Documentation

How to use SecureCode

Pick the tab that matches how you work. Use the editor extension for in-editor scanning, or connect via MCP to hand SecureCode to your AI agent. Same account, same credits.

You need an account first — signing up is free and gives you 3 scans to try it out.

MCP is how AI agents use outside tools. Connect SecureCode once, and your agent can scan your code, explain what's broken, and write the fix itself — while you stay in control of what actually gets changed. You don't need to know any security to use this.

1. Install the standalone MCP server

No VS Code extension needed. Install once and use it with any MCP client:

Terminal

npm install -g @securecode-ai/mcp

Terminal

securecode-mcp login

Enter the email you signed up with. We send you a code — paste it back in. Your token is stored in your OS keychain (never in a file).

2. Add the config to your agent

Cursor

Paste it into .cursor/mcp.json in your project, or ~/.cursor/mcp.json to turn it on everywhere.

.cursor/mcp.json

{
  "mcpServers": {
    "securecode": {
      "command": "securecode-mcp",
      "args": ["serve", "--workspace", "/path/to/your/project"]
    }
  }
}

Claude Code

Terminal

claude mcp add securecode -s user -- securecode-mcp serve --workspace /path/to/your/project

Windsurf

Open Settings, find MCP Servers, click Add Server, and paste this in.

Windsurf — MCP Servers

{
  "mcpServers": {
    "securecode": {
      "command": "securecode-mcp",
      "args": ["serve", "--workspace", "/path/to/your/project"]
    }
  }
}

Any other agent

Nearly every MCP client uses this exact format. Look for an MCP or Tools section in its settings and paste this in. Point --workspace at your project root.

mcp.json

{
  "mcpServers": {
    "securecode": {
      "command": "securecode-mcp",
      "args": ["serve", "--workspace", "/path/to/your/project"]
    }
  }
}

3. Restart your agent and scan

It only reads the config on startup. After restarting, four SecureCode tools show up in its tool list. Try:

Say this to your agent

Use SecureCode to scan this file and explain what's wrong in plain English.

4. Prompts you can paste

Once it's connected, you talk to it normally. These work as-is:

Say this to your agent

Use SecureCode to scan this file and explain what's wrong in plain English.

Say this to your agent

Use SecureCode to fix everything it found, then show me the diff before changing anything.

Say this to your agent

Scan my whole project with SecureCode and give me the three things worth fixing first.

Say this to your agent

Run SecureCode's attack tool on the fix to prove it actually works.

Say this to your agent

Use SecureCode to attack the /api/auth/login endpoint and tell me if it's really exploitable.

What your agent can do

securecode.scan

Reads your code and lists what is wrong, how bad it is, and exactly where.

securecode.map

Builds a map of your app — your pages, your login, where your data lives — so the other tools understand how it fits together.

securecode.fix

Writes the fix and shows it to you first. Asks you first.

securecode.attack

Boots a localhost dev server and runs an AI attack agent against your endpoints to prove the fix actually holds. Uses attacker credits. Asks you first.

Approvals open in your browser. When your agent wants to change code or run an attack, a page opens at 127.0.0.1 asking you to approve. Nothing changes without your click.

If something isn't working

My agent says the tools don't exist

Restart the agent — it only reads the config on startup. If they're still missing, check the config file: for the standalone MCP, make sure securecode-mcp is installed (npm ls -g @securecode-ai/mcp). For the extension MCP, check the file path in args actually exists.

It says my API key is invalid or missing

For the standalone MCP, run securecode-mcp login again. For the extension MCP, run SecureCode: Show MCP Setup in VS Code again, copy the fresh config, and paste it over the old one.

It says I denied approval, but nothing asked me

With the standalone MCP, the approval page opens in your browser. With the extension MCP, it opens in VS Code. Keep the relevant app open on the same project.

It says there's no Project Map

Run securecode.map first — your agent can do this, or run securecode-mcp serve once to build it. For the extension, run SecureCode: Rebuild Project Map in VS Code.