Wardzo MCP server setup for Claude, Cursor, ChatGPT, VS Code and Windsurf

The Wardzo MCP server lets your AI assistant check your live website for leaked API keys, exposed files, missing security headers, SEO and indexing problems and downtime, then explain each issue with fix steps it can apply in your code.

Server URLs (Streamable HTTP):

• https://wardzo.com/mcp/account: sign in with your Wardzo account (OAuth). Your app opens a Wardzo page, you click Allow access, done. No key to copy.
• https://wardzo.com/mcp: works without an account for scan_site, get_report and explain_issue, or with an API key for everything.

Overview, tool list and limits on one page: Wardzo MCP server.

1. Sign in or get an API key (both free)

Sign in (recommended where supported): add https://wardzo.com/mcp/account as a custom connector or remote MCP server. Clients that support MCP sign-in (OAuth with dynamic client registration) open Wardzo in your browser. Log in, check the app name and click Allow access. Connected apps are listed under API keys & MCP, where you can disconnect them.

API key (any client): without a key you can already use scan_site, get_report and explain_issue. To work with your monitored sites:

1. Create a free account and add your site.
2. Open Dashboard → API keys & MCP (wardzo.com/app/keys) and click Create key.
3. Copy the key (it starts with wz_). It is shown only once.

Send it as an HTTP header: Authorization: Bearer wz_...

2. Connect your AI tool

Claude Code

claude mcp add --transport http wardzo https://wardzo.com/mcp --header "Authorization: Bearer YOUR_WARDZO_KEY"

Then type /mcp in Claude Code to check that wardzo is connected.

Cursor

Open Cursor Settings → MCP → Add new MCP server, or edit ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project):

{
  "mcpServers": {
    "wardzo": {
      "url": "https://wardzo.com/mcp",
      "headers": { "Authorization": "Bearer YOUR_WARDZO_KEY" }
    }
  }
}

VS Code (GitHub Copilot agent mode)

Create .vscode/mcp.json. VS Code asks for the key once and stores it securely:

{
  "inputs": [
    { "type": "promptString", "id": "wardzo-key", "description": "Wardzo API key", "password": true }
  ],
  "servers": {
    "wardzo": {
      "type": "http",
      "url": "https://wardzo.com/mcp",
      "headers": { "Authorization": "Bearer ${input:wardzo-key}" }
    }
  }
}

Windsurf

Edit ~/.codeium/windsurf/mcp_config.json (or Settings → Cascade → MCP servers → View raw config):

{
  "mcpServers": {
    "wardzo": {
      "serverUrl": "https://wardzo.com/mcp",
      "headers": { "Authorization": "Bearer YOUR_WARDZO_KEY" }
    }
  }
}

OpenAI Codex (CLI, IDE extension)

Add to ~/.codex/config.toml, then set the environment variable WARDZO_API_KEY to your key:

[mcp_servers.wardzo]
url = "https://wardzo.com/mcp"
bearer_token_env_var = "WARDZO_API_KEY"

Claude Desktop

Sign in: Settings → Connectors → Add custom connector, name it Wardzo and paste https://wardzo.com/mcp/account, then click Connect and approve access on the Wardzo page.

Quick start, no account: use https://wardzo.com/mcp instead. You can scan any site and get fix instructions.

With your API key (your monitored sites): add this to claude_desktop_config.json (Settings → Developer → Edit config). It needs Node.js installed:

{
  "mcpServers": {
    "wardzo": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://wardzo.com/mcp", "--header", "Authorization:${WARDZO_AUTH}"],
      "env": { "WARDZO_AUTH": "Bearer YOUR_WARDZO_KEY" }
    }
  }
}

ChatGPT

In ChatGPT, open Settings → Apps & Connectors → Advanced settings, turn on Developer mode, then Create a connector with the URL https://wardzo.com/mcp/account and authentication OAuth. ChatGPT opens Wardzo so you can approve access, then it can work with your monitored sites. For scans without an account, use https://wardzo.com/mcp with No authentication.

Any other MCP client

Use the remote URL https://wardzo.com/mcp with the Streamable HTTP transport and, optionally, the header Authorization: Bearer YOUR_WARDZO_KEY. To test from a terminal:

curl -s https://wardzo.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

For an interactive view, run npx @modelcontextprotocol/inspector, choose Streamable HTTP and enter the URL above.

3. Tools

Tool	Needs key	What it does
scan_site(url)	No	Passive scan of any public site. Returns the score, every issue with an issue_id, and the report link.
get_report(id)	No	Result of a scan by id or report URL.
explain_issue(issue_id)	No	Why it matters, step-by-step fix for an AI coding agent, snippets for Next.js, Vercel, Netlify, Nginx, Apache, Cloudflare and WordPress, and how to verify.
list_sites()	Yes	Your monitored sites with score, open issues and uptime.
add_site(url)	Yes	Start monitoring a site (counts toward your plan's site limit).
get_site_status(site)	Yes	Latest score and change, open issues by severity, uptime for 24 hours and 7 days, and what changed since the previous scan.
list_issues(site, severity?)	Yes	Open issues from the latest scan, filtered by minimum severity.
recheck_site(site)	Yes	Fresh scan after you deploy a fix, with what got resolved.
list_endpoints(site)	Yes	Your endpoint checks on a site, with status, last HTTP code and response time.
add_endpoint(site, url, …)	Yes	Watch a URL on your site with GET/HEAD: expected status, required text, max response time.
remove_endpoint(endpoint_id)	Yes	Stop an endpoint check.

4. Prompts to try

• "Scan mysite.com with Wardzo and fix everything you can in this repo."
• "Use Wardzo to list the critical and high issues on mysite.com, explain each one, apply the fixes, then recheck the site after I deploy."
• "What changed on my site since last week's Wardzo scan?"

Limits

Plan	MCP calls
No account	30 calls per hour per network; scans share the free scan limits
Free	20 calls per day
Basic	500 calls per month
Premium	5,000 calls per month
Scale	20,000+ calls per month (custom)

Security

• Keys are stored hashed and shown once. Revoke a key at any time in API keys & MCP.
• Sign-in uses OAuth 2.1 with PKCE. Access tokens last one hour, refresh tokens rotate on every use, and Wardzo stores only hashes of them. Disconnect an app in API keys & MCP and it loses access immediately.
• A key can read your monitoring data and start scans of your own sites. It cannot change your account, billing or your website.
• Wardzo scans are passive. See how WardzoBot works.