Skip to contentLockpick
How it worksPricingDocs

Read

  • BlogPlain answers to common security questions
  • GuidesStep by step fixes for common setups
  • Security checksEvery check we run, explained

Learn

  • Learn with PickTwo-minute lessons on how sites get attacked
  • Lockpick for ClaudeCheck sites from Claude and other assistants
  • GlossaryThe words we use, in plain words

Company

  • ChangelogWhat changed, newest first
  • StatusWhether scans are running right now
  • Security and trustHow we check and what we never do
Sign inCheck it
Guides

Run a Lockpick scan from Claude Code or Cursor

By Mark KashefPublished October 8, 2026

Add Lockpick's hosted MCP server to your coding agent and you can check your live site, read the report and fix what it found without leaving the editor. Your assistant never runs a scanner itself. It asks Lockpick, which runs the same limited, read-only checks as the web app.

Claude Code

claude mcp add --transport http lockpick https://mcp.lockpick.app/mcp

After adding it, run /mcp in Claude Code to sign in. The server uses OAuth, so your assistant opens Lockpick in your browser, where you sign in, pick one workspace and choose what it may do, and it never sees your password.

Curious what your site shows from outside? The quick check is free and needs no account.

Check it

Cursor

Add this to .cursor/mcp.json in your project, or use the one-click button on the Cursor setup page.

{
  "mcpServers": {
    "lockpick": { "url": "https://mcp.lockpick.app/mcp" }
  }
}

Cursor opens and asks to add Lockpick, and you sign in when it asks.

What to ask

  1. "Do a quick check of atlas.example and tell me what stands out."
  2. "Run a Pulse on my site and explain the most important fix in plain words."
  3. "Fix what Lockpick found in this repository. Work on a new branch and don't deploy."
  4. "Recheck my site and tell me what changed since last time."

Atlas at atlas.example is an example address, so use your own site.

What still needs you

Every scan needs your say-so. Before starting Deep, your assistant prepares the scan and sends you to Lockpick to approve its exact scope and cost. Reading reports does not start a scan, and nothing an assistant does through Lockpick changes your site. The permissions page lists what each permission allows.

Questions people ask

Does my coding agent scan my site directly?

No. It asks Lockpick, which runs the same limited, read-only checks as the web app, under the permissions you approved.

Can the agent start a Deep scan on its own?

No. It can prepare one, and you approve the exact scope and cost in Lockpick before it starts.

See what your site shows from outside

A quick check reads your homepage the way a visitor would and gives you a score. No account needed.

Check your site

Related pages

  • Security checks your coding agent can run on your live site
  • Cursor security checklist for the app you ship
  • Fix it with your AI, prompts for Lovable, Bolt, Replit, v0, Cursor and Claude Code

Sources

  1. Claude Code Lockpick docs, read on October 6, 2026
  2. Cursor Lockpick docs, read on October 6, 2026
  3. Hosted server and sign-in Lockpick docs, read on October 6, 2026

About the author

Mark Kashef, Founder of Lockpick

I'm Mark, and I build Lockpick. I write these pages, and each one is checked against its sources before it goes live. The Updated date changes only when the page itself does.

Lockpick
PricingMethodologyDocsBlogGuidesSecurity checksLearn with PickSecurity and trustLockpick for ClaudeChangelogStatusFacts for AI assistants

Lockpick is a security scanner for vibe-coded apps. It checks what your live site exposes and what a GitHub repo or AI skill would do before you install it, then gives you a fix prompt for Lovable, Bolt, Replit, Cursor or Claude Code.

Lockpick assesses public pages you are authorized to test, and public GitHub code it never runs.

© 2026 LockpickTermsPrivacyContactSign in