# Shypset

> Shypset is an external security check for AI-built apps (Lovable, Bolt, v0, Replit, Cursor and others). Paste a URL: 100+ non-intrusive checks for leaked API keys in the JavaScript bundle, open data, security headers, TLS, DNS and email, with a fix prompt for every issue that your AI tool can apply. It is a passive external check: application logic (SQL injection, IDOR) is not tested.

## API

- [API docs](https://www.shypset.com/docs/api): REST API v1. Start a scan (POST /v1/scans), poll it (GET /v1/scans/{id}), get a fix prompt (GET /v1/scans/{id}/fix-prompt) and the scan history (GET /v1/scans). Personal API key of the account (Settings -> API keys), sent as `Authorization: Bearer $SHYPSET_API_KEY`; the account's plan limits apply, Free included. Server-side only, no CORS.
- [OpenAPI 3.1 spec](https://www.shypset.com/openapi/v1.yaml): machine-readable contract of the same API.
- [MCP server](https://www.shypset.com/docs/api#mcp): remote MCP server (Streamable HTTP) at https://dqyrveqnsggmckcabgmm.supabase.co/functions/v1/api-v1/mcp with the tools scan_url, get_report, get_fix_prompt and list_scans; same API key, plan limits and answers as the REST API. Claude Code: `claude mcp add --transport http shypset https://dqyrveqnsggmckcabgmm.supabase.co/functions/v1/api-v1/mcp --header "Authorization: Bearer $SHYPSET_API_KEY"`.

## Docs

- [What we check](https://www.shypset.com/checks): the most important checks explained.
- [Security by platform](https://www.shypset.com/security): common problems of apps built with each AI builder.
- [Pricing](https://www.shypset.com/pricing): Free, Launch Pass and Pro.
- [About the scanner](https://www.shypset.com/scanner): for site owners who see ShypsetScanner in their logs.