SecureCode, in your workflow.
Connect SecureCode to your editor or AI agent and start verifying the code your AI writes.
How to use SecureCode
Pick the tab that matches how you work. Use the editor extension for in-editor scanning, or connect via MCP to hand SecureCode to your AI agent. Same account, same credits.
You need an account first. Signing up is free and gives you 3 scans to try it out.
MCP is how AI agents use outside tools. Connect SecureCode once, and your agent can scan your code, explain what's broken, and write the fix itself, while you stay in control of what actually gets changed. You don't need to know any security to use this.
01. Install the standalone MCP server
No VS Code extension needed. Install once and use it with any MCP client:
npm install -g @securecode-ai/mcp
Log in to connect your SecureCode account:
securecode-mcp login
Enter the email you signed up with. We send you a code. Paste it back in. Your token is stored in your OS keychain (never in a file).
02. Add the config to your agent
Cursor
Paste it into .cursor/mcp.json in your project, or ~/.cursor/mcp.json to turn it on everywhere.
1{2 "mcpServers": {3 "securecode": {4 "command": "securecode-mcp",5 "args": ["serve", "--workspace", "/path/to/your/project"]6 }7 }8}
03. Restart your agent and scan
It only reads the config on startup. After restarting, four SecureCode tools show up in its tool list. Try:
Use SecureCode to scan this file and explain what's wrong in plain English.
04. Prompts you can paste
Once it's connected, you talk to it normally. These work as-is:
Use SecureCode to scan this file and explain what's wrong in plain English.
Use SecureCode to fix everything it found, then show me the diff before changing anything.
Scan my whole project with SecureCode and give me the three things worth fixing first.
Run SecureCode's attack tool on the fix to prove it actually works.
Use SecureCode to attack the /api/auth/login endpoint and tell me if it's really exploitable.
What your agent can do
securecode.scan. Reads your code and lists what is wrong, how bad it is, and exactly where.
The agent can request an action. You approve it. Then it executes.
Approvals open in your browser. When your agent wants to change code or run an attack, a page opens at 127.0.0.1 asking you to approve. Nothing changes without your click.
- securecode.fix asks you first.
- securecode.attack asks you first.
- Nothing changes without your click.
If something isn't working
Restart the agent. It only reads the config on startup. If they're still missing, check the config file: for the standalone MCP, make sure securecode-mcp is installed (npm ls -g @securecode-ai/mcp). For the extension MCP, check the file path in args actually exists.