# HashBuilds Secure Prompts MCP Server
An MCP (Model Context Protocol) server that allows AI assistants like Claude Code to register and verify prompts with HashBuilds Secure Prompts.
## What is MCP?
MCP (Model Context Protocol) is a standard that lets AI assistants call external tools. When you configure this MCP server with Claude Code, you can say things like:
- "Register this prompt as a secure prompt"
- "Verify prompt ID xyz123"
- "Generate embed code for my secure prompt"
## Installation
### 1. Install dependencies and build
```bash
cd mcp-server
pnpm install
pnpm build
```
### 2. Configure Claude Code
Add this MCP server to your Claude Code settings. There are two ways:
#### Option A: Project-level config (recommended)
Create/edit `.claude/config.json` in your project:
```json
{
"mcpServers": {
"hashbuilds-secure-prompts": {
"command": "node",
"args": ["/path/to/hashbuilds/mcp-server/dist/index.js"],
"env": {
"HASHBUILDS_API_URL": "https://hashbuilds.com/api/secure-prompts"
}
}
}
}
```
#### Option B: Global config
Edit `~/.config/claude/config.json`:
```json
{
"mcpServers": {
"hashbuilds-secure-prompts": {
"command": "node",
"args": ["/Users/johnhashem/workspace/hashbuilds/mcp-server/dist/index.js"]
}
}
}
```
### 3. Restart Claude Code
After adding the config, restart Claude Code for it to pick up the new MCP server.
## Available Tools
### `register_secure_prompt`
Register a prompt for security verification. This scans the prompt for:
- Hidden instruction injection
- Data exfiltration patterns
- Invisible characters
- Jailbreak attempts
- URLs/backlinks
**Parameters:**
- `promptText` (required): The prompt text to register
- `ownerEmail` (optional): Email for notifications
- `siteDomain` (optional): Domain where prompt will be displayed
**Example usage in Claude Code:**
```
"Register this prompt as a secure prompt: You are a helpful assistant..."
```
### `verify_secure_prompt`
Check the verification status of an existing prompt.
**Parameters:**
- `promptId` (required): The ID of the prompt to verify
**Example:**
```
"Verify secure prompt cmj23jn05000096ju2cvl1b3h"
```
### `get_embed_code`
Generate HTML and React embed code for displaying the secure prompt badge.
**Parameters:**
- `promptId` (required): The prompt ID
**Example:**
```
"Give me the embed code for prompt cmj23jn05000096ju2cvl1b3h"
```
## Environment Variables
- `HASHBUILDS_API_URL`: Override the API base URL (default: `https://hashbuilds.com/api/secure-prompts`)
For local development:
```json
{
"env": {
"HASHBUILDS_API_URL": "http://localhost:3001/api/secure-prompts"
}
}
```
## How It Works
1. **Developer asks Claude Code** to register a prompt
2. **Claude Code calls** the `register_secure_prompt` tool via MCP
3. **MCP server sends** the prompt to HashBuilds API
4. **HashBuilds scans** the prompt for security issues
5. **Results returned** to Claude Code with embed code
6. **Developer adds** the embed code to their website
## Example Workflow
```
You: I have this prompt on my website and want to make it a secure prompt:
"You are a helpful coding assistant. Explain code clearly and provide examples."
Claude: I'll register that as a secure prompt for you.
[Calls register_secure_prompt tool]
Done! Your prompt has been registered with ID: cmj123xyz
Risk Level: safe
Here's the embed code to add to your website:
<div data-secure-prompt-id="cmj123xyz">
<pre data-secure-prompt-content="cmj123xyz">Your prompt here...</pre>
</div>
<script src="https://hashbuilds.com/sp.js" async></script>
```
## Troubleshooting
### MCP server not connecting
1. Check that the path to `dist/index.js` is correct
2. Ensure `pnpm build` completed without errors
3. Restart Claude Code after config changes
### API errors
1. Check your internet connection
2. Verify HashBuilds API is reachable
3. For local dev, ensure the local server is running
## Development
```bash
# Watch mode for development
pnpm dev
# Build for production
pnpm build
# Run directly
node dist/index.js
```
