Perfai Cloud MCP Server

The Perfai MCP server (perfai-cloud-mcp) connects Perfai to your AI coding assistant via the Model Context Protocol. Once installed, you can register an app, run a security scan, review vulnerabilities, and get AI-powered fix prompts and auto-fix instructions — all without leaving your editor.

Where to run Perfai commands: every Perfai action — Login to Perfai, Run a security test, Show me the vulnerabilities it found, and so on — is a natural-language prompt you type into your code agent’s chat (Claude Code, Cursor, VS Code Copilot Agent Mode, Windsurf, or Zed). They are not terminal commands. Only the one-time installation steps (npx, claude mcp add, editing a config file) run in a shell.

Claude Code

One-command setup via the claude mcp add CLI.

Claude

The chat app, not Claude Code — custom connector via Settings.

Cursor

Global or per-project config via .cursor/mcp.json.

VS Code (Copilot Agent Mode)

Add to .vscode/mcp.json or user settings.

Windsurf

Drop the config in ~/.codeium/windsurf/mcp_config.json.

Zed

Postman

Native MCP request type and call tools directly.

AWS Kiro

Amazon’s AI IDE — successor to Amazon Q Developer. Config via mcp.json.

Cline

VS Code extension for autonomous coding. Config via cline_mcp_settings.json.

LM Studio

Local model runner — add via the Program tab’s mcp.json.

Continue.dev

VS Code / JetBrains extension. Config via .continue/mcpServers/.

Replit

Browser-based agent — custom connector via the Integrations pane.

Lovable

Browser-based app builder — custom connector via the Connectors dashboard.

Bolt

Browser-based app builder — custom connector via account-level Connectors.

IBM Bob

Standalone AI coding IDE. Config via mcp.json, global or per-project.

Generic MCP client

Works with any client that supports stdio MCP servers.

Requirements

Node.js 18 or later — run node --version to check.
A Perfai account — sign up at cloud.perfai.ai.

The command

The Perfai MCP server is published as perfai-cloud-mcp. Launch it with npx:

npx -y perfai-cloud-mcp

In a JSON config file this becomes:

{
  "command": "npx",
  "args": ["-y", "perfai-cloud-mcp"]
}

On Windows, some MCP hosts fail to spawn npx directly with a spawn npx ENOENT error, because npx is a .cmd shim rather than an executable. If you hit this, wrap it through cmd: "command": "cmd", "args": ["/c", "npx", "-y", "perfai-cloud-mcp"].

How authentication works

How you sign in depends on how your client runs Perfai MCP:

Local clients (Claude Code, Cursor, VS Code, Windsurf, Zed, and other stdio clients) launch perfai-cloud-mcp on your machine. Browser login is the default. For headless machines and CI, set a Perfai API key as PERFAI_API_KEY instead.
Remote clients (Postman, AWS Kiro, Cline, LM Studio, Continue.dev, Replit, Lovable, Bolt, IBM Bob) connect to https://mcp-server.perfai.ai/mcp. They authenticate with a Perfai API key, sent as Authorization: Bearer pfk_xxxxxxxxxxxx_... or pasted into the client’s API Key / Bearer token field.

Calling login with no arguments opens a browser to Perfai’s own sign-in page (OAuth) and completes the session automatically. No credentials go in your config.

Run the login tool

Ask your AI assistant: “Login to Perfai”. A browser window opens to Perfai’s sign-in page. If that browser already has an active cloud.perfai.ai session, this can complete silently via SSO with no prompt at all.

Confirm you're authenticated

Ask “What’s my Perfai auth status?” — once it reports authenticated, the protected tools become available.

Register the app you want to test by URL. All security-testing and vulnerability tools operate on the currently selected app.

API key in the `env` block (local clients)

To skip the browser, create an API key and add it to the server’s env block:

{
  "mcpServers": {
    "perfai-cloud-mcp": {
      "command": "npx",
      "args": ["-y", "perfai-cloud-mcp"],
      "env": { "PERFAI_API_KEY": "pfk_xxxxxxxxxxxx_..." }
    }
  }
}

PERFAI_TOKEN also accepts an API key, so you can paste a key into an existing PERFAI_TOKEN entry.

Local clients still read PERFAI_EMAIL / PERFAI_PASSWORD from the env block as a fallback. That stores your password in a config file, so use an API key instead.

If you put an API key in a config file, treat that file like a secret — don’t commit it to a shared repository. Prefer user-scoped (global) config over project-scoped config for anything containing a key.

Base64 email:password Bearer values are deprecated and will be removed. If a remote client still sends Authorization: Bearer <base64 of email:password>, replace that value with an API key.

Create an API key

A Perfai API key (pfk_<key id>_<secret>) is a personal credential for MCP clients:

It acts as you. The key has the same organizations and role as the user who created it. A Viewer’s key can’t dismiss or fix findings. Organization selection works the same as with a normal login.
It’s shown once. Perfai returns the full key only in the creation response. Copy it straight into your client config.
It expires. Keys last 90 days by default. You can set up to 365 days.
It’s revocable. Revoke a key at any time and it stops working.
You can hold up to 10 active keys. Use one key per client or machine, so you can revoke one without breaking the others.

Log into cloud.perfai.ai.
In the left sidebar, click API Keys.
Click + Create key.
Name: something that identifies where it’s used, e.g. Cursor or Replit.
Expires after (days): optional — leave blank for the 90-day default, or set up to 365.
Click Create key and copy the value immediately — it’s shown once, right after creation, and never shown again. Store it like a password.

