FYEO Security Scanner · MCP

FYEO MCP Server

Bring security review into your conversations with Claude, ChatGPT and other MCP clients. Get scan estimates, follow progress and review findings without leaving your assistant.

Connect your FYEO account Explore the Scanner

What it does

The FYEO MCP connector lets Claude and other AI assistants that support MCP work with your FYEO Scanner account. Your assistant can check what a scan costs, run security audits of your repositories, follow their progress, and read reports and findings, all from a chat.

Connector URL

https://mcp.fyeo.io

(Streamable HTTP with OAuth sign-in. No API key needed.)

Before you start

You need a FYEO account: sign in with GitHub at https://scanner.fyeo.io. Scans use the account's credits and need an active free trial or plan.
Connect with the account owner's login. Team members can browse scans and findings, but prices, scans and reports need the owner.
The repository must be public on GitHub, or private and connected through the FYEO GitHub App at https://scanner.fyeo.io/repos.
Reading needs no extra setting. Queueing and cancelling scans, and turning automatic PR scanning on, need the AI-apps switch, which is off by default. The account owner can turn it on under Account → API access, or tick it on the approval screen when connecting.

Connect

Claude (claude.ai and Claude Desktop)

Open Settings → Connectors → Add custom connector.
Name it "FYEO" and enter https://mcp.fyeo.io.
Click Connect, sign in to FYEO and click Approve.

On Team and Enterprise plans, an organisation owner may need to allow custom connectors first.

Claude Code

Run:

claude mcp add --transport http fyeo https://mcp.fyeo.io

Then type /mcp, choose fyeo and select Authenticate.

ChatGPT, Codex and other MCP clients

ChatGPT, Codex and other MCP clients: add https://mcp.fyeo.io as a remote MCP server (custom connector), then sign in to FYEO and approve.

What approving allows

Always: read repositories, scans, reports, findings and the credit balance; get price quotes; turn automatic PR scanning off; redeem a credit code you give it.
Only with the AI-apps switch on: queue scans, cancel scans that haven't started, and turn automatic PR scanning on.
Never: billing, team members, API keys or other account settings.

Queueing a scan reserves its quoted credits, which are used when the scan completes. Cancelling a queued scan, or a scan failing, releases them. While automatic PR scanning is on, each pull request scan uses credits like a PR audit.

You can disconnect at any time under Account → API access → Connected apps → Revoke.

What your assistant can do

Tool	What it does	Uses credits
`list_repos`	Lists your repositories, including whether automatic PR scanning is on	No
`list_scans`	Lists your scans, newest first, by repository or status	No
`get_scan`	One scan's status and how many findings it has by severity	No
`get_report`	A finished scan's summary, threat model and severity counts	No
`list_findings`	The findings of a scan, filterable by severity	No
`get_finding`	One finding in detail, with the affected code and how it can be exploited	No
`get_usage`	Your credit balance and plan	No
`estimate_scan`	The exact price of a scan, as a quote valid for 30 minutes	No
`queue_scan`	Queues a scan from a quote and reserves the quoted credits. It never costs more than the quote.	Yes
`cancel_scan`	Cancels a scan that hasn't started yet and releases its reserved credits.	Refund
`set_pr_scanning`	Turns automatic PR audits on or off for a repository connected through the FYEO GitHub App. While on, each pull request into the default branch (not from forks) is scanned and uses credits like a PR audit. Turning it on doesn't start a scan by itself.	Yes, each pull request is billed as a PR audit while it's on
`redeem_credit_code`	Adds a credit code you give it to your balance. The account needs a contact email.	Adds credits

Your assistant asks you before it runs anything that spends credits or cancels a scan.

How a scan works

Your assistant estimates the scan and tells you the price.
After you agree, it queues the scan from that quote.

Small pull request scans often finish within minutes; full audits take about 35 minutes for smaller repositories and over an hour for large ones. Ask your assistant for the status at any time, or come back later for the results. FYEO emails you when a scan finishes, depending on your notification settings. Failed scans release their credits automatically.

Findings are produced automatically. They can miss issues or include false positives, and they are not a substitute for a manual security audit.

Example prompts

"Which of my FYEO repositories haven't been scanned this month?"
"What would a full audit of acme/vault cost?"
"Run a full audit of acme/vault and wait for the results."
"Summarise the critical and high findings from my latest scan of acme/vault."
"Audit pull request #42 in acme/vault."
"Turn on automatic PR scanning for acme/vault."

Data and privacy

FYEO receives only the requests your assistant makes (for example which repository to estimate), not your conversation. What your assistant reads from FYEO, such as findings that quote parts of your code, is sent to the AI provider you use and is handled under that provider's terms. FYEO records which tools are called and whether they succeed, to run the service. You can disconnect your assistant at any time under Account → API access; its access stops immediately. Read our Privacy Policy.

Limits

60 requests per minute per connected app.
3 scans running or queued per account at a time.
Price quotes are valid for 30 minutes.

Troubleshooting

Message	What to do
ai_apps_queue_disabled	Switch on "Let connected AI apps queue and cancel scans and turn on PR scanning" under Account → API access → AI apps.
insufficient_credits	The account doesn't have enough credits for this scan. The error shows the balance and the credits needed.
trial_ended	The free trial has ended and the account has no active plan. Remaining credits alone don't allow new scans.
email_required	Redeeming a credit code needs a contact email on the account. Add one at https://scanner.fyeo.io/account (Notifications → Contact email), then try again.
repo_not_available	The repository isn't public; connect it through the FYEO GitHub App at https://scanner.fyeo.io/repos.
price_changed	The price changed since the quote; your assistant shows the new price to confirm.
quote_expired	Quotes last 30 minutes; ask for a new estimate.
too_many_active_scans	Wait for a scan to finish, or cancel one that hasn't started.
not_account_owner	Connect with the account owner's FYEO login.
Sign-in fails, or the connector stops working	Remove the connector and add it again with `https://mcp.fyeo.io`. Connectors added with an older address need to be re-added.

Help

Email hello@fyeo.io or use our contact page.

For developers: the full API reference is at https://scanner.fyeo.io/docs/api.md, and a guide for AI agents at https://scanner.fyeo.io/llms.txt.

Talk to our team