Add Flowpatrol to Claude Code, Cursor, or Windsurf. One config line. Your AI assistant can scan your app for real vulnerabilities while you build.
{
"mcpServers": {
"flowpatrol": {
"type": "url",
"url": "https://api.flowpatrol.ai/mcp",
"headers": {
"Authorization": "Bearer fp_live_your_api_key"
}
}
}
}Replace fp_live_your_api_key with your key from the dashboard.
flowpatrol_probeQuick security check. Scans JavaScript bundles for leaked secrets, audits HTTP headers, checks for exposed paths, and tests Supabase RLS — all without leaving your editor.
flowpatrol_scanFull DAST scan. An AI agent explores your running app like a real attacker — crawling routes, testing auth flows, probing APIs, and chaining findings together.
flowpatrol_reportPull results from any previous scan. Filter by severity, get fix suggestions inline, and share findings with your team — all from the chat.
Every other MCP security tool needs access to your source code. Flowpatrol tests the real, running application — like an attacker would. Your codebase stays private.
DAST = Dynamic Application Security Testing (tests a live app). SAST = Static Analysis (reads source code).
Get an API key, drop one line of config, and your AI assistant becomes security-aware. Takes under a minute.