CheckMyLaunch MCP server

Lets an AI coding tool (Claude Code, Claude Desktop, Cursor, etc.) run a CheckMyLaunch scan and read back findings + repair prompts without leaving the chat.

This is a paid feature. Every tool call is gated behind a CheckMyLaunch API key from a paid account (one-time Launch Check purchase or the Continuous Guard subscription) — get one at checkmylaunch.com/account after signing in and upgrading. Without a valid key configured, every tool refuses with a message pointing you there instead of running.

Tools

• scan_repo { repoUrl } — scans a public GitHub repo.

• scan_url { url } — scans a live site.

• get_repair_prompt { scanId, findingId } — fetches the paste-back fix prompt for one finding.

Related MCP server: Sekrd Security Scanner

Setup

1. Sign in at checkmylaunch.com, upgrade to a paid plan, then go to your account page and generate an API key.

2. Add this to your MCP client's config:

{
  "mcpServers": {
    "checkmylaunch": {
      "command": "npx",
      "args": ["github:matdtools-code/checkmylaunch-mcp"],
      "env": { "CHECKMYLAUNCH_API_KEY": "cml_live_..." }
    }
  }
}

Claude Code: claude mcp add or edit .claude/mcp.json / ~/.claude.json. Claude Desktop / Cursor: same JSON shape in their respective MCP config files.

Try it locally

npm install
CHECKMYLAUNCH_API_KEY=cml_live_... node test/smoke.js

Config

• CHECKMYLAUNCH_API_KEY — required. From your CheckMyLaunch account page.

• CHECKMYLAUNCH_API_URL — override the API base URL (defaults to https://www.checkmylaunch.com); useful for pointing at localhost:8899 during development.

How the gate works

Every tool call first verifies the key against GET /api/auth/api-key on the CheckMyLaunch server, which only resolves for a signed-in, paid account (see server/src/routes/auth.js in the main app repo). A missing, invalid, or free-plan key stops the call before any scan runs.

This doesn't (and can't) prevent someone from calling CheckMyLaunch's public /api/scan/public-github / /api/scan/url endpoints directly without this plugin — those intentionally stay open, capped at a small free weekly quota with truncated findings, as the website's own no-signup teaser. What the key unlocks is the difference that actually matters for real use: uncapped findings and no weekly quota, from inside your coding tool.