Using VIfix

MCP server

VIfix runs a local MCP server so your AI coding tools can scan code before they write it. Every tool is read-only.

Turn it on#

Open MCP Server
In the app sidebar, click MCP Server and switch the server on.
Allow folders
Add the project folders agents may scan. Home folders and drive roots can't be added.
Pick your client and copy the snippet
VIfix generates the exact command or JSON for your tool.

For Claude Code, run the command shown in the app. It looks like this:

terminal

claude mcp add vifix --scope user -- <path-to-vifix> --mcp-stdio

For Claude Desktop, Cursor and other clients, add the JSON snippet to their MCP config file, then restart the client:

json

{
  "mcpServers": {
    "vifix": {
      "command": "<path-to-vifix>",
      "args": ["--mcp-stdio"]
    }
  }
}

Tip

The app fills in the real path for your computer, so copy the snippet from the MCP Server page rather than typing it.

Tool	What it does	Counts as a scan
`scan_project`	Full scan of an allowed folder	Yes
`scan_code`	Checks a snippet the agent is about to write, without touching disk	No
`get_finding`	Vulnerable lines, why it matters, and the suggested fix	No
`list_rules`	The rule catalogue, filterable by code, migrations or database	No
`list_databases`	Saved connections (name, engine, host), never credentials	No
`audit_database`	Live database audit through the read-only path	Yes

Try asking your agent: “use VIfix to scan this project for security issues.”

The server listens on 127.0.0.1 only and requires a token stored in your OS keychain.
It checks Host and Origin headers, caps request size and rate-limits calls.
Agents get findings and fix text only. Database credentials never leave the app.