Docs

Use AppSafe from your AI coding tool

Connect AppSafe to Claude Code, Cursor or any other MCP client, or call the REST API from your own scripts. Your agent can scan a verified site, read each finding's fix prompt, apply the fix and recheck it, all in one loop.

The API, the MCP server and report exports are included in the Pro, Agency and Team plans.

1. Create an API key

Go to Dashboard → Account → API keys, name a key and copy it. It's shown only once, and AppSafe stores just a hash. Keys start with appsafe_ and only work on your own sites.

2. Connect the MCP server

The server uses Streamable HTTP at the URL below and authenticates with your API key as a bearer token. Replace YOUR_KEY with your key.

https://appsafe.dev/api/mcp

Claude Code

Run this once, or add the JSON to .mcp.json in your project:

claude mcp add --transport http appsafe https://appsafe.dev/api/mcp \
  --header "Authorization: Bearer YOUR_KEY"

{
  "mcpServers": {
    "appsafe": {
      "type": "http",
      "url": "https://appsafe.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_KEY"
      }
    }
  }
}

Cursor

Add this to ~/.cursor/mcp.json, or to .cursor/mcp.json in your project:

{
  "mcpServers": {
    "appsafe": {
      "url": "https://appsafe.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_KEY"
      }
    }
  }
}

Other MCP clients: use the same URL and Authorization header.

Tools

list_sites: Your sites, whether they're verified, and their latest scan.
start_scan: Starts a full scan of a verified site, by URL. Unverified sites are refused with instructions on how to verify them.
get_scan_status: Running, completed or failed, with score, grade and severity counts.
get_report: The report as Markdown (written for agents), JSON or SARIF.
recheck_finding: After you deploy a fix, re-runs only the checks behind one finding: fixed, still present or inconclusive.

The loop

Ask your agent to scan your site with AppSafe.
It reads the Markdown report and applies each fix prompt, most severe first.
You deploy the changes, because AppSafe scans the live site.
The agent rechecks each finding until it's fixed.

Example prompt: “Scan myapp.com with AppSafe, fix the critical and high findings, and recheck them after I deploy.”

REST API

Base URL: https://appsafe.dev/api/v1. Send your key in the Authorization header as Bearer YOUR_KEY. The OpenAPI spec describes every endpoint.

Endpoint	What it does
GET /sites	List your sites
POST /scans	Start a full scan of a verified site (siteId or url)
POST /sites/{id}/scans	Re-scan one site
GET /scans/{id}	Scan status, score, grade and severity counts
GET /scans/{id}/findings	Findings with evidence, fix prompt and recheck ref
GET /scans/{id}/report?format=markdown	Report as markdown, json or sarif
POST /findings/recheck	Recheck one finding by its ref

Example

curl -X POST https://appsafe.dev/api/v1/scans \
  -H "Authorization: Bearer YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://myapp.com"}'

curl "https://appsafe.dev/api/v1/scans/SCAN_ID/report?format=markdown" \
  -H "Authorization: Bearer YOUR_KEY"

Report exports

Every completed scan can be exported as Markdown written for AI agents (evidence, affected URL, fix prompt and how to verify each finding) or as SARIF 2.1.0 for code scanning tools. Download them from the scan in your dashboard, or use the report endpoint.

Limits and safety

120 API requests per 15 minutes per account (30 rechecks), plus your plan's daily and concurrent scan limits.
Full scans and rechecks only run on sites you've verified you own.
Secrets are redacted in every response, and database findings list table and field names only, never your data.
You can revoke a key at any time in your account. It stops working immediately.