# Run a Lockpick scan from Claude Code or Cursor

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

Connect Lockpick to Claude Code or Cursor in a minute, ask it to check your site, and let it fix what it finds while you approve every scan.

Add Lockpick's hosted MCP server to your coding agent and you can check your live site, read the report and fix what it found without leaving the editor. Your assistant never runs a scanner itself. It asks Lockpick, which runs the same limited, read-only checks as the web app.

## Claude Code

```bash
claude mcp add --transport http lockpick https://mcp.lockpick.app/mcp
```

After adding it, run `/mcp` in Claude Code to sign in. The server uses OAuth, so your assistant opens Lockpick in your browser, where you sign in, pick one workspace and choose what it may do, and it never sees your password.

## Cursor

Add this to `.cursor/mcp.json` in your project, or use the one-click button on the [Cursor setup page](/docs/ai/cursor).

```json
{
  "mcpServers": {
    "lockpick": { "url": "https://mcp.lockpick.app/mcp" }
  }
}
```

Cursor opens and asks to add Lockpick, and you sign in when it asks.

## What to ask

1. "Do a quick check of atlas.example and tell me what stands out."
2. "Run a Pulse on my site and explain the most important fix in plain words."
3. "Fix what Lockpick found in this repository. Work on a new branch and don't deploy."
4. "Recheck my site and tell me what changed since last time."

Atlas at atlas.example is an example address, so use your own site.

## What still needs you

Every scan needs your say-so. Before starting Deep, your assistant prepares the scan and sends you to Lockpick to approve its exact scope and cost. Reading reports does not start a scan, and nothing an assistant does through Lockpick changes your site. The [permissions page](/docs/mcp/permissions) lists what each permission allows.

## Questions people ask

### Does my coding agent scan my site directly?

No. It asks Lockpick, which runs the same limited, read-only checks as the web app, under the permissions you approved.

### Can the agent start a Deep scan on its own?

No. It can prepare one, and you approve the exact scope and cost in Lockpick before it starts.

## Sources

- [Claude Code](https://www.lockpick.app/docs/ai/claude-code), Lockpick docs, read on 2026-10-06
- [Cursor](https://www.lockpick.app/docs/ai/cursor), Lockpick docs, read on 2026-10-06
- [Hosted server and sign-in](https://www.lockpick.app/docs/mcp/hosted-server), Lockpick docs, read on 2026-10-06