Scan free

Guides · Updated October 28, 2026

Use SniffPup inside Lovable: add a free security scan to your Lovable chat (custom MCP connector)

Short answer: add SniffPup, the free passive security scanner for vibe-coded apps, to Lovable as a custom MCP server. Open Connectors, choose Add custom, then MCP server, paste https://sniffpup.com/api/mcp and pick No authentication. Then ask Lovable to scan the live site you own. It reads what SniffPup finds and fixes your code in the same chat.

1. Copy these settings

These are the only values you need for the free scan. Each one has a copy button.

Server nameSniffPup
Server URLhttps://sniffpup.com/api/mcp
AuthenticationNo authentication

Lovable picks OAuth by default. Change it to No authentication: SniffPup doesn't offer an OAuth sign-in.

ConnectionDirect connection

Only shown when your workspace has more than one option. Keep Direct connection.

2. Add SniffPup as a custom MCP server

  1. In Lovable, open Connectors, select Add custom in the top right of the catalog, and choose MCP server.
  2. Enter SniffPup as the Server name.
  3. If you see a Connection dropdown, keep Direct connection.
  4. Paste https://sniffpup.com/api/mcp as the Server URL.
  5. Under authentication, choose No authentication.
  6. Click Add server. SniffPup now shows in your list of chat connectors.

If MCP server is greyed out, a workspace admin has turned off custom MCP servers for your workspace. These steps follow Lovable's custom MCP guide; Lovable may move a button now and then, so check their page if something looks different.

3. Ask Lovable to scan your live site

Publish your app first: SniffPup scans the live site, not the editor preview. Then paste a prompt like this into the Lovable chat:

I own my-app.com. Use the SniffPup connector to run a free scan of it, then fix any critical issue it finds.

Lovable first shows a prompt asking you to confirm you own the site and agree to SniffPup's terms, then an Allow prompt to run the SniffPup tool. Confirm and allow, and it shows the score and the issues. We tested this in Lovable on October 28, 2026 by scanning sniffpup.com, which scored 100/100. Ask it to fix the critical ones, publish again, and check the result:

I just published my changes. Scan my-app.com with SniffPup again and tell me if the score went up.

4. What the free tool does, and what a token adds

Free, no sign-in: with no token, SniffPup gives your AI one tool, Free scan of a site (scan_site). It runs the same passive scan as the box on our home page and returns the 0–100 score and every issue found by title and severity. Every critical issue comes with masked evidence, fix steps and a fix prompt your AI can follow. With no critical issue, one other issue comes with its fix. It has the same limits as a free scan from the website (per network and per site).

With a token (Solo, Starter, Pro or Ultimate): the same address also gives your AI List my sites (list_sites), Scan a site with full results for your verified sites, and Get latest results (get_latest_results). To use them in Lovable, pick Bearer token or API key instead of No authentication, and paste your SniffPup API token from Account › API tokens on the website. Your site also needs to be added and verified in your SniffPup dashboard. The token is shown once and we store only a hash; revoke it any time and the connector stops working right away. See the MCP setup page for the details.

5. The ownership rule

Only scan sites you own or are authorized to test. The SniffPup tool asks your AI to confirm that with you before every scan and to pass consent: true. That means you agree to the same Terms, Acceptable Use Policy and Privacy Policy as the scan box on the website. If your AI asks you to confirm, answer honestly.

The scan is passive: it only reads what any visitor's browser can see on the live site. It never signs in, never sends attack payloads and never uses a secret key it finds. Leaked keys are always masked, so never paste a full key into the chat.

Good to know

Use another builder too? Use SniffPup inside Bolt or Use SniffPup inside Cursor. Claude Code and other tools: see the MCP setup page.

FAQ

Does the SniffPup connector work on Lovable's free plan?

Lovable's docs say custom MCP servers are available on all plans, and SniffPup's scan_site tool is free with no sign-in. A workspace admin can turn custom MCP servers off; if MCP server is greyed out in the Add custom menu, that's why.

Which authentication should I pick in Lovable?

No authentication for the free scan. Lovable picks OAuth by default, and SniffPup doesn't offer an OAuth sign-in, so change it before you click Add server. If you have a Solo, Starter, Pro or Ultimate plan and want the full toolset, pick Bearer token or API key and paste your SniffPup API token instead.

Does SniffPup become part of my published Lovable app?

No. Lovable's docs say chat connections, custom MCP servers included, are personal to you and are never part of your published app. SniffPup only helps while you build: Lovable calls it from the chat, reads the results and fixes your code.

What does SniffPup check that Lovable's own security scans don't?

They look at different things, so run both. Lovable's Quick and Deep scans review your project and database rules from the inside. SniffPup looks at your published site from the outside, like any visitor: secret keys in HTML and JavaScript, public .env and .git files, source maps, security headers, cookies, HTTPS, and whether an anonymous visitor can read rows using the public Supabase key the site already ships.

Can I scan any site from Lovable?

No. Only scan sites you own or are authorized to test. The SniffPup tool asks Lovable to confirm that with you before every scan, and the same Terms and Acceptable Use Policy apply as on the website.

Does a score of 100 mean my Lovable app is secure?

No. A score of 100 means no issues were found in our checks. It is never proof of security, and it says nothing about your server code, your database policies or what signed-in users can reach.

A clean report is not a guarantee of security. Only scan sites you own or are authorized to test.