Skip to content
Model Context Protocol

The security agent inside your AI tool.

Add Opviva to Claude, Cursor, or Codex over MCP. Ask it to scan the app you just shipped — it grades the risk, proves the exploit, opens the fix as a pull request you approve, then keeps watching. All without leaving the chat.

Connect itGet an API key →
agent · via MCP
scan_url("https://myapp.example.com")
Grade C · 3 issues found
create_fix("RLS disabled on orders")
Opened PR #42
premerge_check(pr: 42)
Safe to merge · evidence sealed
What it does

Four jobs, one connector.

Every Opviva tool your agent can call, grouped by what it's for.

Scan

Grade a live URL free, or run a deep code scan on a connected repo or the files you're working on.

scan_urlscan_reposcan_files

Check

Catch a known-vulnerable dependency before it ships, straight from your package manifest.

check

Fix

Open a fix as a pull request, get a premerge safety verdict, then approve the merge — you stay in control.

create_fixpremerge_checkapprove_fix

Watch

Keep the app monitored after launch, and pull up findings or the fix timeline anytime.

add_monitorlist_monitorslist_findingsfixes_timelineget_fix
How to connect

Two ways in.

Pick the one that matches where your agent lives. Either way it takes about a minute.

claude.ai & ChatGPT — remote

Settings → Connectors → Add custom connector, paste the URL, click Connect, and sign in with your Opviva account.

https://api.opviva.com/mcp

Claude Code, Cursor, Codex, VS Code — local

Run the @opviva/mcp bridge with your API key. It can also scan your local working tree and apply an approved fix to disk.

claude mcp add opviva \
  -e OPVIVA_API_KEY=vops_sk_... \
  -- npx -y @opviva/mcp
After you connect

Just talk to your agent.

You never call tools by name — Opviva reads plain language and picks the right one. A good first run goes:

Step 01

Scan it

Ask your agent to scan the live URL or the repo you just shipped.

Step 02

Review

Read the findings back, ordered by severity, and pick what matters.

Step 03

Fix & verify

Have it open a pull request, then run a premerge safety check.

Step 04

Approve & watch

Approve the merge, then keep the app monitored 24/7.

Prompts to try

Copy, paste, ship.

Nine things to say once Opviva is connected — plain English, the agent does the rest.

Scan
Scan https://myapp.example.com and tell me the security grade and the top issues.
Do a deep code scan of my repo acme/storefront and summarize the criticals.
Scan the files I just changed for security issues before I commit.
Check
Check my package.json and lockfile for known-vulnerable dependencies before I ship.
Fix
Open a fix pull request for the top finding in acme/storefront.
Run a premerge safety check on that fix, then tell me if it's safe to merge.
Approve and merge the fix once it's verified safe.
Watch
Add https://myapp.example.com to uptime monitoring and list everything you're watching.
Show my open findings by severity, then the fix timeline.
FAQ

Questions about the MCP.

How do I add a security scanner to Claude, Cursor, or VS Code?
Add Opviva's MCP server. On claude.ai: Settings → Connectors → Add custom connector, paste https://api.opviva.com/mcp, click Connect and sign in with your Opviva account. In Claude Code, Cursor, Codex, or VS Code, run the @opviva/mcp bridge with an API key. Your agent then gets tools to scan the app it just built and open fix pull requests — without leaving the chat.
Do I need an Opviva account or API key?
Yes — the connector requires sign-in. On claude.ai you click Connect and sign in with your Opviva account over OAuth; there's nothing to paste. In Claude Code, Cursor, Codex, or VS Code you use a vops_sk_ key from opviva.com → Settings → API keys. A passive live-URL scan runs free; deep code scans and fixes draw on your plan's credits.
Can the agent open a fix pull request through MCP?
Yes. With a full-scope key, create_fix opens a real pull request for a finding, premerge_check returns a safety verdict, and approve_fix merges it. The agent proposes; you approve. The local bridge can also apply an approved fix straight to your working tree.
Is it safe to connect Opviva to my AI agent?
Yes. Scans are read-only by default, keys are scoped — read, then scan, then full — and only full-access keys can write. Opviva never sees your source beyond what a scan reads, every finding is evidence-backed, and you can revoke any connected agent anytime from Settings → Connected apps.
Which AI tools and hosts does Opviva's MCP support?
claude.ai and ChatGPT connect to the remote endpoint; Claude Code, Cursor, Codex, and VS Code use the local @opviva/mcp bridge, which additionally scans your local working tree and can apply an approved fix to disk.
What does it cost to connect?
Connecting is free, and a passive live-URL scan runs at no cost. Deep code scans, dependency checks, and fixes use your Opviva plan's credits at the same rates as in-app — see the pricing page for details.

Add Opviva to your agent

Connect in a minute — sign in on claude.ai, or drop a key into Claude Code, Cursor, or VS Code — and open fixes as pull requests you approve.

Read the install guideGet an API key →
Opviva MCP — the security agent inside your AI coding tool · Opviva