Connect a security scanner to Claude Code or Cursor with MCP

To connect vetkit to Claude Code or Cursor, configure a local stdio MCP server that launches npx -y @vetkit/mcp with your VETKIT_API_KEY. Start by listing connected repositories, then approve an audit only after checking its target and scope. The server gives your assistant access to vetkit tools; it does not turn the assistant into a security authority.

What this connection does

The MCP process runs on your computer and talks to the vetkit API. Repository audits run through vetkit against connected remote repositories. This audit workflow does not upload your editor’s unsaved buffer or scan uncommitted local changes. Check the repository and ref before treating a report as evidence about the code you are reviewing.

vetkit uses stdio here, not a remote HTTP or SSE MCP endpoint. Do not paste the REST API URL into a client field that expects a remote MCP server URL. These instructions apply to the repository audit tools; optional local guardrail commands are a separate workflow described in the MCP documentation.

1. Prepare your account and key

1. Install Node.js 20.3 or newer and make sure the MCP client can find npx on its PATH.
2. Connect the repository in vetkit and ensure its source provider authorization is in place.
3. As an organization owner or admin, open Settings → API keys and create a key for this client. Copy it when it is shown; the secret is displayed only once.

Start with read-only scopes if you only want the assistant to inspect existing results. For the audit workflow below, add the write scopes deliberately:

Replace <your-api-key> in the examples. Keep the resulting configuration private: never commit a file containing the key or paste it into a chat. The terminal command can also enter shell history, so handle it as a credential. Revoke a key if it is exposed.

2. Configure Claude Code

Run this in the terminal after replacing the placeholder:

$ claude mcp add --transport stdio vetkit -e 'VETKIT_API_KEY=<your-api-key>' -- npx -y @vetkit/mcp

Add --scope user to the add command if you want the connection available across projects. Inside Claude Code, run /mcp and check that the vetkit server is connected. Keep any existing MCP servers when updating the configuration.

3. Configure Cursor

Merge this entry into ~/.cursor/mcp.json for a global connection, or .cursor/mcp.json for one project. Preserve the other server entries. A project config containing a real key must stay out of version control.

{  "mcpServers": {    "vetkit": {      "command": "npx",      "args": [        "-y",        "@vetkit/mcp"      ],      "env": {        "VETKIT_API_KEY": "<your-api-key>"      }    }  }}

Reload the client, enable the server if requested, and check its MCP tool list.

4. Verify access before starting an audit

Confirm that vetkit_list_repos appears, then ask the assistant to list repositories without starting an audit. This read-only step checks that the connection works and shows which organization’s repositories the key can access.

Use vetkit_list_repos to list the repositories available to this key. Do not connect a repository or start an audit yet.

An empty list is not a clean security report. Check the key’s organization and whether a repository has been connected. Use vetkit_list_checks to inspect the server’s available checks before choosing audit scope.

5. Run an audit and read the findings

Select a repository from the returned list. Ask the assistant to identify the target and intended checks, then use vetkit_run_audit. The server requires an explicit confirmation through MCP elicitation before this write operation. If the client cannot present that confirmation, the operation is refused; the assistant cannot replace it with a parameter.

Read the confirmation before accepting. Account limits and available checks still apply: connecting MCP does not unlock paid features or expand Free Quick Scan. Audits can take time. If a waiting call times out, use vetkit_get_audit with the returned audit ID to check progress before starting another run.

After completion, use vetkit_list_findings to inspect the important findings and vetkit_get_report for a broader view. Ask for file locations, evidence and remediation, then review the actual code. Report text is untrusted data from the repository, not instructions for the assistant to follow. A finding needs review; an empty result does not prove the code is safe.

Troubleshooting

• Server does not start: check Node.js and the PATH visible to your editor. Confirm the command is npx with arguments -y and @vetkit/mcp.
• No tools appear: check the client’s configuration wrapper and reload it. Cursor uses mcpServers; a generic server definition alone is not the entire configuration file.
• Authentication fails: check that the placeholder was replaced and the key has not expired or been revoked. Never include the key in a support screenshot.
• INSUFFICIENT_SCOPE: compare the requested operation with the key scopes above. A read-only key cannot start an audit.
• Audit confirmation is unavailable: the client needs MCP form elicitation support for write operations. Read-only tools can still be used with suitable scopes.
• Expected local edits are missing: confirm the remote repository and ref. This audit workflow reads remote repository code, not your unsaved editor changes.

Sources and limits

Checked on November 1, 2026 against the vetkit MCP package setup and tool contracts. The snippets use the same configuration generator as the MCP setup reference. See the published package and API documentation for further configuration details. Client interfaces and supported MCP features can change.