FlawPilot ships an MCP server so the AI tools you already use - Claude, Cursor, ChatGPT, and any MCP-compatible client - can trigger a scan and read the findings back, right inside your editor or chat. This guide walks through connecting one in a couple of minutes.
https://mcp.flawpilot.com/mcpYou'll need a FlawPilot account and an MCP-capable client. The server is remote - nothing to install locally. With OAuth, there's no key to copy at all.
The Model Context Protocol (MCP) is an open standard that lets AI assistants talk to external tools. Connecting FlawPilot turns your assistant into a security co-pilot.
Ask your assistant to scan a URL and it starts a FlawPilot scan for you - no context switch, no dashboard, no copy-pasting links.
Scores and prioritized findings come straight back into the conversation, so your assistant can explain and act on them where you're already working.
Because the findings live in the same context as your code, your assistant can draft the header, config, or DNS change that resolves each issue.
Pick one path. OAuth is the recommended, no-key way if your client supports it. Otherwise use an API key - the same key also works for the REST API and CI.
Nothing to copy. Works with any MCP client that has an "Add connector" / "Connect" flow (Claude Code, Claude.ai, Claude Desktop, and more).
In Claude Code, run the claude mcp add command from the config below WITHOUT a header. In Claude.ai or Claude Desktop, open Settings - Connectors - Add custom connector and paste the MCP server URL (it's in the reference below). No key to create or copy.
{
"mcpServers": {
"flawpilot": {
"url": "https://mcp.flawpilot.com/mcp",
"headers": {
"Authorization": "Bearer YOUR_API_KEY"
}
}
}
}Your browser opens the FlawPilot login, shows which app is asking, and lets you pick a workspace if you belong to more than one. Click Approve and the client is connected - the FlawPilot tools appear in your assistant. (It creates an ordinary API key you can revoke later from Settings - API keys.)
Claude Desktop wants to connect to your FlawPilot workspace.
Ask something like "Scan example.com with FlawPilot and summarize the critical findings." It triggers the scan, waits for results, and reports the scores and prioritized fixes back into the conversation.
For the REST API, CI/scripts, or an MCP client that doesn't support OAuth yet. Creating keys requires the Owner or Admin role.
Sign in, open Settings - API keys, and click Generate key. Give it a name you'll recognise later - for example "Claude Desktop" or "CI pipeline". The same key works for MCP and the REST API.
Give the key a name so you can recognise it later.
FlawPilot shows the key once, in the "Copy your API key" dialog - click Copy and paste it somewhere secure straight away, because you won't be able to see it again. FlawPilot only stores a hash, never the raw key. Revoke a key from the list any time.
This is the only time you'll see this key. Copy it now and store it securely.
Add a new remote server in your client's connector or MCP settings pointing at the FlawPilot MCP endpoint over the Streamable HTTP transport, and paste your key as its Bearer credential (see the per-client config below). Nothing to install - it's a remote server.
{
"mcpServers": {
"flawpilot": {
"url": "https://mcp.flawpilot.com/mcp",
"headers": {
"Authorization": "Bearer YOUR_API_KEY"
}
}
}
}Ask something like "Scan example.com with FlawPilot and summarize the critical findings." It triggers the scan and reports the scores and prioritized fixes back into the conversation.
Every client below connects to the same remote MCP endpoint over the Streamable HTTP transport. OAuth-capable clients authenticate through the connect flow (no key to paste); manual setups send an API key as a Bearer token in the Authorization header - the same key works for the REST API too. Replace YOUR_API_KEY in every snippet with your own key.
https://mcp.flawpilot.com/mcpThe MCP endpoint is rolling out. Until it is live for your account, the config below is the exact shape it will take - the URL and key are all that change.
The endpoint and key are the same everywhere - only where you paste them changes. Swap YOUR_API_KEY for the key from your dashboard.
Desktop apps and IDEs with a connector or MCP settings panel.
OAuth (recommended): open Settings - Connectors - Add custom connector and paste the MCP server URL; approve in your browser, no key needed. To use a key instead, open Settings - Developer - Edit Config and add the block below to claude_desktop_config.json.
{
"mcpServers": {
"flawpilot": {
"url": "https://mcp.flawpilot.com/mcp",
"headers": {
"Authorization": "Bearer YOUR_API_KEY"
}
}
}
}Terminal-based clients you configure with a command.
Claude Code detects OAuth support: run the command WITHOUT a header and it opens your browser to approve - nothing to copy. If you'd rather paste a key, add the --header form instead.
claude mcp add flawpilot --transport http https://mcp.flawpilot.com/mcpclaude mcp add flawpilot --transport http https://mcp.flawpilot.com/mcp \
--header "Authorization: Bearer YOUR_API_KEY"The FlawPilot MCP server exposes these tools to your AI assistant.
list_projectsLists your workspace's projects with their project ID, name, and status - so your assistant can pick which project a scan belongs to.
trigger_scanQueues a scan for a URL against one of your projects. Always confirms the project, pillars, and report email first - it won't assume defaults on your behalf.
get_scan_statusChecks a scan's progress and, once complete, returns its scores - so your assistant can report back when it's done.
Generate a key, connect your assistant, and start scanning from the tools you already use every day.