Scan free

Connect

Connect an AI Agent to Sekura

From Claude Code, Cursor, Copilot, Codex and Muse.

Sekura works from the tool you already code in. A connected tool does what your dashboard does: finds the repositories Sekura can scan, starts a scan, follows it, reads what it found with the proof, subscribes a repository to Sekura Always, and cancels.

  • Sign in with GitHub, no key to copy
  • Quoted before anything is charged
  • The same prices as the dashboard
Connect your coding toolConnect Meta Muse →

Claude Code, Cursor, GitHub Copilot, OpenAI Codex and nearly forty other tools connect as an MCP server; Meta Muse through the REST API. Nothing is started or charged until you have agreed to it in the conversation.

Sekura — owl-in-shield mark

The fastest way in

One command connects every tool on your machine.

Run it once. It finds the coding tools you have, shows you what it would write, signs you in once in your browser, connects them, and installs the skill that teaches the agent to quote before it scans. Nothing to copy, no key to paste.

npx sekura@latest init
  1. Detects your coding tools. It looks for the tools listed below by their configuration folders and commands. Nothing is written yet.
  2. Asks one question. Connect every tool it found, for every project, with the skill, and sign in? Yes, No, or Edit, which opens the list of tools, the scope (every project, or this project only), the skill and the sign-in.
  3. Shows the plan. Every file it would write and the exact entry, or the tool's own command, with your key shown as Authorization: Bearer <your key, after sign-in>. Nothing happens until you answer Apply. --dry-run stops here.
  4. Signs you in once. In your browser: sign in with GitHub on sekura.ai and approve. On a machine with no browser of its own (SSH, a devcontainer, Codespaces, or with --device) it shows a code to enter at sekura.ai/connect/device from any other device.
  5. Applies it, and the skill. One entry named sekura in each chosen tool, in that tool's own shape and with your key, plus the sekura skill that teaches the agent to quote before it scans. It says what each step did. A file with comments, such as Zed's settings, is never rewritten: you get the lines to add. Codex and Devin cannot take a key in their configuration, so it runs their own mcp login, one click with your browser already signed in.
  6. Checks the server answers. It asks the Sekura server to answer before it tells you anything works.
  7. Gets you to a first scan. It says what your account still needs, the Terms or a verified email, and waits while you do it in the browser. It offers to install the Sekura GitHub App and waits until the repository shows up. Then you pick a repository, the current folder's first. It starts no scan.
  8. Tells you what to do next. Each tool's next step (restart Cursor; start a new Claude Code session, then type /sekura) and what to type to scan. Every scan is quoted first and starts only after you agree.

It connects Claude Code, GitHub Copilot in VS Code, OpenAI Codex, Cursor, Antigravity, Kiro, Zed, JetBrains Junie, Tabnine CLI, Devin Desktop and the Devin CLI, OpenCode, Goose, Cline and Factory Droid.

Already connected? Run it again to add a tool or refresh the skill: it changes nothing that is already right. npx sekura@latest status shows what is connected and who is signed in; npx sekura@latest login signs in again and gives the connected tools the new key; npx sekura@latest logout deletes the saved key; npx sekura@latest uninstall removes the entries, the skill, the guidance block and the saved key, and nothing else; npx sekura@latest billing lists your saved cards, masked, and --open opens the payment methods page.

Options. --yes, --dry-run, --scope project, --tools claude,cursor, --no-skill, --no-login, --device. For an unattended install, with a key from Settings → Agents and API keys: SEKURA_API_KEY=sek_live_… npx sekura@latest init --yes.

What the connector does

It reads what your Sekura dashboard shows you:

  • your account, and what it still needs before a scan can run, such as the Terms or the Sekura GitHub App;
  • the repositories you granted the Sekura GitHub App, which are the ones Sekura can scan;
  • each repository’s plan, Sekura Once or Sekura Always, with its schedule and last scan;
  • your scans, their status, a summary of what each found, and the link to its full report;
  • your billing: the card on file by brand and last four digits, your Always subscription, and this month’s charges.

It acts, each time only after you have agreed (how):

  • start a Sekura Once scan, or scan again a repository already on your dashboard;
  • subscribe a repository to Sekura Always on the schedule you choose, or move one from Once to Always;
  • change when an Always repository is scanned;
  • cancel Sekura Always on a repository, from the end of the period already paid for;
  • cancel a scan in its first five minutes, as Cancel on the dashboard does.

Each of these uses the same functions your dashboard uses, so a tool cannot see or do anything the dashboard would not let you. It cannot see anything you have not granted (repositories without the Sekura GitHub App, other people’s scans, card numbers or API keys), and it cannot grant a repository: that is GitHub’s install screen, which the tool links you to.

What you need

  • A Sekura account. Signing in with GitHub creates one; accept the Terms when Sekura asks. GitHub supplies the verified email address reports are sent to.
  • The Sekura GitHub App installed on the repositories you want scanned. Each must not be empty.
  • For Muse, a Meta Muse account; for a coding tool, the tool itself, connected as its panel above shows.
  • For a scan or Sekura Always, one way to pay: a card already saved on your Sekura account, or, without one, a Stripe Checkout link the tool gives you. In Meta Muse only, you can also approve the amount in the chat and Link pays it; no coding tool asks for that. Every scan through a connected tool is quoted at the dashboard’s price before anything is charged.

