MCP · for AI coding agents

Deep security scans of your repos, inside Cursor & Claude Code.

Connect a GitHub repo to OpzyAI once, then your agent runs server-side deep scans — SAST, dependency CVEs and secrets across your full git history — without leaving the editor. Plus a free local scanner for the code on your machine.

Deep repo scans: SAST, CVEs, git-history secrets Free local scan — never leaves your machine Need a URL scan? Run it in the browser

Get the install commands Scan a URL in the browser

Claude Code · opzyai-pro connected

Deep-scan my connected repo for vulnerabilities

deep_scanagency-pilot~70s

Deep scan complete — 3 findings, most severe first

CRITICALSQL injection in user lookupsrc/api/users.ts:42
HIGHVulnerable dependency: lodashCVE-2021-23337
MEDAWS key in git history.env.bak @ a1b2c3d

propose_fix3 paste-ready fixes

Install

Add it to your editor in one step

Pro deep-scans the GitHub repos you’ve connected to OpzyAI; the free local scanner checks the code on your machine. Add either (or both) — they use different names so they don’t clash.

Pro · deep scan

Hosted — deep-scans your connected repos

Runs on our servers against a GitHub repo you’ve connected in your OpzyAI dashboard (Assets → connect a repo). Authenticates with a personal access token from Settings → MCP access tokens. Exposes list_repos, deep_scan, get_scan_results and propose_fix.

Token required · deep_scan needs the Pro plan or above.

Claude Code

terminal

claude mcp add --transport http opzyai-pro https://www.opzyai.com/api/mcp/pro/mcp --header "Authorization: Bearer opz_live_..."

Cursor (~/.cursor/mcp.json)

json

{
  "mcpServers": {
    "opzyai-pro": {
      "url": "https://www.opzyai.com/api/mcp/pro/mcp",
      "headers": { "Authorization": "Bearer opz_live_..." }
    }
  }
}

Free · no account

Local — scans your project’s code

Runs on your machine via npx — no account, nothing leaves your computer. Needs Node 18+. Exposes the security_check tool.

Claude Code

terminal

claude mcp add opzyai -- npx -y @opzyai/mcp

Cursor (~/.cursor/mcp.json)

json

{
  "mcpServers": {
    "opzyai": {
      "command": "npx",
      "args": ["-y", "@opzyai/mcp"]
    }
  }
}

Just need to scan a live URL? You don’t need an MCP for that — do it in the browser at opzyai.com/scan, no install.

The tools

Deep repo scans, or a quick local check

Add both and your agent picks the right one — deep-scan a repo you’ve connected, or check the code in front of you on your machine.

deep_scan

Hosted · pro · connected repo

A server-side deep scan of a GitHub repo you’ve connected to your OpzyAI account. Findings land in your dashboard, ranked by severity, with paste-ready fixes.

SAST: injection, auth and unsafe sinks in your code
Vulnerable dependencies (CVEs) with fix versions
Secrets committed anywhere in git history
Saved to your OpzyAI account, shareable with your team

propose_fix

Hosted · pro · connected repo

Turns a completed deep_scan into ready-to-apply fixes: exact package.json edits for dependency CVEs and provider-specific secret-rotation runbooks. Your agent applies them in your editor — OpzyAI never changes your repo.

Exact package.json upgrade edits for dependency CVEs
Step-by-step rotation runbooks for leaked secrets
Applied in-editor by your agent — read-only on our side
Pro plan and above

security_check

Local · free · npx @opzyai/mcp

Scans the project you’re working on, entirely on your machine. No account, and your code never leaves your computer.

Hardcoded API keys in your source
A committed / un-gitignored .env
Secrets buried in git history
Known-vulnerable dependencies (CVEs)

How it works

From “deep-scan my repo” to fixes, in the chat

Add the MCP

One command in Claude Code, or a few lines in Cursor's config. Pro authenticates with a personal access token you create in Settings → MCP access tokens; the free local scanner just needs Node 18+. Then restart your editor.

Ask your agent

“Deep-scan my connected repo with opzyai-pro”, or “run a security check with opzyai on this project” for the code on your machine. The agent calls the right tool.

Fix and re-run

You get ranked findings with paste-ready fixes — SAST, CVEs and git-history secrets for repos, secrets and deps for local code. Apply them, then run it again to confirm.

what your agent gets back (pro deep scan)

Deep scan complete — 3 finding(s), most severe first:

[CRITICAL] SQL injection in user lookup
  src/api/users.ts:42 — request input concatenated into the query
  Fix:   Use parameterized queries / your ORM’s bind params.

[HIGH] Vulnerable dependency: lodash 4.17.19 (CVE-2021-23337)
  package.json — prototype pollution
  Fix:   Upgrade to lodash ≥ 4.17.21.

[MEDIUM] AWS key committed in git history
  .env.bak @ commit a1b2c3d
  Fix:   Rotate the key now; purge it with git filter-repo.

Just need a URL scan? Do it in your browser.

Paste a URL and get a Launch Readiness score and fixes — no editor, no install required.

Open the web Vibe Check Talk to us