Opviva MCP

Connect an AI agent to Opviva over the Model Context Protocol and it can scan, check fix status, and — with a full-scope key — open fixes and monitors, without you leaving the chat. Two ways in: the published stdio bridge (npx @opviva/mcp) for a coding agent with a local working tree, or the remote endpoint for anything that speaks MCP directly.

Get an API key

Dashboard → API keys (opviva.com/app/api-keys) → Create key → pick a scope. Read only covers every read tool below — no spend, no writes. Scan only adds scan_repo and scan_files, which spend credits. Full access also unlocks the tools that write (open/approve a fix, add a monitor). The key is shown once, as vops_sk_....

Claude Code

Add the server

claude mcp add opviva -e OPVIVA_API_KEY=vops_sk_... -- npx -y @opviva/mcp

Adds two local-only tools on top of the remote catalog: scan_files (walks the current working directory) and apply_fix (writes an approved fix to disk, dry-run unless you pass confirm:true). OPVIVA_MCP_CWD overrides which directory those two operate on — it defaults to the current working directory.

Codex

In ~/.codex/config.toml (or a project-scoped one):

config.toml

[mcp_servers.opviva]
command = "npx"
args = ["-y", "@opviva/mcp"]

[mcp_servers.opviva.env]
OPVIVA_API_KEY = "vops_sk_..."

VS Code

In .vscode/mcp.json:

mcp.json

{
  "servers": {
    "opviva": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@opviva/mcp"],
      "env": { "OPVIVA_API_KEY": "vops_sk_..." }
    }
  }
}

ChatGPT & Claude.ai (remote connector)

Both talk to the remote endpoint directly, so neither can read your local working tree — scan_files and apply_fix aren't reachable this way. Use scan_repo (a connected GitHub repo) or scan_url (a live app URL) instead.

MCP server URL

https://api.opviva.com/mcp

ChatGPT: Settings → Apps & Connectors → Advanced settings → turn on Developer mode → Connectors → Create → Authentication: API key → paste your key.

Claude.ai: Settings → Connectors → Add custom connector → Opviva's endpoint authenticates with a Bearer key, not OAuth — use the static-header option and set Authorization: Bearer vops_sk_....

Tools

11 tools, gated by scope: Read only < Scan only < Full access. Any key scope can call a Read tool; a Scan tool (billable) needs Scan only or Full access; a Full tool needs Full access.

Tool	Scope	Notes
scan_url	none	Free passive scan of a live app URL.
scan_repo	Scan	Deep code scan of a connected GitHub repo. Spends credits.
scan_files	Scan	Remote: scan file contents you paste in. Local bridge: scans your working tree instead, no args. Spends credits.
list_findings	Read	Every finding across every scanned repo, with fix state.
get_fix	Read	One fix's status by its fix/incident id.
fixes_timeline	Read	Recent fixes and their lifecycle state.
list_monitors	Read	Everything currently watching the account.
create_fix	Full	Opens a real pull request for one finding.
approve_fix	Full	Merges a prepared fix's pull request.
premerge_check	Full	Read-only safety verdict before approving a fix.
add_monitor	Full	Starts 24/7 uptime monitoring on a URL.
apply_fix	Local bridge only	Writes an approved fix to disk. Dry-run unless confirm:true.

Want the risk-and-mitigation picture for MCP servers generally — tool poisoning, over-broad scopes, exposed secrets — rather than just this setup guide? See MCP server security.