Scan from your AI coding tool

You built the app in Claude Code, Cursor or Windsurf. You can check it there too. Install the ArgosX MCP server once, then just ask: “scan my app for security problems”. Findings come back in the chat, each with a fix you can hand straight to the agent that wrote the code.

1Add ArgosX to your MCP config

Paste this into your tool’s MCP settings file. Set ARGOSX_CAMPAIGN to whichever tool you’re in, so we can tell which ones people actually use.

{
  "mcpServers": {
    "argosx": {
      "command": "npx",
      "args": ["-y", "argosx-mcp"],
      "env": { "ARGOSX_CAMPAIGN": "claude-code" }
    }
  }
}

Claude Code reads ~/.claude.json or a project .mcp.json. Cursor uses ~/.cursor/mcp.json. Windsurf uses ~/.codeium/windsurf/mcp_config.json. Restart the tool afterwards so it picks the server up.

2Ask for a scan

Your agent now has three tools. In practice you never name them, you just describe what you want:

start_audit, kicks off a scan of a deployed URL and returns immediately
get_audit_result, the score, a red/amber/green verdict, and the findings that matter
get_finding_poc, the evidence for one finding, plus a fix prompt written to be acted on

A deep scan takes less than two minutes, so the agent starts it, does something else, and comes back for the result.

3Fix, then scan again

The point of the fix prompt is that it goes back to the tool that built the app. Re-run the scan afterwards and the finding should be gone. If it isn’t, that is worth knowing before a user finds out.

Honest limits

It scans what is deployed, not what is on your laptop. The scanner runs in our cloud, so localhost and private addresses are unreachable. Ship a preview URL first.

Signed-out only. Scans started this way test the public surface. Testing behind a login needs credentials you provide deliberately in the web app, which is not something we want an agent doing on your behalf without you watching.

Free scans are rate limited. If you hit the limit the tool says so plainly rather than returning an empty result that looks like a clean bill of health.

Prefer the browser? Run a scan here instead, or read the FAQ.