Hosted server and sign-in

Lockpick's MCP server lets AI assistants use Lockpick with your account. It runs the same checks as the web app and the CLI, with the same limits, and only through the permissions you approve.

The address

https://mcp.lockpick.app/mcp

The server speaks Streamable HTTP. Most assistants need only this address; the assistant pages show each one's setup.

Signing in

The server uses OAuth. When your assistant connects, it opens Lockpick in your browser, where you sign in, pick one workspace and choose what the assistant may do. The assistant never sees your password.

• A sign-in lasts 60 minutes. With Stay signed in (offline_access), your assistant can renew it while you use it. Without that permission, sign in again when the token expires.
• A connection you don't use for 90 days ends, and you sign in again.
• See and disconnect your assistants in Lockpick under Add to your AI, on the CLI and keys tab.

Assistants that support OAuth discovery find everything from the address, through the server's protected resource metadata.

Your first request

Ask your assistant: "Show my Lockpick sites, remaining allowance and latest findings. Do not start a scan yet."

Reading existing results does not consume another scan. Starting a Pulse or Deep scan uses that scan's allowance; connecting, checking progress and reading a report are not separate paid scans. Before starting Deep, your assistant prepares the scan and sends you to Lockpick to approve its exact scope and cost. Retrying the same action with the same idempotency key does not charge twice.

What the server offers

The server has tools to read your sites, scans, findings, repair briefs and remaining allowance, to run quick checks, Pulse scans and the free Re-read this record, and to prepare Deep scans for your approval. It can also read Monitor and, when you ask, send your project's package names and versions to it. It can also search and read these docs, so your assistant answers how-to questions in Lockpick's own words. It also offers each scan's report and repair brief as resources, and prompts to check a site, go deeper and fix findings. Tools, resources and prompts lists every one.