Paste that value into your client’s config exactly as-is. Each client page shows where it goes.

List and revoke keys

The same API Keys page lists every key you’ve created, with its creation date, expiry, and last-used time. Click Revoke next to any key to disable it immediately — the list never shows a key’s secret again. If you lose a key, revoke it and create a new one.

Troubleshooting API keys

Symptom	Cause	Fix
`401 Unauthorized`, or a connection that used to work now fails	The key has expired or been revoked	Create a new key and replace the old value in your client config.
`401` on a brand-new key	The value is incomplete, has extra whitespace, or is missing the `Bearer` prefix	Paste the full `pfk_…` value again. A raw header value needs `Bearer` in front of the key.
An action, such as dismissing or fixing a finding, is refused	The key has your role, and your role doesn’t allow that action	Ask an organization admin for a role that allows it.
Creating a key fails and you already have 10	You’ve reached the limit of 10 active keys	Revoke a key you no longer use, then try again.

Tools

Only login and auth_status are available before you authenticate. After login, all of the following become available:

Authentication

Tool	What it does
`login`	Sign in to Perfai — opens a browser, or uses `PERFAI_API_KEY` if set
`auth_status`	Shows current authentication status
`logout`	Clears your saved session

Organization management

Tool	What it does
`manage_organizations`	List the organizations your account belongs to and switch between them

App management

Tool	What it does
`register_app`	Register a new app by URL for security testing
`check_app_status`	Poll registration progress until complete
`list_apps`	List all your registered apps
`select_app`	Switch to a different registered app
`submit_app_credentials`	Provide login credentials for apps that require authentication

Security testing

Tool	What it does
`run_security_test`	Start a security scan on the current app
`check_task_status`	Poll scan progress until complete

Vulnerability management

Tool	What it does
`get_vulnerabilities`	List all findings from the latest scan
`suggest_fix`	Get a conversational fix prompt for a specific vulnerability
`auto_fix`	Get structured, step-by-step fix instructions for one vulnerability
`auto_fix_all`	Get a prioritized fix plan for all unfixed vulnerabilities
`get_fix_summary`	View fix progress — fixed/unfixed/dismissed by severity
`dismiss_vulnerability`	Dismiss a finding (false positive, accepted risk, etc.)
`reopen_vulnerability`	Reopen a previously dismissed finding
`mark_vulnerability_fixed`	Mark a finding as fixed after applying the code change

Typical workflow

Login to Perfai

Register https://myapp.com with Perfai

Run a security test

Run a security test on the selected app

Review the findings

Show me the vulnerabilities it found

Fix and verify

Auto-fix all critical and high vulnerabilities, then confirm each one: Mark vulnerability 3 as fixed

Registering an app and running a scan

Register https://your-app.example.com with Perfai

Check the onboarding status for that app

Run a security test on the selected app

Show me the vulnerabilities it found

Fixing vulnerabilities

One at a time:

Show me how to fix vulnerability 3

All at once, prioritized by severity:

Auto-fix all critical and high vulnerabilities

After applying a fix, mark it done and verify progress:

Mark vulnerability 3 as fixed

Give me the fix summary

Useful prompts

Goal	Prompt
Check login status	`What's my Perfai auth status?`
List your organizations	`List my Perfai organizations`
Switch organizations	`Switch to the second Perfai organization`
Register a new app	`Register https://myapp.com with Perfai`
List your apps	`List my Perfai apps`
Switch apps	`Select the app with URL https://other-app.com`
Run a scan	`Run a security test on the selected app`
See findings	`Show me all vulnerabilities for this app`
Fix everything	`Auto-fix all vulnerabilities for my current app`
Fix one issue	`Show me how to fix vulnerability #2`
Check progress	`Give me the fix summary`
Dismiss a finding	`Dismiss vulnerability #3 — it's a false positive`

Next steps

Pick your editor to get started:

Getting Started

Core Concepts

Hybrid Deployment

Changelog

Claude Code

Claude

Cursor

VS Code (Copilot Agent Mode)

Windsurf

Zed

Postman

AWS Kiro

Cline

LM Studio

Continue.dev

Replit

Lovable

Bolt

IBM Bob

Generic MCP client

Requirements

The command

How authentication works

API key in the `env` block (local clients)

Create an API key

List and revoke keys

Troubleshooting API keys

Tools

Authentication

Organization management

App management

Security testing

Vulnerability management

Typical workflow

Registering an app and running a scan

Fixing vulnerabilities

Useful prompts

Next steps

Claude Code

Claude

Cursor

VS Code (Copilot Agent Mode)

Windsurf

Zed

Postman

AWS Kiro

Cline

LM Studio

Continue.dev

Replit

Lovable

Bolt

IBM Bob

Generic MCP client

​Requirements

​The command

​How authentication works

​Browser login (local clients)

​API key in the env block (local clients)

​Create an API key

​List and revoke keys

​Troubleshooting API keys

​Tools

​Authentication

​Organization management

​App management

​Security testing

​Vulnerability management

​Typical workflow

​Registering an app and running a scan

​Fixing vulnerabilities

​Useful prompts

​Next steps

Requirements

The command

How authentication works

Browser login (local clients)

API key in the `env` block (local clients)

Create an API key

List and revoke keys

Troubleshooting API keys

Tools

Authentication

Organization management

App management

Security testing

Vulnerability management

Typical workflow

Registering an app and running a scan

Fixing vulnerabilities

Useful prompts

Next steps