Your AI writes the code. Now it sees what broke.
ecoa exposes a remote MCP server. Connected to Claude, Cursor or your own agent, it stops answering about security from memory and starts running the analysis against your actual site, handing back the fix step by step.
https://mcp.ecoa.dev/api/mcp
The agent is great at writing. It is blind after the deploy.
It generated the route, the form and the middleware. But it does not know your Content-Security-Policy is permissive, that a table in your database is open to anyone, that your domain's SPF lets anybody send email in your name. None of that shows up in the file it just opened.
So you paste a scanner screenshot into the chat, it guesses a generic fix, and weeks later you find out the fix broke something else. What is missing is the agent being able to look at the app while it runs.
No account: public check
A separate address, /api/mcp/public, that asks for no login at all. It unlocks the domain check: HTTP headers, TLS, DNS, email authentication (SPF/DKIM/DMARC) and SEO/AEO. Your AI gets the issues counted by severity and, for each front, the worst finding with the evidence observed. No signup, no card.
claude mcp add --transport http ecoa-publico https://mcp.ecoa.dev/api/mcp/publicWith login: all 25 tools
On the main address, the first connection opens your browser so you can sign in to your ecoa account and approve. There is no key to generate or paste. That unlocks the full catalog: run the technical and privacy analysis, read the evidence behind each finding, get the curated remediation plan, verify domain ownership, analyse the logged-in area, read feedback and publish versions.
See my connections →What your AI can actually do now
There are 25 tools. In practice, six conversations and a seventh that does not even ask for an account.
See your apps
List what you have registered, open the details, register a new version and upload a mobile package.
list_appsget_appcreate_app_version+1Run the technical analysis
Kick off the scan, follow every step, read the prioritised problems and ask for the fix plan for one of them.
get_analysis_setuprun_analysisget_analysis_run+3Unblock the analysis
Prove the domain is yours (the agent writes the validation file itself) and generate the login-capture link for whoever holds the test account.
get_ownership_challengeverify_ownershipcreate_login_capture_link+1Read the feedback
The summary of what testers said, the full list, the apps you can review and your points.
get_feedback_summarylist_feedbackslist_reviewable_apps+3Leave the analysis running on its own
Save what the analysis does, schedule it by day of the week and generate the trigger for your CI. The agent writes the GitHub Action YAML and puts it in the repository.
list_scan_automationcreate_scan_configcreate_scan_triggerInstall the widget
Fetch your key, build the snippet and paste it in the right place, then read the answers split by label.
get_widget_setuplist_widget_feedbacksNo account at all
Three tools on a separate endpoint: any agent can check a domain's public security posture without logging in.
check_site_securityget_site_security_checkhow_to_connect_ecoaInstall
Pick your assistant and copy. The blocks below work as they are. On first connect the client opens your browser so you can sign in and approve.
One command in the terminal, in your project folder. If the browser does not open on its own, run /mcp inside Claude Code and choose to authenticate.
claude mcp add --transport http ecoa https://mcp.ecoa.dev/api/mcpAlternative: API key
In a browser-less environment (server, CI), generate a key on your MCP page and add the header to the same config; access is identical to the login. The key is shown only once.
{
"mcpServers": {
"ecoa": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://mcp.ecoa.dev/api/mcp", "--header", "x-api-key:SUA_CHAVE_AQUI"]
}
}
}What your AI can then do
The 25 tools available after signing in (or with an API key). The public address exposes only the domain check.
| Tool | What it does |
|---|---|
| list_apps | Listar todos os aplicativos do usuário. |
| get_app | Ver detalhes e resumo de IA de um aplicativo. |
| get_feedback_summary | Ver resumo IA dos feedbacks. |
| list_feedbacks | Listar feedbacks recebidos do aplicativo. |
| get_analysis_setup | Ver o que a análise técnica pergunta antes de rodar. |
| run_analysis | Simula ou dispara a análise técnica (segurança, LGPD, domínio). |
| get_technical_analysis | Ver o resultado acumulado da análise técnica do app. |
| list_analysis_runs | Listar o histórico de execuções da análise técnica. |
| get_analysis_run | Acompanhar/ver o detalhe de uma execução da análise. |
| get_finding_fix | Ver o plano de correção curado de UM problema. |
| get_ownership_challenge | Obter o desafio que prova que o site é do usuário. |
| verify_ownership | Conferir se o desafio de titularidade já está no ar. |
| create_login_capture_link | Gerar um link de uso único para alguém capturar um login. |
| revoke_login_capture_links | Cancelar links de captura de login ainda em aberto. |
| get_points | Ver os pontos acumulados do usuário. |
| list_reviewable_apps | Listar apps que o usuário pode avaliar (ecoar). |
| list_consulting_plans | Listar planos de consultoria com especialistas. |
| create_app_version | Libera nova versão arquivando anterior. |
| submit_feedback | Enviar um eco (avaliação) sobre um app da comunidade. |
| get_widget_setup | Gerar o snippet de instalação do widget de feedback do site. |
| list_widget_feedbacks | Listar feedbacks enviados pelo widget embarcado no site. |
| list_scan_automation | Ver as configurações salvas, os gatilhos e quantos disparos ainda cabem. |
| create_scan_config | Salva com um nome o que a análise deve rodar, para gatilhos reutilizarem. |
| create_scan_trigger | Agenda a análise por dias da semana, ou cria o gatilho de API para o CI. |
| upload_app_package | Faz o upload de um executável local (.apk ou .zip/.ipa) para a Caverna. |
Ask like this
- Is my site secure? Check https://mysite.com with ecoa.
- Run the ecoa check on my site and tell me what is most urgent to fix.
- Take the first issue from the ecoa analysis, show me the remediation plan and apply it to my project.
- Create the ecoa domain ownership file in my project and verify it.
- Run the full technical analysis of my app on ecoa, including the logged-in area.
Frequently asked questions
Do I need an ecoa account to connect?+
For the public check, no: the /api/mcp/public address asks for no login. For every other tool, yes: the first connection to the main address opens your browser so you can sign in and approve. The account is free and unlocks the full technical evidence behind each finding; a paid plan unlocks the step-by-step fix.
Can I check a site that isn't mine?+
The public check, yes: it only observes what any visitor already sees (headers, certificate, DNS, email records) and makes no intrusive requests. That is why the anonymous result comes with reduced technical evidence. The tool is not meant for reconnaissance on someone else's site. Intrusive testing (pentest, dynamic BaaS) requires verified domain ownership and explicit acceptance of the terms.
Are there limits?+
The public check is capped at 8 runs per hour per origin, and the result for a given domain is cached for 24 hours. With an account, what the plan defines is quantity: registered apps, pages per crawl, logins per analysis and analyses per month. No tool is ever blocked by plan.
Does this replace a pentest?+
No. The public check is passive and is a snapshot of what was observable at the moment it ran, not a certificate or a guarantee of security. ecoa does have an authenticated pentest (Nuclei, ZAP, sqlmap, content discovery), but it only runs against a domain whose ownership you have proven, with explicit acceptance of the intrusive-testing terms.
Will the AI ask for my password?+
Never. To analyse the logged-in area, ecoa generates a single-use link that whoever holds the test account opens in their own browser and logs in once. If an assistant asks for your password in chat, don't answer.
Two minutes for your agent to see production
Create the account, run the command, approve it. The analysis runs on the free plan, no card needed.