MCP Quick Install21 MCP toolsNo API key copyPro+ workspace required

Install BoringSec MCP in one copy-paste flow.

Open a terminal in your project folder, paste the commands below, approve the short browser code, then restart Claude Code, Codex, or Cursor. BoringSec stores a dedicated device credential for you, so beginners do not have to handle raw secrets.

Device authorization and hosted API tools require an active Pro, Business, or Enterprise workspace. Free and Care accounts can read this setup guide but cannot approve an MCP device credential.

Copy install commands Compare Pro+ plans

What you get after setup

Inline project security review from Claude Code, Codex, or Cursor.

21 default MCP tools for scans, reviews, fixes, policies, and usage visibility.

AI-ready fixes for auth gaps, secrets, SSRF, webhooks, and risky code.

Workspace rules: AGENTS.md, .cursorrules, and BoringSec policy bundle.

Privacy-safe MCP cockpit with device status and recent run summaries.

Copy this into Terminal

Use this when you want BoringSec available in both Claude Code and Cursor for the current project.

terminal

npx -y @boringsec/claude-code login
npx -y @boringsec/claude-code init --editor both --scope project --write-rules
npx -y @boringsec/claude-code doctor

Claude Code only

terminal

npx -y @boringsec/claude-code login
npx -y @boringsec/claude-code init --editor claude --scope project --write-rules

Cursor only

terminal

npx -y @boringsec/claude-code login
npx -y @boringsec/claude-code init --editor cursor --scope project --write-rules

Codex setup

terminal

npx -y @boringsec/claude-code login

terminal

npx -y @boringsec/claude-code init --editor codex --scope project --write-rules

toml

[mcp_servers.boringsec]
command = "npx"
args = ["-y", "@boringsec/claude-code"]
startup_timeout_sec = 60
tool_timeout_sec = 660

terminal

codex mcp get boringsec

The npm latest tag is currently 0.4.7. Run the initializer from your project to write .codex/config.toml. Review the generated files, trust the workspace in Codex, then run the verification command. The TOML block is an optional manual alternative. Configuration alone does not prove the server is connected. See the full MCP docs for user-scope paths and troubleshooting.

Step 1

Run login

The command starts device authorization. If the browser does not open automatically, the terminal will show a URL and a short code.

Step 2

Approve in browser

Step 3

Bootstrap project config

The init command writes the MCP config and starter rule files for your editor. Commit these project config files if your team wants the same setup.

Step 4

Restart and run review

Restart Claude Code, Codex, or Cursor, then ask the assistant to run a BoringSec workspace review.

First prompt to paste into your AI editor

prompt

Use BoringSec MCP to review this project for security issues.
Start with boringsec_workspace_review.
Show critical risks first, explain why they matter, then give me safe fixes I can apply.

If anything fails

terminal

npx -y @boringsec/claude-code doctor --fix
npx -y @boringsec/claude-code status
npx -y @boringsec/claude-code rotate
npx -y @boringsec/claude-code logout --revoke

No tools in editor

Restart the editor after init. Then run doctor --fix to repair local config.

Authorization denied

MCP uses authenticated API access. If your plan does not include MCP yet, upgrade or ask the workspace owner for access.