Guides · Updated October 28, 2026
Use SniffPup inside Bolt: add a free security scan to Bolt as a custom MCP connector
Short answer: add SniffPup, the free passive security scanner for vibe-coded apps, to Bolt as a custom MCP server. Open Connectors, then Manage connectors, click Custom MCP server, paste https://sniffpup.com/api/mcp, pick Transport type HTTP and Authentication None. Turn it on in your project and ask Bolt to scan the live site you own. It reads what SniffPup finds and fixes your code.
1. Copy these settings
These are the only values you need for the free scan. Each one has a copy button.
SniffPuphttps://sniffpup.com/api/mcpHTTPSniffPup uses Streamable HTTP. Don't pick SSE.
NoneThe free scan needs no sign-in. Pick API key only if you're adding a SniffPup API token.
2. Add SniffPup as a custom connector
- On the Bolt homepage, click the plus icon in the chatbox.
- Click Connectors, then Manage connectors. This opens the Connectors (MCP) page in your account settings.
- Click Custom MCP server.
- Enter SniffPup as the Name and paste
https://sniffpup.com/api/mcpas the URL. - Set Transport type to HTTP and Authentication to None.
- Click Connect. Bolt shows Connected in the upper-right corner when it reaches SniffPup.
- Optional: tick Auto-enable for all projects (Bolt may label it Automatically enable for new projects), or leave it off and turn SniffPup on per project (next step).
These steps follow Bolt's MCP help page; Bolt may move a button now and then, so check their page if something looks different.
3. Turn it on in your project and ask for a scan
Open your project, click the plus icon in the chatbox, click Connectors and turn on the toggle next to SniffPup. Publish your app first: SniffPup scans the live site, not the editor preview. Then paste a prompt like this:
Don't skip the toggle. If SniffPup isn't turned on for the project, Bolt's chat will say it has no access to the tool, even though the connector shows Connected in your settings.
I own my-app.com. Use the SniffPup connector to run a free scan of it, then fix any critical issue it finds.
Bolt asks in the chat whether you own the site and agree to SniffPup's terms. Reply yes, and it calls SniffPup, then shows the score and the issues. After it fixes them and you publish again:
I just published my changes. Scan my-app.com with SniffPup again and tell me if the score went up.
4. What the free tool does, and what a token adds
Free, no sign-in: with no token, SniffPup gives your AI one tool, Free scan of a site (scan_site). It runs the same passive scan as the box on our home page and returns the 0–100 score and every issue found by title and severity. Every critical issue comes with masked evidence, fix steps and a fix prompt your AI can follow. With no critical issue, one other issue comes with its fix. It has the same limits as a free scan from the website (per network and per site).
With a token (Solo, Starter, Pro or Ultimate): the same address also gives your AI List my sites (list_sites), Scan a site with full results for your verified sites, and Get latest results (get_latest_results). To use them in Bolt, edit the connector, set Authentication to API key and paste your SniffPup API token from Account › API tokens on the website. Your site also needs to be added and verified in your SniffPup dashboard. The token is shown once and we store only a hash; revoke it any time and the connector stops working right away. See the MCP setup page for the details.
5. The ownership rule
Only scan sites you own or are authorized to test. The SniffPup tool asks your AI to confirm that with you before every scan and to pass consent: true. That means you agree to the same Terms, Acceptable Use Policy and Privacy Policy as the scan box on the website. If your AI asks you to confirm, answer honestly.
The scan is passive: it only reads what any visitor's browser can see on the live site. It never signs in, never sends attack payloads and never uses a secret key it finds. Leaked keys are always masked, so never paste a full key into the chat.
Good to know
- Bolt finds new tools on its own when a server adds them. To check, open the connector's three-dots menu, click Edit, then Refresh connection.
- SniffPup and Bolt's own checks work well together: Bolt's audit looks inside your project, and SniffPup looks at what your live URL shows a stranger. Our Bolt security audit guide walks through both.
- We tested these steps in Bolt on October 28, 2026 by scanning sniffpup.com, which scored 100/100.
- Facts in this guide were checked on October 28, 2026 against Bolt's own help center.
Use another builder too? Use SniffPup inside Lovable or Use SniffPup inside Cursor. Claude Code and other tools: see the MCP setup page.
FAQ
Which transport type and authentication should I pick in Bolt?
Transport type HTTP (SniffPup is a Streamable HTTP server; it doesn't use SSE) and Authentication None for the free scan. If you have a Solo, Starter, Pro or Ultimate plan and want the full toolset, pick API key and paste your SniffPup API token instead.
Do I need to turn the connector on in every Bolt project?
Only if you leave Auto-enable for all projects unticked. Bolt's docs suggest turning a connector on only in projects that need it, because every connector adds to the context Bolt works with. Turn SniffPup on when you're ready to check your live site and off again when you're done.
Can I limit what SniffPup can do in Bolt?
Yes. Bolt turns on all of a connector's tools by default and lets you turn tools off under the connector's Edit menu. Without a token SniffPup has just one tool, the free scan, so there is nothing else to switch off.
What does SniffPup check that Bolt's own security audit doesn't?
They look at different things, so run both. Bolt's database check and project security audit review your project from the inside. SniffPup looks at your published site from the outside, like any visitor: secret keys in HTML and JavaScript, public .env and .git files, source maps, security headers, cookies, HTTPS, and whether an anonymous visitor can read rows using the public Supabase key the site already ships.
Can I scan any site from Bolt?
No. Only scan sites you own or are authorized to test. The SniffPup tool asks Bolt to confirm that with you before every scan, and the same Terms and Acceptable Use Policy apply as on the website.
Does a score of 100 mean my Bolt app is secure?
No. A score of 100 means no issues were found in our checks. It is never proof of security, and it says nothing about your server code, your database policies or what signed-in users can reach.
A clean report is not a guarantee of security. Only scan sites you own or are authorized to test.