Scan free

Guides · Updated October 28, 2026

Use SniffPup inside Cursor: add the free security scan MCP server to mcp.json

Short answer: add SniffPup, the free passive security scanner for vibe-coded apps, to Cursor as a remote MCP server. Click Add to Cursor (or paste the three-line config below into .cursor/mcp.json), make sure SniffPup is turned on under Customize, then ask the Agent to scan the live site you own. It reads what SniffPup finds and fixes your code.

1. Add it in one click, or copy the config

Add to Cursor One click opens Cursor and asks you to install SniffPup: free, no token, no sign-in. Nothing opens? Cursor isn't installed on this device, so copy the config instead.

Or create .cursor/mcp.json in your project (or ~/.cursor/mcp.json for every project) and paste this. If the file already has other servers, add the sniffpup entry inside the existing mcpServers block.

{
  "mcpServers": {
    "sniffpup": { "url": "https://sniffpup.com/api/mcp" }
  }
}

SniffPup is a Streamable HTTP server at https://sniffpup.com/api/mcp. No token, no OAuth sign-in.

2. Turn it on in Cursor

  1. Save the file. Open Customize in the sidebar and find sniffpup in your MCP servers.
  2. Make sure its toggle is on. Disabled servers don't load or appear in chat.
  3. You should see one tool, scan_site, under its available tools.

These steps follow Cursor's MCP docs; Cursor may move a menu now and then, so check their page if something looks different.

3. Ask the Agent to scan your live site

Deploy first: SniffPup scans the live site, not your local dev server. Then ask:

I own my-app.com. Use the SniffPup connector to run a free scan of it, then fix any critical issue it finds.

Cursor asks for approval before it runs an MCP tool. Check the arguments, approve, and the Agent gets the score, the issues and the fixes. After you deploy the fixes:

I just published my changes. Scan my-app.com with SniffPup again and tell me if the score went up.

4. What the free tool does, and what a token adds

Free, no sign-in: with no token, SniffPup gives your AI one tool, Free scan of a site (scan_site). It runs the same passive scan as the box on our home page and returns the 0–100 score and every issue found by title and severity. Every critical issue comes with masked evidence, fix steps and a fix prompt your AI can follow. With no critical issue, one other issue comes with its fix. It has the same limits as a free scan from the website (per network and per site).

With a token (Solo, Starter, Pro or Ultimate): the same address also gives your AI List my sites (list_sites), Scan a site with full results for your verified sites, and Get latest results (get_latest_results). To use them in Cursor, save your SniffPup API token from Account › API tokens on the website in an environment variable named SNIFFPUP_TOKEN and use the config below, so the token never sits in the file. Your site also needs to be added and verified in your SniffPup dashboard. The token is shown once and we store only a hash; revoke it any time and the connector stops working right away. See the MCP setup page for the details.

{
  "mcpServers": {
    "sniffpup": {
      "url": "https://sniffpup.com/api/mcp",
      "headers": { "Authorization": "Bearer ${env:SNIFFPUP_TOKEN}" }
    }
  }
}

5. The ownership rule

Only scan sites you own or are authorized to test. The SniffPup tool asks your AI to confirm that with you before every scan and to pass consent: true. That means you agree to the same Terms, Acceptable Use Policy and Privacy Policy as the scan box on the website. If your AI asks you to confirm, answer honestly.

The scan is passive: it only reads what any visitor's browser can see on the live site. It never signs in, never sends attack payloads and never uses a secret key it finds. Leaked keys are always masked, so never paste a full key into the chat.

Good to know

Use another builder too? Use SniffPup inside Lovable or Use SniffPup inside Bolt. Claude Code and other tools: see the MCP setup page.

FAQ

Where does the mcp.json file go?

Use .cursor/mcp.json in your project folder for that project only, or ~/.cursor/mcp.json in your home folder for every project. Both use the same mcpServers format.

Do I need a token or an OAuth sign-in?

No, not for the free scan. With just the url line, SniffPup gives Cursor one free tool, scan_site. SniffPup doesn't use OAuth, so Cursor won't ask you to sign in. For the full toolset (Solo, Starter, Pro or Ultimate), add an Authorization header that reads your token from an environment variable, as shown above.

Cursor asks before it runs the SniffPup tool. Is that normal?

Yes. Cursor's docs say it asks for approval before using MCP tools by default. Click the arrow next to the tool name to see the arguments: the site address and consent: true, which Cursor should only set after you confirm you own the site.

What if SniffPup doesn't show up in Cursor?

Check that the JSON is valid and the server is turned on under Customize. Then open the Output panel (Cmd+Shift+U on Mac, Ctrl+Shift+U on Windows and Linux) and pick MCP Logs to see connection errors.

Can I scan any site from Cursor?

No. Only scan sites you own or are authorized to test. The SniffPup tool asks the Agent to confirm that with you before every scan, and the same Terms and Acceptable Use Policy apply as on the website.

Does a score of 100 mean my Cursor app is secure?

No. A score of 100 means no issues were found in our checks. It is never proof of security, and it says nothing about your server code, your database policies or what signed-in users can reach.

A clean report is not a guarantee of security. Only scan sites you own or are authorized to test.