Redproof
# Redproof MCP server
Check apps built with Lovable, Bolt, Cursor or Claude Code for security problems from inside your AI tool. Redproof reads the code without running it and finds things like tables anyone can read, exposed keys and functions anyone can call.
[](https://www.npmjs.com/package/redproof-mcp) [](LICENSE)
Website and setup: https://redproof.dev/mcp
## Set up
Claude Code:
```bash
claude mcp add redproof -- npx -y redproof-mcp
```
Claude Desktop, Cursor and other clients:
```json
{ "mcpServers": { "redproof": { "command": "npx", "args": ["-y", "redproof-mcp"] } } }
```
## Tools
| Tool | What it does |
|---|---|
| `scan_github_repo` | Starts a scan of a public GitHub repo. Refuses unless you confirm you own the code or may have it reviewed. |
| `get_report` | Reads the score and findings, with the files and a fix prompt for each. |
Try: "Scan https://github.com/me/my-app with Redproof. I own this code. Fix the critical issues one at a time and show me each change."
## Good to know
- The server is free. A free scan gives the score, the counts and the most serious finding we could prove. The rest is in the paid report on redproof.dev.
- It sends the repo URL to redproof.dev. Your AI tool sees the report under its own terms.
- Only scan code you own or are allowed to have reviewed.
- A scan lowers risk. It does not prove an app is safe. Read each fix before you keep it.
## Build from source
```bash
npm ci
npm run build
node dist/index.js # speaks MCP over stdio
```
This repository is a mirror of the MCP server in the Redproof codebase. Issues and pull requests are welcome here.
TDQS
Scored across 2 tools
The two tools have clearly distinct roles: one initiates a scan and returns a token, the other reads results using that token. There is no overlap in purpose and the descriptions make the sequence explicit.
Both names follow a consistent snake_case verb_noun pattern (scan_github_repo, get_report) and are self-descriptive. No convention mixing.
Two tools is thin for a service; the surface is essentially a single async operation split into start and poll. It is defensible for a narrow purpose but leaves little room for auxiliary operations.
The core lifecycle (start scan, fetch findings with fixes) is covered end to end. Minor gaps exist: no status/cancel, no listing or re-fetching of past scans, and polling relies on the caller retrying blindly.