1. Server address
MCP address: https://hackaiz.com/mcp. You sign in with your Hackaiz account (OAuth) and approve a consent screen. No key to copy.
2. Claude (web and desktop)
- Open Settings → Connectors → Add custom connector.
- Paste https://hackaiz.com/mcp, then sign in to Hackaiz and approve access.
- Ask for example: "List my verified Hackaiz sites" or "Explain the most severe finding of my latest analysis".
3. Claude Code, Cursor, Windsurf, VS Code
- Claude Code: claude mcp add --transport http hackaiz https://hackaiz.com/mcp
- Cursor / Windsurf / VS Code: add an HTTP MCP server pointing to https://hackaiz.com/mcp in the editor's MCP configuration.
- On first use, the editor opens the Hackaiz sign-in in your browser.
4. Available tools
- List your platforms and verified sites.
- Read an analysis status and its findings (no raw evidence or secrets).
- Explain a finding.
- Prepare an analysis: returns the Hackaiz link where you confirm it; ownership proof and credits are checked there.
5. What the assistant will never do
- Launch an analysis or spend credits without your confirmation in Hackaiz.
- Analyse a target whose ownership you have not proven.
- Write, merge or change anything on GitHub.
- Take payments: purchases happen only on Hackaiz.
6. ChatGPT and other assistants
Assistants that accept a remote MCP server can use the same address, subject to their own rules and availability. ChatGPT apps and listing in official directories depend on each platform's approval and are not available yet.
7. Revoke access
Remove the connector in your assistant; access then stops for that assistant. Email contact@hackaiz.com with any question.
8. Block a secret before every commit (free, local)
- In your repository: curl -fsSL https://hackaiz.com/hackaiz-pre-commit.sh -o .git/hooks/pre-commit && chmod +x .git/hooks/pre-commit
- The check runs on your machine and sends nothing. It catches common key formats (GitHub, AWS, Stripe, Supabase, private keys); it does not guarantee a commit is safe.
9. Check every pull request (GitHub Actions, free)
- Download https://hackaiz.com/hackaiz-github-action.yml and place it at .github/workflows/hackaiz.yml.
- Read-only: it looks for added secrets and applies the open Hackaiz rules, never writing or merging. A passing run does not prove the code is safe.
10. Scan a folder on your computer (free, local)
- curl -fsSL https://hackaiz.com/hackaiz-scan.mjs -o hackaiz-scan.mjs && node hackaiz-scan.mjs .
- Looks for secret keys in your files without sending anything; values are masked. No result does not prove the project is safe.
11. Other coding agents (Codex, GitHub Copilot, Cline, Continue, Zed, Gemini CLI)
- These tools accept remote MCP servers in their MCP settings: add an HTTP server named "hackaiz" with the address https://hackaiz.com/mcp.
- The Hackaiz sign-in opens on first use; the same read tools and rules apply.
- Exact support (OAuth, remote servers) depends on each tool's version; if yours lacks it, use Hackaiz from the dashboard.
12. ChatGPT (custom GPT with Actions)
- In ChatGPT: Explore GPTs → Create → Configure → Create new action → Import from URL: https://hackaiz.com/openapi-gpt.json
- Authentication: API key, "Bearer" type, with your platform key (platform page in Hackaiz).
- Read-only: the GPT reads one platform's analyses and findings. Every access appears in Settings → Integrations.
13. Slack, Teams, Discord alerts and tickets
- Settings → Integrations: paste an incoming webhook address to receive serious proven risks.
- On each finding: "Create Linear ticket" or "Copy for Jira". Nothing is sent without you.