MCP Server
Security scanning, right inside your AI coding assistant
Vergate ships an MCP server so Claude Code, Cursor, Windsurf and VS Code can scan any website — security, performance, SEO, AEO, accessibility, tech profiling — and get findings back inline, without leaving your editor.
Why your AI assistant needs a scanner
Your AI pair-programmer writes code fast — that's the point. But it can't see what the deployed site actually looks like. Headers missing, endpoints exposed, dependencies outdated: those live at the URL, not in the diff. Vergate's MCP tools give your assistant eyes on the live site.
The workflow that was impossible before now takes one sentence: “scan our staging URL before we merge”. The assistant calls the scanner, reads the findings, and can even apply the suggested fixes in the same session.
Tools your assistant gains
- scan_website — passive security scan (headers, exposed files, redirects, CVEs) with optional active scan profile.
- get_scan_results / list_scans — read findings and scan history for a project.
- profile_site— technology stack detection (50+ detectors plus WhatWeb's 1,800 plugins).
- performance_check — Lighthouse Core Web Vitals with AI-generated optimization prompts.
- seo_check / aeo_check — search and answer-engine readiness.
- accessibility_check — WCAG 2.1 AA audit with fix prompts.
- deliverability_check — SPF, DKIM, DMARC and email DNS health.
- scan_integrations — security posture of connected providers (GitHub, Vercel, Cloudflare, and more).
Setup in three steps
- Install:
pip install vergate-mcp— it ships as a pip package with a single console command,vergate-mcp. - Create a project key:in your project's MCP page, generate a project-scoped API key (shown once, never stored).
- Configure your assistant:add the MCP server with your key and you're done — the tools appear automatically.
Detailed copy-paste configs for Claude Code, Cursor, Windsurf and VS Code are in the MCP docs — including per-project key setup so each client is locked to exactly one project.
Secure by design
- Project-scoped keys — a key created for one project cannot see or scan another. Wrong project? 404, not an error dump.
- Show-once keys — the raw key is displayed exactly once and stored only as a SHA-256 hash. Revoke any key from the dashboard at any time.
- Works with your stack — scans talk to our cloud backend over HTTPS; nothing runs on your machine except the thin client.
Give your pair-programmer a scanner
Read the setup guide or run a free scan right now.
Frequently asked questions
What is MCP?+
MCP (Model Context Protocol) is an open standard that lets AI assistants like Claude Code call external tools. An MCP server exposes capabilities — in Vergate's case, scanning tools — that your AI can invoke on demand, with results returned into the conversation.
Which editors and assistants does it work with?+
Anything that speaks MCP over stdio: Claude Code, Cursor, Windsurf, VS Code, and open-source clients like OpenClaw. We also ship an HTTP transport for web-based tools and remote setups. Setup is a one-line command in each tool's MCP configuration.
Is my API key safe?+
Keys are scoped per project and shown once at creation — the raw value is never stored. You can generate, list and revoke keys independently from the dashboard, and a project-scoped key can only access that project.
Do I need a paid plan?+
The MCP server itself is free to install. It talks to your Vergate account, so which tools work depends on your plan — the free plan covers passive scans and standalone analyses, while active scanning and deeper features need a paid plan. See pricing.
How is this different from an in-editor security linter?+
Linters check the code you've written. Vergate scans the site you've deployed — live headers, exposed files, real endpoints, TLS, third-party trackers, CVEs in your runtime stack. It catches the stuff that only exists once your app is actually running and reachable.
Set up the MCP server in under a minute
Install vergate-mcp, point it at your project-scoped API key, and your AI pair-programmer gains a security scanner.
Start scanning free