MCP Server Setup Guide

Overview

Sayver's MCP server (@sayver/mcp) lets any MCP-compatible AI client — Claude Desktop, Cursor, Continue, Windsurf, Codex CLI — run a Sayver scan, read findings, and triage them, all from inside your chat. It runs locally as a small background process and authenticates outward to Sayver using an API key you generate in your dashboard. It does no scanning itself; every tool call is a thin wrapper over Sayver's own scan API, so results are identical to running a scan from the dashboard.

Prerequisites

• A Sayver account on Pro or Max — the API and MCP server are included on those plans. On Free and Solo the key manager is replaced by an upgrade link, and any existing key stops authenticating.
• At least one project.
• That project's domain verified — scans require proven domain ownership, the same as scans triggered from the dashboard. Until it is, the API returns issue counts without the finding detail.
• An MCP-compatible AI client installed (Claude Desktop, Cursor, Continue, Windsurf, or Codex CLI).

1. Generate an API key

1. Go to Dashboard → API & MCP.
2. Type a name that tells you where the key will be used (e.g. “Claude Desktop” or “Cursor”).
3. Click Generate key.

Copy it immediately — it starts with sayver_sk_ and is shown only once. If you lose it, revoke it from the same page and generate a new one. The key pop-up also gives you a ready-made setup prompt with your key already inserted — paste it into your AI client and it does the steps below for you.

2. Configure your AI client

Add this block to your client's MCP config, with your real key in place of the placeholder:

{
  "mcpServers": {
    "sayver": {
      "command": "npx",
      "args": ["-y", "@sayver/mcp"],
      "env": { "SAYVER_API_KEY": "sayver_sk_your_real_key" }
    }
  }
}

Where that config file lives, per client:

• Claude Desktop — Settings → Developer → Edit Config, or edit the file directly: %APPDATA%\Claude\claude_desktop_config.json on Windows, or ~/Library/Application Support/Claude/claude_desktop_config.json on macOS.
• Cursor — Settings → MCP → Add, or edit ~/.cursor/mcp.json directly.
• Continue, Windsurf, Codex CLI — each has its own MCP settings section using the same JSON shape.

If the file already lists other MCP servers, add "sayver" as another entry inside the existing mcpServersobject — don't overwrite the others.

3. Restart your client

Fully quit and reopen the app (not just close the window). On launch it spawns the Sayver server and discovers its tools automatically. You should see Sayver listed under the client's tools/MCP indicator.

4. Ask your agent

You don't call tools by name — just describe what you want and the AI picks the right one:

• “List my Sayver projects” → list_projects
• “Scan staging.myapp.com with Sayver” → run_scan
• “Show me the results of that scan” → get_scan_results
• “Dismiss that finding, it's a false positive” → dismiss_finding

A typical flow: “Scan example.com” → wait a few seconds → “Show me the findings” → “Give me the fix prompt for the top one.”

The 9 tools

• run_scan — start a scan by project id or URL; kind is site (default), code (needs a connected GitHub repo), or legal.
• get_scan_results — a scan and its findings (full detail on paid plans; counts-only + locked on free).
• list_scans — scan history for a project.
• list_projects — every project in your workspace.
• get_project — one project's metadata.
• update_project— edit project metadata (name, alerts, environment; the URL itself isn't editable via the API).
• dismiss_finding — mark a finding a false positive / non-issue.
• restore_finding — undo a dismissal.
• list_dismissals — list findings by status (dismissed, open, fixed, all).

Troubleshooting

“SAYVER_API_KEY is not set”

The envblock is missing or misspelled in your config, or the client wasn't fully restarted after you saved the change.

401 / “Invalid or missing API key”

The key is wrong or has been revoked. Generate a new one from Dashboard → API & MCP.

“Verify the project's domain before scanning”

Verify the project's domain in the dashboard first — scans require proven ownership.

Tools don't appear in your client

The client didn't fully restart, or the config JSON has a syntax error (a stray comma or brace). Validate the JSON and restart again.

Findings come back locked / counts-only

That's the free-plan paywall on finding detail — upgrade for full detail and fix prompts.