SniffPup

npx add-mcp 'https://sniffpup.com/api/mcp'

SniffPup in your AI coding tool

Ask Claude Code, Cursor or another AI coding tool to scan your live site. It reads what SniffPup found, fixes your code and checks again.

Free: scan a site, no sign-in

Add SniffPup with no token and your AI tool gets one tool, Scan a site (scan_site). It runs the same free scan as the website: the score, every issue found, and every critical issue with masked evidence, fix steps and a prompt. With no critical issue, one other issue comes with its fix.

Claude Code

claude mcp add --transport http sniffpup https://sniffpup.com/api/mcp

Cursor

One click opens Cursor and asks you to install SniffPup: free, no token, no sign-in. Nothing opens? Cursor isn't installed on this device, so copy the config instead.

Or add this to .cursor/mcp.json in your project, or ~/.cursor/mcp.json for every project:

{
  "mcpServers": {
    "sniffpup": { "url": "https://sniffpup.com/api/mcp" }
  }
}

Other tools that support remote MCP servers over HTTP work too: use the address https://sniffpup.com/api/mcp with no sign-in.

Step-by-step guides with copy buttons: use SniffPup inside Lovable, inside Bolt and inside Cursor.

• Only scan a site you own or have permission to test. Your AI tool must confirm that with you first and pass consent: true, which means you agree to the same Terms, Acceptable Use Policy and Privacy Policy as the scan box on the website.
• It has the same limits as a free scan from the website (per network and per site), and it's the same passive scan: it only reads what any visitor's browser can see.

Try asking:

• “I own my-app.com. Run a free SniffPup scan of it and fix any critical issue.”
• “I just deployed my-app.com. Scan it with SniffPup again and tell me if the score went up.”

Every paid plan (Solo and up): the full toolset

With a token, your AI tool can also list your sites, scan your verified sites with full results and read your latest results.

Get a token

What you need

• A Solo, Starter, Pro or Ultimate plan and a token from Account › API tokens (the same tokens as the Scan API: Solo 1, Starter up to 2, Pro 10, Ultimate 25). The token is shown once; we store only a hash. Revoke it there at any time and the tool stops working right away.
• Your site added to your dashboard and ownership verified. SniffPup only scans sites in your own account.

Connect it

Save your token in an environment variable named SNIFFPUP_TOKEN, then pick your tool.

Claude Code

claude mcp add --transport http sniffpup https://sniffpup.com/api/mcp \
  --header "Authorization: Bearer $SNIFFPUP_TOKEN"

Cursor

{
  "mcpServers": {
    "sniffpup": {
      "url": "https://sniffpup.com/api/mcp",
      "headers": { "Authorization": "Bearer ${env:SNIFFPUP_TOKEN}" }
    }
  }
}

Other tools

Any tool that supports remote MCP servers over HTTP works. Use the address https://sniffpup.com/api/mcp and send the header Authorization: Bearer followed by your token.

What to ask

• “Scan my-app.com with SniffPup and fix anything high or critical.”
• “What did SniffPup find on my site last time? Start with the worst issue.”
• “I just deployed. Run SniffPup again and tell me if the score went up.”

What it can do

• List my sites (list_sites): your sites, whether each is verified, and the latest score.
• Scan a site (scan_site): runs a new scan of one of your verified sites (up to about a minute) and returns the score, pass or fail against a pass mark (default 70), and each issue with fix steps and a prompt.
• Get latest results (get_latest_results): reads your most recent scan without running a new one.

Limits and privacy

• Scans from your AI tool count toward your plan's daily scans and per-site pacing, and share the Scan API's 30 scans an hour per token.
• It's the same passive scan as the dashboard: it reads what your live site shows any visitor and never logs in or changes anything.
• Your AI tool sees the issue titles, summaries, masked evidence and fix steps. Leaked keys are always masked, never shown in full.