SafeWeave — Claude Code MCP server: security scanning
SafeWeave scans a project for code flaws, exposed secrets and risky dependencies through MCP. Use it in your editor to surface security findings and ask your agent to address them.
claude mcp add --transport http safeweave https://mcp.safeweave.dev/mcpWhat SafeWeave does
SafeWeave brings security scans into an MCP-connected editor. It checks source code for issues such as SQL injection and XSS, searches for credentials, reviews package dependencies for known CVEs, and checks Terraform, Dockerfile and Kubernetes configuration. It also covers container images, dependency licenses and application security settings. Runtime API scanning is part of the Cloud plan.
The server fetches scanner binaries when needed, including gitleaks, trivy and opengrep. For SAST it uses an installed semgrep first; otherwise it downloads opengrep. Without a license key, the trial covers 10 scans with three scanners. A free account unlocks local scans with seven. A separate Claude Code skill can trigger scans before git commit, git push or PR creation, but it depends on SafeWeave MCP being configured.
What it helps with
- spot SQL injection and XSS in source code
- find credentials left in project files
- check packages for known CVEs
- detect misconfigurations in Terraform and Docker files
- review container images and application security settings
Example prompts for the agent
- Scan this project for security issues and suggest fixes.
- Check the project's dependencies for known CVEs.
- Look for credentials accidentally committed in the source files.
How to install SafeWeave
1Platform CLI: remote server
claude mcp add --transport http safeweave https://mcp.safeweave.dev/mcp2Platform CLI
claude mcp add --env SAFEWEAVE_LICENSE_KEY=<SAFEWEAVE_LICENSE_KEY> --transport stdio safeweave -- npx -y safeweave-mcpReplace <…> with your own values
1Platform CLI: remote server
codex mcp add safeweave --url https://mcp.safeweave.dev/mcp2Platform CLI
codex mcp add safeweave --env SAFEWEAVE_LICENSE_KEY=<SAFEWEAVE_LICENSE_KEY> -- npx -y safeweave-mcpReplace <…> with your own values
Config file
{
"mcpServers": {
"safeweave": {
"url": "https://mcp.safeweave.dev/mcp"
}
}
}{
"mcpServers": {
"safeweave": {
"command": "npx",
"args": [
"-y",
"safeweave-mcp"
],
"env": {
"SAFEWEAVE_LICENSE_KEY": "<SAFEWEAVE_LICENSE_KEY>"
}
}
}
}Replace <…> with your own values
Config file
{
"servers": {
"safeweave": {
"type": "http",
"url": "https://mcp.safeweave.dev/mcp"
}
}
}{
"servers": {
"safeweave": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"safeweave-mcp"
],
"env": {
"SAFEWEAVE_LICENSE_KEY": "<SAFEWEAVE_LICENSE_KEY>"
}
}
}
}Replace <…> with your own values
1Platform CLI: remote server
gemini mcp add -t http safeweave https://mcp.safeweave.dev/mcp2Platform CLI
gemini mcp add -e SAFEWEAVE_LICENSE_KEY=<SAFEWEAVE_LICENSE_KEY> safeweave npx -y safeweave-mcpReplace <…> with your own values
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about SafeWeave
How do I install SafeWeave in Claude Code?
Connect the hosted server with claude mcp add --transport http safeweave https://mcp.safeweave.dev/mcp. For a local server, run claude mcp add --env SAFEWEAVE_LICENSE_KEY=<SAFEWEAVE_LICENSE_KEY> --transport stdio safeweave -- npx -y safeweave-mcp.
What does SafeWeave do?
It scans code, credentials and dependencies, and checks infrastructure configuration and container images. An AI agent in the editor can work on the findings.
What can I scan without a SafeWeave key?
The key-free trial includes 10 scans for SAST, secret detection and dependency checks. A free account enables local scanning with seven scanners.
