MCP server
Scan your app without leaving Claude
Add Prbl to Claude, Claude Code or Cursor. Ask it to scan a repo or a live URL and it comes back with the findings and fixes, in the same chat where the code was written. Free, no account needed.
https://getprbl.com/api/mcp
Add it
Claude (claude.ai and desktop)
Open Settings, go to Connectors, choose to add a custom connector, name it Prbl and paste the server URL above.
Claude Code
claude mcp add --transport http prbl https://getprbl.com/api/mcpCursor
Add this to your mcp.json:
{ "mcpServers": { "prbl": { "url": "https://getprbl.com/api/mcp" } } }With your own API key (optional)
Create a free account, copy your key from the dashboard, and send it as a Bearer token. Claude Code example:
claude mcp add --transport http prbl https://getprbl.com/api/mcp --header "Authorization: Bearer YOUR_KEY"Try it
- “Scan https://myapp.vercel.app with Prbl and fix what it finds.”
- “Run Prbl on github.com/me/my-lovable-app and list anything high severity.”
- “Before I ship, scan my live site for exposed keys and open Supabase tables.”
Tools
Scans a public repo for hardcoded secrets, missing auth, injection and the other patterns AI tools leave behind. Returns file, line and fix.
Passively checks a deployed app for keys in the JavaScript, dashboards open without login, exposed .env files and readable Supabase tables.
Frequently asked questions
What is the Prbl MCP server?
A remote Model Context Protocol server that lets an AI assistant run Prbl scans for you. Add it once and you can ask Claude, Claude Code or Cursor to scan a public GitHub repository or a deployed app, and it returns the findings with the file, line and a suggested fix, ready to apply.
Does it cost anything or need an account?
No. Scans work with no account. Anonymous use shares a free hourly capacity across all users. For your own limits, create a free Prbl account, copy your API key and add it to the connector as a Bearer token; free accounts get a separate allowance for public repositories.
Is it safe to point at my app?
Yes. Both tools are read-only. The URL scan makes only the requests a normal browser already makes and stores nothing the site returns. The repo scan reads public code and never writes to it. Prbl never receives your assistant's conversation, only the repo name or URL you ask it to scan.
What does it check?
Repositories: hardcoded credentials, missing authorization checks, injection, fallback secrets and broken object-level authorization in Python, JavaScript and TypeScript. Live URLs: keys in the JavaScript, dashboards that render without login, exposed .env and .git files, weak security headers and Supabase tables readable with the public key.
Related: free web scan · the research behind the rules · pricing