Security for Claude Code & vibe-coded apps
Jikida gives Claude Code, Cursor, Windsurf and Codex real security tools over MCP. Pentest a live site, scan code and repos, and fix findings, right in the chat.
Real security tools, called by your AI.
Your assistant calls these over MCP when it needs live data or a real scan. Pentest leads, headers come last.
A live pentest of any URL: TLS, HSTS, CSP, exposed .env / .git / backup files, leaked Supabase, Firebase and S3 keys, and security headers. Graded A to F with a fix for every finding. Works free once a day with no token, so your AI can take a first look on any public site.
Free, once a day, no tokenThe deep pass on a site you own: surface discovery, tech fingerprint, a safe error-based SQL-injection probe, admin and login-panel discovery, source-map leaks and CVE checks. Full report saved to history.
Token, paid planScan a GitHub repo or a vibe-coded app for committed secrets, exposed key files, unsafe patterns, vulnerable dependencies and the dead code the AI left behind. No clone needed.
Check a snippet for exposed keys and unsafe patterns as you write it, inline, before it ships.
KeylessThe agentic triage loop. The AI opens the code for each finding and records confirmed vs false-positive, so the report is real issues, not noise.
Read your account's recent scans, uptime state and WAF or attack log, so the assistant reasons over your real data.
Fast keyless probes for a site's current security-header state, or a public S3 bucket. Handy, but run_pentest is the real audit.
KeylessSkills run on your machine, on your behalf. Jikida never runs your code on our servers. run_pentest, guard_code, check_headers and check_s3_bucket work with no token (IP-limited); the rest use a jk_live_ key.
Scan and pentest from your terminal.
One npx command runs a website pentest, a repo and code scan for secrets, bad code and vulnerable dependencies, plus SARIF and JSON reporting and CI gating. All local, no install.
Pentest a site
npx @jikida/scan example.com
Deep: crawl plus active SQLi probe
npx @jikida/scan example.com --crawl 10 --active
Authenticated scan (behind login)
npx @jikida/scan example.com --cookie "session=abc123"
Scan a local repo (offline, no account)
npx @jikida/scan repo .
SARIF for GitHub code scanning
npx @jikida/scan example.com --sarif > results.sarif
JSON report
npx @jikida/scan example.com --json
Fail a CI build on high severity
npx @jikida/scan example.com --fail-on high
Offline, local checks only
npx @jikida/scan example.com --offline
One-command project setup
$ npx @jikida/init framework detected, SDK added, scan wired
Connect the MCP server
Add jikida to your AI IDE's MCP config. Set JIKIDA_API_KEY for the account tools; keyless tools work without it.
Add to .claude/mcp.json in your project, or run npx -y @jikida/mcp link to connect via the browser.
{
"mcpServers": {
"jikida": {
"command": "npx",
"args": ["-y", "@jikida/mcp"],
"env": { "JIKIDA_API_KEY": "jk_live_..." }
}
}
}Settings, Developer, Edit Config. Add the server, then restart Claude Desktop.
{
"mcpServers": {
"jikida": {
"command": "npx",
"args": ["-y", "@jikida/mcp"],
"env": { "JIKIDA_API_KEY": "jk_live_..." }
}
}
}Settings, MCP, Add new MCP server, or edit ~/.cursor/mcp.json.
{
"mcpServers": {
"jikida": {
"command": "npx",
"args": ["-y", "@jikida/mcp"],
"env": { "JIKIDA_API_KEY": "jk_live_..." }
}
}
}Settings, Cascade, MCP servers, edit config.
{
"mcpServers": {
"jikida": {
"command": "npx",
"args": ["-y", "@jikida/mcp"],
"env": { "JIKIDA_API_KEY": "jk_live_..." }
}
}
}Add the server to your Codex MCP config.
[mcp_servers.jikida]
command = "npx"
args = ["-y", "@jikida/mcp"]
env = { JIKIDA_API_KEY = "jk_live_..." }SDKs, Chrome extension & WordPress plugin
Beyond the MCP server, ship jikida everywhere your app runs.
SDKs, 10 languages
One-line fail-open guard clients.
Chrome extension
Scan any site you visit for exposed files, weak headers and leaked keys.
Get the extension →WordPress plugin
Connect a WordPress site and scan it from your dashboard.
Get the plugin →MCP server
Give your AI IDE the jikida security tools over MCP.
Connect it →FAQ: securing vibe-coded apps
How do I add security to Claude Code?+
Add the jikida MCP server to .claude/mcp.json with npx -y @jikida/mcp, then set JIKIDA_API_KEY. Claude Code can then call run_pentest, scan_repo and run_vibe_scan directly in the chat.
Can it pentest my site?+
Yes. run_pentest runs a live pentest of any URL and grades it A to F. run_deep_pentest adds the deep pass, a SQL-injection probe, admin-panel discovery, source-map leaks and CVE checks, on a site you own.
What is the difference between pentest and deep pentest?+
run_pentest is the fast surface audit (TLS, headers, exposed files, leaked keys) and works free once a day with no token. run_deep_pentest is the authenticated full pass, saved to history, and needs an account on a plan that includes deep scans.
Does it run my code on your servers?+
No. The CLI and code scans run locally on your machine, on your behalf. The MCP tools return results into your chat; jikida never uploads or runs your source code on our servers.
How do I scan a repo for secrets?+
Run npx @jikida/scan repo . to scan a local working tree offline for committed secrets, vulnerable dependencies and unsafe Dockerfile or GitHub Actions config, or use the scan_repo MCP tool on a public GitHub repo.
Can I gate CI on findings?+
Yes. Add --fail-on high to exit non-zero when a finding at or above that severity exists, and --sarif to upload results to GitHub code scanning.
Which AI IDEs are supported?+
Claude Code, Claude Desktop, Cursor, Windsurf and Codex, any client that speaks the Model Context Protocol. The install snippet is the same npx command for each.