Sniff & Fix

SniffPup in your AI coding tool

Ask Claude Code, Cursor or another AI coding tool to scan your live site. It reads what SniffPup found, fixes your code and checks again.

Get a token

What you need

• A Starter, Pro or Ultimate plan and a token from Account › API tokens (the same tokens as the Scan API: Starter up to 2, Pro 10, Ultimate 25). The token is shown once; we store only a hash. Revoke it there at any time and the tool stops working right away.
• Your site added to your dashboard and ownership verified. SniffPup only scans sites in your own account.

Connect it

Save your token in an environment variable named SNIFFPUP_TOKEN, then pick your tool.

Claude Code

claude mcp add --transport http sniffpup https://sniffpup.com/api/mcp \
  --header "Authorization: Bearer $SNIFFPUP_TOKEN"

Cursor

Add this to .cursor/mcp.json in your project, or ~/.cursor/mcp.json for every project:

{
  "mcpServers": {
    "sniffpup": {
      "url": "https://sniffpup.com/api/mcp",
      "headers": { "Authorization": "Bearer ${env:SNIFFPUP_TOKEN}" }
    }
  }
}

Other tools

Any tool that supports remote MCP servers over HTTP works. Use the address https://sniffpup.com/api/mcp and send the header Authorization: Bearer followed by your token.

What to ask

• “Scan my-app.com with SniffPup and fix anything high or critical.”
• “What did SniffPup find on my site last time? Start with the worst issue.”
• “I just deployed. Run SniffPup again and tell me if the score went up.”

What it can do

• List my sites (list_sites): your sites, whether each is verified, and the latest score.
• Scan a site (scan_site): runs a new scan (up to about a minute) and returns the score, pass or fail against a pass mark (default 70), and each issue with fix steps and a prompt.
• Get latest results (get_latest_results): reads your most recent scan without running a new one.

Limits and privacy

• Scans from your AI tool count toward your plan's daily scans and per-site pacing, and share the Scan API's 30 scans an hour per token.
• It's the same passive scan as the dashboard: it reads what your live site shows any visitor and never logs in or changes anything.
• Your AI tool sees the issue titles, summaries, masked evidence and fix steps. Leaked keys are always masked, never shown in full.