Connect your AI assistant to FlawPilot

FlawPilot ships an MCP server so the AI tools you already use - Claude, Cursor, ChatGPT, and any MCP-compatible client - can trigger a scan and read the findings back, right inside your editor or chat. This guide walks through connecting one in a couple of minutes.

The server is remote - there's nothing to install locally.

What is MCP, and why connect it?

The Model Context Protocol (MCP) is an open standard that lets AI assistants talk to external tools. Connecting FlawPilot turns your assistant into a security co-pilot:

• Trigger scans from chat - ask your assistant to scan a URL and it starts a FlawPilot scan for you: no context switch, no dashboard, no copy-pasting links.
• Read findings inline - scores and prioritized findings come straight back into the conversation, so your assistant can explain and act on them where you're already working.
• Turn findings into fixes - because the findings live in the same context as your code, your assistant can draft the header, config, or DNS change that resolves each issue.

Before you start

• A FlawPilot account - create one free from the dashboard.
• An MCP-compatible client: Claude (desktop or Claude Code), Cursor, VS Code, ChatGPT, or any tool that speaks MCP.
• A FlawPilot API key, generated from Settings → API keys in your dashboard (see steps 1–3 below). The same key works for MCP and the REST API.

Connect in five steps

First generate a key from your FlawPilot dashboard, then point your AI client at the FlawPilot MCP server using that key, and scan.

1. Open API keys in your dashboard

Sign in to FlawPilot and open your dashboard. In the left sidebar under Settings, click API keys. This is where your keys for MCP and automated scans live.

2. Generate a key

Click Generate key in the top right. In the dialog, give the key a name you'll recognise later - for example Claude MCP or CI pipeline - then click Generate.

3. Copy your key and store it safely

FlawPilot shows the key once, in the "Copy your API key" dialog. Click Copy and paste it somewhere secure straight away - you won't be able to see it again. Click Done to close the dialog. You can revoke a key from the list at any time.

The key is shown only once

If you lose it, you can't recover it - revoke the key and generate a new one.

4. Add the FlawPilot MCP server to your client

In your AI client's connector or MCP settings, add a new remote server pointing at the FlawPilot MCP endpoint, and paste the key you just copied as its credential. Nothing to install - it's a remote server. Approve the connection when your client prompts you, and the FlawPilot tools appear in your assistant's tool list.

See Client-specific setup below for exact snippets.

5. Scan from your assistant

Ask your assistant something like:

Scan example.com with FlawPilot and summarize the critical findings.

It triggers the scan, waits for results, and reports the scores and prioritized fixes back into the conversation:

Overall 82. 1 critical: API key exposed in JS bundle. 2 high on headers. Want the fixes?

The FlawPilot MCP server

Every client below connects to the same remote MCP endpoint over the Streamable HTTP transport and authenticates with the API key you generated above. The key is sent as a Bearer token in the Authorization header - the same key works for the REST API too.

Remote MCP server URL

https://mcp.dev.flawpilot.com/mcp

Replace YOUR_API_KEY in every snippet below with your own key.

Rolling out

The MCP endpoint is rolling out. Until it is live for your account, the config below is the exact shape it will take - the URL and key are all that change.

Client-specific setup

The endpoint and key are the same everywhere - only where you paste them changes.

Claude Desktop

Open Settings → Developer → Edit Config to open claude_desktop_config.json, add the FlawPilot server, and restart Claude. The FlawPilot tools then appear in the tools menu.

claude_desktop_config.json

{
  "mcpServers": {
    "flawpilot": {
      "url": "https://mcp.dev.flawpilot.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

Claude Code

Add FlawPilot as an HTTP MCP server from your terminal. Claude Code stores it in your MCP config and the tools are available on your next session.

Terminal

claude mcp add flawpilot --transport http https://mcp.dev.flawpilot.com/mcp \
  --header "Authorization: Bearer YOUR_API_KEY"

VS Code

Add a .vscode/mcp.json in your workspace (or your user MCP config). VS Code prompts for the key once and stores it securely rather than writing it into the file. GitHub Copilot's agent mode then lists the FlawPilot tools.

.vscode/mcp.json

{
  "inputs": [
    {
      "type": "promptString",
      "id": "flawpilot-api-key",
      "description": "FlawPilot API key (Bearer token)",
      "password": true
    }
  ],
  "servers": {
    "flawpilot": {
      "type": "http",
      "url": "https://mcp.dev.flawpilot.com/mcp",
      "headers": {
        "Authorization": "Bearer ${input:flawpilot-api-key}"
      }
    }
  }
}

Antigravity

Open Agent Manager → settings (gear icon) → Manage MCP Servers → Add custom server. This opens Antigravity's MCP config file; add FlawPilot as a remote HTTP server.

MCP config

{
  "mcpServers": {
    "flawpilot": {
      "serverUrl": "https://mcp.dev.flawpilot.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

If it doesn't connect

Rename serverUrl to url - Google's MCP config schema has used both keys across editor versions.

Any other MCP client

Any client that supports the Streamable HTTP transport works the same way: point it at the FlawPilot MCP URL and set the Authorization header. There's no vendor-specific setup on FlawPilot's side.

Remote (HTTP) client

URL:    https://mcp.dev.flawpilot.com/mcp
Header: Authorization: Bearer YOUR_API_KEY

What your assistant can do once connected

The FlawPilot MCP server exposes these tools to your AI assistant.

Tool	What it does
list_projects	Lists your workspace's projects with their project ID, name, and status - so your assistant can pick which project a scan belongs to.
trigger_scan	Queues a scan for a URL against one of your projects. Always confirms the project, pillars, and report email first - it won't assume defaults on your behalf.
get_scan_status	Checks a scan's progress and, once complete, returns its scores - so your assistant can report back when it's done.

Frequently asked questions

Is my API key sensitive?

Yes. Your API key authenticates as your whole workspace - anyone with it can trigger scans and read results. Treat it like a password: never commit it to a repo or paste it into a public chat, and use one key per integration. FlawPilot shows the key only once when you generate it, so store it securely. If it leaks, revoke it from Settings → API keys and generate a new one.

Does connecting over MCP change what a scan sees?

No. Scans triggered over MCP use the exact same public-signals engine as the website. MCP is just a different way to start a scan and read the results - the checks and scoring are identical.

Which clients are supported?

Any MCP-compatible client. We test against Claude (desktop and Claude Code), Cursor, and ChatGPT, but the connection works with any tool that supports remote MCP servers.

Can I revoke access later?

Yes. Revoke the API key in your FlawPilot Settings → API keys at any time. The connected assistant immediately loses access until you issue and configure a new key.