Your app's security, where you already code.
Your agent, your repo, your CI. The same checks as the app, the same proof of ownership, the same fixes.
MCP server
Your agent scans, fixes and checks again.
OAuth from the agent, or an API key. Five tools, none of them writes on your side.
claude mcp add --transport http rustine https://mcp.rustine.io
// ~/.cursor/mcp.json
{ "mcpServers": { "rustine": { "url": "https://mcp.rustine.io" } } }URL: https://mcp.rustine.io Auth: OAuth, or the header Authorization: Bearer <key>
Included in Pro. 14-day trial with Solo.
list_projectsYour projects and their score.run_scanStarts a quick scan or a full audit.list_issuesOpen issues, with their proof.get_fixThe fix to apply in your project.recheck_issueChecks an issue again after the fix.GitHub repo
What only shows in the code.
Install the GitHub app on a repo. Rustine reads the default branch and recent history, runs nothing, on a copy destroyed afterwards.
CRITICALAWS key in a commit from 09/03 · .env.localHIGHnext 15.1.0 · CVE-2025-29927 · move to 15.2.3MEDIUMsupabase/migrations · orders table without RLSOKno service_role key on the client
API · soon
One API key, the same routes as the app.
Today, API keys serve the MCP server. The app's routes open to them next: a key acts for your space, with its quotas, and is revoked in one click.
curl https://api.rustine.io/v1/scans \
-H "Authorization: Bearer rst_••••" \
-d '{"url": "https://mysaas.com"}'
{ "id": "8f3a…", "status": "queued" }CLI and CI · soon
Block the deploy when it leaks.
Not available yet. Here's what they'll look like.
$ npx rustine scan mysaas.com ✓ 35 checks · 1 issue ✗ CRITICAL users table readable without signing in → npx rustine fix users-rls
# .github/workflows/rustine.yml
- uses: rustine/scan-action@v1
with:
url: ${{ vars.PREVIEW_URL }}
fail-on: high