more users rely on "Answer Engines" like Perplexity or SearchGPT, your site must be optimized for AI crawlers. This is known as Answer Engine Optimization (AEO). If your assistant detects that your site is blocking AI bots via robots.txt or missing proper semantic HTML, it can suggest immediate fixes to ensure your app remains visible in the AI-first web.

The Future of Secure AI Development

The goal of SimplyScan is to make security invisible and frictionless. By moving the security scanner into the IDE, we eliminate the "security tax" that often slows down rapid development. Whether you are using Lovable, Bolt.new, or v0, the ability to audit your work in real-time is the difference between a side project and a production-ready application.

Connect the MCP server today and start shipping with the confidence that your AI assistant is watching your back.

FAQ

• Is the SimplyScan MCP server free to use?

Yes. The MCP server provides access to all of SimplyScan's free checks, including the comprehensive security and speed scan. You can run these scans directly from your AI assistant without a paid subscription or a SimplyScan account. The free tier includes the initial scan and two rescans, which is perfect for the "fix and verify" loop within your editor.

• Which AI assistants support the SimplyScan MCP server?

Any AI client that supports the Model Context Protocol (MCP) via Streamable HTTP can connect. This currently includes Claude Desktop, Cursor, and Windsurf. As more tools like GitHub Copilot or Replit adopt the MCP standard, they will also be able to use the https://api.simplyscan.io/mcp endpoint to perform security audits.

• Do I need to install a CLI or local package?

No local installation is required for the remote MCP server. You simply add the SimplyScan URL to your assistant's configuration file or settings menu. The assistant connects to our cloud-based engine to perform the scan, meaning it doesn't consume your local CPU resources or require you to manage dependencies.

• Can my AI assistant actually fix the vulnerabilities it finds?

Yes, that is the primary advantage of MCP. Because the assistant receives the scan results as structured data, it can analyze the specific line of code or configuration setting causing the issue. You can prompt it to "fix the exposed API key" or "add the missing CSP header," and it will generate the code and then re-scan to confirm the fix works.

• What is the "AI Visibility" check?

The check_ai_visibility tool performs an AEO (Answer Engine Optimization) audit. It checks if your site's structure, robots.txt, and headers allow AI agents like ChatGPT and Claude to crawl and cite your content. In an AI-driven search landscape, being "invisible" to these bots can significantly reduce your app's discoverability and traffic.

• Does this replace a professional security audit?

While SimplyScan catches the most common "vibe-coding" errors · like exposed .env files or weak Supabase RLS·it is an automated tool. It is an excellent first line of defense for rapid development, but for high-stakes enterprise applications, we still recommend a manual review of complex business logic and authorization flows.