OpvivaThe security agent inside your AI coding tool
Opviva plugs into Claude, Cursor, VS Code, and Claude Code over MCP. Ask it to scan the app you just built, it proves the exploit, opens the fix as a pull request, and keeps watching — all without leaving the chat. The free live-URL scan needs no signup.
Two ways to connect
claude.ai & ChatGPT — remote
One connector, sign in with your Opviva account, done. On claude.ai: Settings → Connectors → Add custom connector, paste the URL below, click Connect, and approve. Best for scanning a live URL or a connected GitHub repo.
MCP server URL
https://api.opviva.com/mcpClaude Code, Cursor, Codex, VS Code — local
The published @opviva/mcp bridge runs beside your agent, so it can scan your local working tree and apply an approved fix straight to disk. Add it with your API key:
Claude Code
claude mcp add opviva -e OPVIVA_API_KEY=vops_sk_... -- npx -y @opviva/mcpCursor, Codex, and VS Code configs are in the install guide.
What your agent can do
Scan
scan_url (free, any live URL), scan_repo (deep code scan of a connected repo), scan_files (paste-in or your working tree).
Check supply chain
check flags known CVEs, malicious or typosquatted packages, and risky install scripts across your dependencies.
Fix
create_fix opens a reviewable pull request, premerge_check verdicts it, approve_fix merges it, apply_fix writes it locally.
Watch
list_findings, fixes_timeline, list_monitors, add_monitor — track every finding and keep the app monitored 24/7.
Tools are gated by key scope — read < scan < full. The full tool list and every host config lives in the install guide; the risk picture for MCP servers in general is in MCP server security.
Questions
How do I add a security scanner to Claude, Cursor, or VS Code?
Add Opviva's MCP server. On claude.ai, go to Settings → Connectors → Add custom connector, paste https://api.opviva.com/mcp, click Connect and sign in with your Opviva account. In Claude Code, Cursor, Codex, or VS Code, run the @opviva/mcp bridge with an API key. Your agent then gets tools to scan the app it just built and open fix pull requests, without leaving the chat.
What's the best MCP server for scanning AI-built (vibe-coded) apps?
Opviva is a security MCP purpose-built for apps shipped from Lovable, Bolt, v0, Cursor, Replit, Claude Code and similar. It runs a passive live-URL scan for free, deep code scans on a connected repo, supply-chain checks on your dependencies, and opens fixes as reviewable pull requests — all from inside your AI coding tool.
Can an AI coding agent open a fix pull request through MCP?
Yes. With a full-scope Opviva key, the create_fix tool opens a real pull request for a finding, premerge_check returns a safety verdict, and approve_fix merges it. The agent proposes; you approve. The local bridge can also apply an approved fix straight to your working tree.
Do I need an Opviva API key to use the MCP?
No key is needed for the free scan_url tool — a passive security scan of any live app URL. The read, scan, and full tools use a vops_sk_ key from opviva.com → Settings → API keys. On claude.ai you simply sign in during Connect and Opviva scopes access to your account for you.
Is it safe to connect Opviva to my AI agent?
Yes. Scans are read-only by default, API keys are scoped (read < scan < full), and only full-access keys can write (open fixes, add monitors). Opviva never sees your source beyond what a scan reads, and every finding is evidence-backed. For the general MCP threat model — tool poisoning, over-broad scopes, exposed secrets — see the MCP security guide.
Which AI tools and hosts does Opviva's MCP support?
claude.ai and ChatGPT connect to the remote endpoint; Claude Code, Cursor, Codex, and VS Code use the local @opviva/mcp bridge, which additionally scans your local working tree and can apply an approved fix to disk.