SecureCode, in your workflow.
Connect SecureCode to your editor or AI agent and start verifying the code your AI writes.
How to use SecureCode
SecureCode runs as an MCP server. Install it once, log in, and add it to your AI agent. Your agent can then scan, verify, and propose fixes for the code it writes.
You need an account first. Signing up is free and gives you 20 scan credits to try it out.
MCP is how AI agents use outside tools. Connect SecureCode once, and your agent can scan your code, explain what's broken, and write the fix itself, while you stay in control of what actually gets changed. You don't need to know any security to use this.
01. Install the MCP server
Install once and use it with any MCP client:
npm install -g @securecode-ai/mcp
Log in to connect your SecureCode account:
securecode-mcp login
Enter the email you signed up with, then choose how to log in: we email you a code, or you type your password (run securecode-mcp login --password to skip the question). No password yet? Set one on the login page with "Forgot password?". Your token is saved in your OS keychain, or in ~/.securecode/credentials.json (readable only by you) when no keychain is available.
02. Add the config to your agent
Cursor
Paste it into .cursor/mcp.json in your project, or ~/.cursor/mcp.json to turn it on everywhere.
1{2 "mcpServers": {3 "securecode": {4 "command": "securecode-mcp",5 "args": ["serve", "--workspace", "/path/to/your/project"]6 }7 }8}
03. Restart your agent and scan
It only reads the config on startup. After restarting, the SecureCode tools show up in its tool list. Try:
Use SecureCode to scan this file and explain what's wrong in plain English.
04. Prompts you can paste
Once it's connected, you talk to it normally. These work as-is:
Use SecureCode to scan this file and explain what's wrong in plain English.
Use SecureCode's agent scan on this file and tell me which findings are proven.
Use SecureCode to fix everything it found, then show me the diff before changing anything.
Survey my project with SecureCode's architecture tool and scan the three most important files.
What your agent can do
securecode.scan. Reads one file and lists what is wrong, how bad it is, and exactly where. A second AI model checks every finding before you see it.
Scans only read your code. Anything that changes your code or runs it asks you first.
Approvals open in your browser. When your agent wants to apply a fix, run your tests, or probe your local dev server, a page opens at 127.0.0.1 asking you to approve. Most agents also ask you before they call any tool.
- securecode.fix asks you first.
- Running tests or probing your dev server asks you first.
- Nothing in your code changes without your click.
If something isn't working
Restart the agent. It only reads the config on startup. If they're still missing, make sure securecode-mcp is installed (npm ls -g @securecode-ai/mcp) and that the command in your config is exactly securecode-mcp.