Allows starting security scans of public GitHub repositories and retrieving reports with scores and findings, including affected files and fix prompts. Requires confirmation that the user owns the code or is allowed to have it reviewed.
Check apps built with Lovable, Bolt, Cursor or Claude Code for security problems from inside your AI tool. Redproof reads the code without running it and finds things like tables anyone can read, exposed keys and functions anyone can call.
Website and setup: https://redproof.dev/mcp
Claude Code:
claude mcp add redproof -- npx -y redproof-mcpClaude Desktop, Cursor and other clients:
{ "mcpServers": { "redproof": { "command": "npx", "args": ["-y", "redproof-mcp"] } } }Related MCP server: shipsafe-mcp
Tool | What it does |
| Starts a scan of a public GitHub repo. Refuses unless you confirm you own the code or may have it reviewed. |
| Reads the score and findings, with the files and a fix prompt for each. |
Try: "Scan https://github.com/me/my-app with Redproof. I own this code. Fix the critical issues one at a time and show me each change."
The server is free. A free scan gives the score, the counts and the most serious finding we could prove. The rest is in the paid report on redproof.dev.
It sends the repo URL to redproof.dev. Your AI tool sees the report under its own terms.
Only scan code you own or are allowed to have reviewed.
A scan lowers risk. It does not prove an app is safe. Read each fix before you keep it.
npm ci
npm run build
node dist/index.js # speaks MCP over stdioThis repository is a mirror of the MCP server in the Redproof codebase. Issues and pull requests are welcome here.
Read the score and findings of a Redproof scan, with the exact files and a fix prompt per finding.
Inputs: token (required).
Start a security check of a public GitHub repository built with AI tools (Lovable, Bolt, Cursor...). Only for code the user owns or may have reviewed: ask them first and set owner_confirmed only after they say yes. Returns a token; call get_report with it after about a minute.
Inputs: url (required), owner_confirmed (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 2 tools
The two tools have clearly distinct roles: one initiates a scan and returns a token, the other reads results using that token. There is no overlap in purpose and the descriptions make the sequence explicit.
Both names follow a consistent snake_case verb_noun pattern (scan_github_repo, get_report) and are self-descriptive. No convention mixing.
Two tools is thin for a service; the surface is essentially a single async operation split into start and poll. It is defensible for a narrow purpose but leaves little room for auxiliary operations.
The core lifecycle (start scan, fetch findings with fixes) is covered end to end. Minor gaps exist: no status/cancel, no listing or re-fetching of past scans, and polling relies on the caller retrying blindly.
Security scans for AI-built apps: leaked keys, open Supabase RLS, vulnerable packages, live sites.
Free security scan for AI-written GitHub repos: leaked keys, .env, eval, SQLi, CORS.
Security checks for AI-built apps (Lovable, Supabase, Bolt): RLS, headers, monitoring, fixes.
Checks AI-written code for leaked keys and made-up packages, on your machine. Never uploads code.
