MODEL CONTEXT PROTOCOL
Claude writes the fix. UNPWNED proves it worked.
Connect UNPWNED to Claude Code, Cursor, or Windsurf with one URL and a personal API key. Your AI agent scans your live site, reads the real findings, fixes them in your code, and UNPWNED re-scans from outside to prove the issue is gone. The security review lives inside the tool you already work in.
claude mcp add --transport http unpwned https://unpwned.io/api/mcp--header "Authorization: Bearer YOUR_KEY"Generate an MCP key in your UNPWNED settings first, then drop it in. In Cursor or Windsurf: add a remote MCP server with https://unpwned.io/api/mcp and your key as an Authorization header. Native claude.ai connector support is on the way.
Four Tools
Start a scan
Your agent kicks off a real, external scan of a site you own or are authorized to test. Same 36-scanner engine, same monthly quota as the dashboard. It confirms authorization before anything runs.
Read the results
Score, grade, severity counts, and every finding title, straight into the conversation. This is the ground truth about your deployed site that an AI in your editor simply cannot see on its own.
Get the exact fix
Full remediation detail plus a ready-to-paste fix prompt per finding, so your agent fixes the real issue with the real observed context. Then re-scan to prove the hole is closed.
Check CVE Radar
Look up any technology and version against our CVE database, enriched with CISA KEV (actively exploited) and EPSS exploit-probability. No scan needed, instant answer.
How it Works
Generate a key
In your UNPWNED account, open Settings, choose AI tool (MCP), review the authorization, and create an MCP key. It is tied to your account and your plan, and you can revoke it anytime.
Add UNPWNED to your editor
One command in Claude Code, or a few lines in Cursor / Windsurf: the UNPWNED URL plus your key as an Authorization header. No server to run.
Just talk to your agent
"Scan floweco.com and tell me what is wrong." "Fix the findings." "Is Next.js 14.1 affected by any CVE?" The agent calls the tools behind the scenes.
Fix, then prove it
Your agent writes the fix in your code. UNPWNED re-scans the live deployment from outside and confirms the issue is actually gone. That loop is the whole point.
Scoped to you
A connected tool acts only as you and only reaches your own scans. It can never see another account’s data. Revoke any tool or key at any time from your account.
Same rules as the app
Same monthly quota, same authorization requirement, same Free-shows-WHAT and Pro-shows-HOW gating as the dashboard. The MCP server is a new door into the same engine, not a shortcut around it.
Common Questions
What is the UNPWNED MCP server?
It is a remote Model Context Protocol (MCP) server that lets AI tools like Claude Code and Cursor use UNPWNED on your behalf. Once connected, your AI agent can start security scans, read the findings, look up CVEs, and (on Pro) pull the exact remediation steps, all from inside your normal conversation. There is nothing to install: you add one HTTPS URL to your AI client with a personal API key.
If my AI can already write code, why do I need UNPWNED in the loop?
Because your AI sees your code, not your deployment. It cannot see which security headers your server actually serves, which secret leaked into your production bundle, whether an API route is exposed, or whether your RLS is truly enforced in production. UNPWNED scans the live site from outside and gives your agent that ground truth. And after your agent writes a fix, UNPWNED re-scans to prove it actually worked, which is the step you should never take on trust.
Which tools can I use it with?
Any MCP client that lets you send an Authorization header to a remote server: Claude Code, Cursor, and Windsurf all support this today. Generate an MCP key in your UNPWNED account settings first, then add the UNPWNED URL with your key. Support for claude.ai custom connectors is on the way.
How do I connect it to Claude Code?
First create an MCP key in your UNPWNED settings. Then run: claude mcp add --transport http unpwned https://unpwned.io/api/mcp --header "Authorization: Bearer YOUR_KEY" . That is it, no browser login step.
How do I connect it to Cursor or Windsurf?
Add a remote MCP server in your MCP config with the UNPWNED URL and your key as a header. In Cursor (.cursor/mcp.json): {"mcpServers":{"unpwned":{"type":"http","url":"https://unpwned.io/api/mcp","headers":{"Authorization":"Bearer YOUR_KEY"}}}}. Windsurf uses the same shape with serverUrl instead of url.
Does a connected tool get my data?
Only your own scan data is available through the four MCP tools. Your API key is tied to your account and every tool call is scoped to it, so a connected tool cannot reach another user's data or anything else in your account. When you direct a tool to read a report, that data goes to the tool you connected and is then handled under that provider's privacy policy. You can revoke the API key at any time from your account settings. See our Terms (Section 1c) and Privacy Policy (Section 2.12).
What is free and what needs Pro?
Free tells you WHAT is wrong: score, grade, severity counts, and finding titles, plus CVE Radar lookups. Pro unlocks HOW to fix it: full remediation detail and the ready-to-paste fix prompt per finding, plus unlimited re-scans to verify your fixes. The MCP server uses the exact same plan rules as the dashboard.
Put a security engineer in your IDE
Create a free account, connect the URL, and let your AI agent scan and fix. Upgrade to Pro when you want the full fix and the verify loop.