Let your coding agent check your live app for leaks

By LeakPatrol · Updated 25 October 2026

LeakPatrol has an MCP server, so Claude Code, Cursor and other AI coding agents can run a security scan on your live site themselves, for example right after a deploy. The agent gets the grade, every problem and the launch checklist back, and can start fixing straight away. It's free, read-only and needs no API key.

Add it in one line

Claude Code

claude mcp add --transport http leakpatrol https://www.getleakpatrol.com/mcp

Cursor

Add this to ~/.cursor/mcp.json (or .cursor/mcp.json in your project):

{
  "mcpServers": {
    "leakpatrol": { "url": "https://www.getleakpatrol.com/mcp" }
  }
}

VS Code, Windsurf and other MCP clients

Add a remote (Streamable HTTP) server with the URL https://www.getleakpatrol.com/mcp. There's no login or key.

Then just ask

"Scan myapp.lovable.app with LeakPatrol and fix anything critical."
"I just deployed. Check the live site for leaked keys before I share it."
"Run the LeakPatrol launch checklist on my site and fix the link preview."

What the agent gets back

One tool, scan_website, which runs the same read-only checks as the scan on our home page:

secret API keys in your JavaScript (OpenAI, Anthropic, Stripe, AWS, Supabase service keys and more), always masked
public .env and .git files and source maps
paid features switched on from the browser, and AI providers called straight from the browser
missing security headers and HTTPS problems
the launch checklist: page title, link preview, sitemap, analytics, your own domain, DMARC

It returns an A–F grade, every issue, one worked fix and the launch checklist, as text and as structured data. The full report with a fix prompt for every issue is linked at the end.

Limits and safety

Read-only: it fetches only what a browser would, plus a short list of files that should never be public. It never logs in, submits forms or changes anything.
5 scans per hour per connection; a site's result is reused for 10 minutes.
Only scan sites you own or have permission to test.

Check your app in a minute

Free, read-only, no sign-up. Every problem comes with a plain-English fix and a prompt for your AI tool.

Get the 10-point checklist

Every check we run on AI-built apps, with how to do each one yourself. Straight to your inbox.

Questions

Does LeakPatrol have an MCP server?

Yes. Add https://www.getleakpatrol.com/mcp as a remote (Streamable HTTP) MCP server in Claude Code, Cursor, VS Code or Windsurf. It offers one read-only tool, scan_website, and needs no API key.

How do I add LeakPatrol to Claude Code?

Run: claude mcp add --transport http leakpatrol https://www.getleakpatrol.com/mcp. Then ask Claude Code to scan your site with LeakPatrol.

Is it safe to let an agent run security scans?

The scan is read-only. It only downloads what any visitor's browser would, plus a short list of files that should never be public, and any key it finds is masked.