Penthera in your coding tool

Starter. For “I build with Cursor, Claude Code, Lovable or another AI tool: how do I add Penthera?”

Penthera runs on your machine. Pick your tool below. There are three ways in:

Your coding agent calls it through the MCP server (npx -y penthera@2.0.0 mcp). This works in tools that run on your computer.
You run it in a terminal, or in CI with the GitHub Action.
You check the live app on penthera.org. It’s passive, nothing is stored, and it only needs a URL. This is the route for browser-only app builders.

The MCP tools only read your project, never apply fixes, run no shell and send no attack payloads. scan_url reaches loopback only, unless you add "--allow-host", "app.example.com" to args, and only for a host you’re allowed to test. Details: the MCP server. The commands below pin a version on purpose: an update never reaches you unless you change the pin.

Coding agents and editors

Tool	Where the config goes	Docs
Claude Code	`claude mcp add` (project scope writes `.mcp.json`), or the plugin	MCP
Cursor	`.cursor/mcp.json`	MCP
VS Code (Copilot agent mode)	`.mcp.json` at the workspace root, or `.vscode/mcp.json`	MCP configuration
OpenAI Codex	`codex mcp add`, or `.codex/config.toml`	MCP
Gemini CLI	the extension, or `.gemini/settings.json`	MCP servers
Google Antigravity	`.agents/mcp_config.json`	MCP
Windsurf (Devin Desktop)	`mcp_config.json`	MCP
Cline	`cline_mcp_settings.json`	Configuring MCP servers
Zed	`context_servers` in `settings.json`	MCP
JetBrains AI Assistant	Settings, Tools, AI Assistant, Model Context Protocol	MCP
JetBrains Junie	`.junie/mcp/mcp.json`	MCP
Kiro	`.kiro/settings/mcp.json`	MCP configuration
Continue	`.continue/mcpServers/penthera.yaml` (agent mode)	MCP

Claude Code

claude mcp add --scope project penthera -- npx -y penthera@2.0.0 mcp

Or install the plugin (the skill plus the pinned server) from Claude Code’s prompt: /plugin marketplace add danoszz/penthera, then /plugin install penthera@penthera.

Cursor, Windsurf, Cline, Antigravity, Kiro, Junie, JetBrains, VS Code (`.mcp.json`)

All of these read the same shape:

{
  "mcpServers": {
    "penthera": {
      "command": "npx",
      "args": ["-y", "penthera@2.0.0", "mcp"]
    }
  }
}

One .mcp.json at the root of your repo serves Claude Code and VS Code together. Windsurf’s file path changed when it became Devin Desktop: check your build’s MCP settings for where it reads mcp_config.json.

VS Code, older format (`.vscode/mcp.json`)

{
  "servers": {
    "penthera": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "penthera@2.0.0", "mcp"]
    }
  }
}

OpenAI Codex

codex mcp add penthera -- npx -y penthera@2.0.0 mcp

Gemini CLI

gemini extensions install https://github.com/danoszz/penthera

Gemini CLI now needs a paid API key or an Enterprise licence. Google moved free use to Antigravity, which uses the JSON above.

Zed (`settings.json`)

{
  "context_servers": {
    "penthera": {
      "command": "npx",
      "args": ["-y", "penthera@2.0.0", "mcp"],
      "env": {}
    }
  }
}

Continue (`.continue/mcpServers/penthera.yaml`)

name: Penthera
version: 0.0.1
schema: v1
mcpServers:
  - name: penthera
    command: npx
    args: ["-y", "penthera@2.0.0", "mcp"]

App builders (Lovable, Bolt, Base44, Replit, v0)

These run in the browser and only accept MCP servers by URL. Penthera’s server runs on your machine, so it can’t be added there. That’s deliberate: your code stays local. Two routes work instead:

Builder	1. Check the live app	2. Scan the code
Lovable	paste your `*.lovable.app` URL into penthera.org	connect GitHub (two-way sync), clone, `npx penthera@2.0.0 --repo .`
Bolt.new	the published URL into penthera.org	GitHub sync, then the CLI or the Action
Base44	the published URL into penthera.org	GitHub sync (Builder plan and up), clone, the CLI
Replit	the deployed URL into penthera.org	in the Shell: `npx penthera@2.0.0 --repo .` (needs Node.js 22 or later)
v0	the production URL into penthera.org (preview links can sit behind a Vercel login)	connect GitHub and add the Action to the pull requests v0 opens

Once the code is on GitHub, the Action checks every pull request: dependencies, AI-tool config and the code. See the Action and a ready workflow. Mobile builders (Rork and similar) usually have no web URL. Sync to GitHub and scan the repository.

Limits

Browser-only builders: they can’t run Penthera’s MCP server, because it needs a local process.
Live check: penthera.org checks one public page and up to 8 of its scripts. It’s passive and doesn’t log in.
Configs in these tools change often. Each link above goes to the tool’s own docs. If a path moved, the tool’s docs win.

I'm new

I use AI coding tools

I run it in CI

Evidence for an auditor

Research and method

Compared

The project

Integrations

Penthera in your coding tool

Coding agents and editors

Claude Code

Cursor, Windsurf, Cline, Antigravity, Kiro, Junie, JetBrains, VS Code (`.mcp.json`)

VS Code, older format (`.vscode/mcp.json`)

OpenAI Codex

Gemini CLI

Zed (`settings.json`)

Continue (`.continue/mcpServers/penthera.yaml`)

App builders (Lovable, Bolt, Base44, Replit, v0)

Limits

​Penthera in your coding tool

​Coding agents and editors

​Claude Code

​Cursor, Windsurf, Cline, Antigravity, Kiro, Junie, JetBrains, VS Code (.mcp.json)

​VS Code, older format (.vscode/mcp.json)

​OpenAI Codex

​Gemini CLI

​Zed (settings.json)

​Continue (.continue/mcpServers/penthera.yaml)

​App builders (Lovable, Bolt, Base44, Replit, v0)

​Limits

Penthera in your coding tool

Coding agents and editors

Claude Code

Cursor, Windsurf, Cline, Antigravity, Kiro, Junie, JetBrains, VS Code (`.mcp.json`)

VS Code, older format (`.vscode/mcp.json`)

OpenAI Codex

Gemini CLI

Zed (`settings.json`)

Continue (`.continue/mcpServers/penthera.yaml`)

App builders (Lovable, Bolt, Base44, Replit, v0)

Limits