MCP Server Setup

Use Vergate from Claude Code, Cursor, OpenClaw, or any MCP-compatible tool.

The Vergate MCP (Model Context Protocol) server lets AI coding assistants run security scans directly. It runs on your machine and talks to the Vergate cloud backend over HTTPS.

#Installation

#Via pip (recommended)

Install

pip install vergate-mcp

Warning. We do not offer an npm package. Global npm installs trigger macOS's "Access other apps and services on this device"(App Management) permission prompt, which we won't ask end users to grant. The pip install is a plain Python package — no system-level permissions requested.

#Configuration

Set two environment variables:

Environment variables

export VERGATE_API_KEY="pk_your_key_here"
export VERGATE_BACKEND_URL="https://api.vergate.dev"
# Optional: pin the server to a single project
export VERGATE_PROJECT_ID="your-project-uuid"

Warning. You need an API key, not an OAuth token. Create one in Settings → API Keys in the Vergate dashboard.

#Per-Project Keys (Recommended)

The dashboard can generate a project-scoped API key that locks the MCP server to a single project. With a scoped key the server automatically pins every tool to that project — you never pass project_id manually, and the key cannot read or modify any other project.

Create the key

Open a project in the dashboard and go to Project → MCP.

Copy your client's snippet

The page shows ready-made config snippets for Claude Code, opencode, OpenClaw, and HTTP mode with the key already filled in.

Claude Code .mcp.json

{
  "mcpServers": {
    "vergate": {
      "command": "vergate-mcp",
      "env": {
        "VERGATE_API_KEY": "pk_your_project_key_here",
        "VERGATE_BACKEND_URL": "https://api.vergate.dev",
        "VERGATE_PROJECT_ID": "your-project-uuid"
      }
    }
  }
}

opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "vergate": {
      "type": "local",
      "command": ["vergate-mcp"],
      "enabled": true,
      "environment": {
        "VERGATE_API_KEY": "pk_your_project_key_here",
        "VERGATE_BACKEND_URL": "https://api.vergate.dev",
        "VERGATE_PROJECT_ID": "your-project-uuid"
      }
    }
  }
}

Protect the key

The raw key is shown exactly once. Revoke it any time from the same MCP page — multiple named keys let you give each client its own credential and revoke them independently.

Tip. Scoped keys only access their own project: list_projects returns just that project, create_projectis disabled, and any other project's resources return 404.

#Claude Code Setup

Install the MCP server

pip install vergate-mcp

Add to Claude Code config

Add to your ~/.claude/claude_desktop_config.json or project .mcp.json:

.mcp.json

{
  "mcpServers": {
    "vergate": {
      "command": "vergate-mcp",
      "env": {
        "VERGATE_API_KEY": "pk_your_key_here",
        "VERGATE_BACKEND_URL": "https://api.vergate.dev"
      }
    }
  }
}

#opencode Setup

Add the same server to opencode.json (project) or ~/.config/opencode/opencode.json:

opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "vergate": {
      "type": "local",
      "command": ["vergate-mcp"],
      "enabled": true,
      "environment": {
        "VERGATE_API_KEY": "pk_your_key_here",
        "VERGATE_BACKEND_URL": "https://api.vergate.dev",
        "VERGATE_PROJECT_ID": "your-project-uuid"
      }
    }
  }
}

#Stdio Transport (Default)

The MCP server communicates over stdin/stdout using JSON-RPC 2.0. This is the default and recommended transport for Claude Code, opencode, and OpenClaw.

#HTTP/SSE Transport

For web-based tools (Lovable, Base44), use HTTP transport:

Start HTTP server

vergate-mcp --transport http --port 3001

Important: Lovable and Base44 run in the cloud, so they cannot reach localhost. Expose the server with a tunnel (e.g. ngrok http 3001 or cloudflared tunnel --url http://localhost:3001) or deploy it on a public host, then register the public URL ending in /mcpin the tool's MCP settings and authenticate with your project key as a Bearer token.

The server exposes:

POST /mcp — JSON-RPC endpoint
GET /health — Health check
GET /sse — SSE stream

#Available Tools

Tool	Description
scan_website	Run a passive + optional active scan
get_scan_results	Fetch results by scan ID
list_scans	List all your scans
profile_site	Technology stack profiling
performance_check	Performance analysis (Core Web Vitals)
seo_check	SEO or AEO analysis
accessibility_check	WCAG 2.1 AA audit
deliverability_check	Email DNS authentication checks
list_integrations	List connected providers
scan_integrations	Run security analysis on integrations
issue_badge	Issue a Verified badge for a project
verify_badge	Verify a badge JWT token

Tip. See Tools Reference for detailed usage of each tool.