Limits

  • 120 requests a minute per connection.
  • 10 confirmed actions an hour per account: starting a scan, subscribing, changing a schedule or cancelling. Asking for a quote or a preview does not count.
  • 30 connection attempts an hour from one network address; a connect link works for 10 minutes.
  • Over a limit, the answer is 429 Too Many Requests with a Retry-After header giving the seconds to wait.
  • A request body over 64 KB is refused with 413.
  • One scan runs at a time per account; the others wait their turn.

Data handling

The API answers a tool with what your Sekura dashboard shows you, for your account and the repositories you granted the Sekura GitHub App only: your name and email, what your account still needs before a scan can run, your repositories and plans, your scans’ status and metadata, a summary of each scan’s findings (severity, title, file and a one-line description), a link to the full report, and the brand and last four digits of a saved card. The full report stays on sekura.ai behind your sign-in.

Card details never pass through Sekura, Muse or your tool. When Link pays, Stripe holds the card and Muse hands Sekura a payment token limited to the amount you approved; a saved card and a Checkout payment stay with Stripe as they do on the dashboard.

What Muse does with those answers is governed by Meta’s terms, and what a coding tool does with them by its vendor’s. What Sekura does with your data is in the privacy policy and the terms of service; a scan a tool starts is authorized and recorded on the same terms as one you start on sekura.ai.

For developers: the REST API

  • Base URL: https://sekura.ai/api/muse/v1. JSON in and out.
  • OpenAPI 3.1: https://sekura.ai/api/muse/v1/openapi.json, readable without a key. It is the reference for every schema.
  • Authentication: Authorization: Bearer sek_live_… on every call except connecting and the OpenAPI document.
  • Errors: { code, error, link } — a code to branch on, one sentence for the person, and a link to where they take the next step.
  • 401 no key, or a revoked one; 403 a scope is missing, and the error names it; 402 payment is needed, and link is a Stripe Checkout page; 409 the amount or the authorization text changed since the quote, and the body carries the new quote; 429 with Retry-After.

Scopes

ScopeWhat it permits
readreading your account, the repositories you granted the Sekura GitHub App, your plans, your scans, their findings and report links, and your billing summary.
writeasking for a price and then starting a Sekura Once scan, subscribing a repository to Sekura Always, changing its schedule, cancelling Always and cancelling a scan. Every one of them first shows you what it will do and what it costs, and is paid only in the way you agreed to: approved in the Muse chat, your saved card, or a Stripe Checkout page.

Connecting

The device-authorization pattern: no redirect URL, and the person never handles the key. Show the person the link; poll with the code, no faster than interval. Polling answers authorization_pending, slow_down, access_denied or expired_token until the person approves, then the key exactly once.

POST https://sekura.ai/api/muse/v1/connect
→ { "code": "…", "verificationUrl": "https://sekura.ai/…", "expiresIn": …, "interval": … }

POST https://sekura.ai/api/muse/v1/connect/token      (with the code, every interval seconds)
→ { "code": "authorization_pending", … }   the person is still on the page
→ { "apiKey": "sek_live_…", "scopes": ["read", "write"] }   once

Quote, then confirm

Every call that charges, authorizes or stops something has a GET quote or preview that changes nothing, and a POST that repeats what the quote said. Show the person the quote before you confirm it.

GET  https://sekura.ai/api/muse/v1/scans/quote?repository=your-org/your-repo
→ the amount, how it would be paid, the authorization text and its version

POST https://sekura.ai/api/muse/v1/scans
{ "repository": "your-org/your-repo",
  "disclosureVersion": "…",          repeated from the quote
  "amountCents": …,                  repeated from the quote
  "payment": { "sharedPaymentToken": "spt_…" } }
  or  "payment": { "savedCard": true }
  or  no payment: 402 with a Stripe Checkout link

Operations

CallScopeWhat it does
POST /connectnoneStarts connecting: answers a code for the agent to poll with and a link for the person to open.
POST /connect/tokennonePolls with the code until the person has approved, then answers the API key, once.
GET /accountreadName and email, whether the Terms are accepted, the GitHub App’s installations, a billing summary without card details.
GET /repositoriesreadThe repositories granted to the Sekura GitHub App, per installation, marked private or empty.
GET /plansreadEach repository’s plan, Sekura Once or Sekura Always, with its schedule and last scan.
GET /scansreadYour scans, newest first, 1 to 20 at a time.
GET /scans/{id}readOne scan: status, phase, findings by severity, where the report was sent.
GET /scans/{id}/findingsreadCounts by severity and the most severe findings, each with title, file and one line.
GET /scans/{id}/report-linkreadThe link to the full report on sekura.ai, while the report is kept.
GET /billingreadThe card on file by brand and last four, the Always subscription, charges this month.
GET /scans/quote?repository=writeThe price of a Sekura Once scan, how it would be paid, and the authorization text with its version. Changes nothing.
POST /scanswriteStarts the scan the quote described, repeating its amount and version.
POST /scans/run-nowwriteBrings forward the next scheduled scan of a repository on Sekura Always; the schedule continues from the slot after it. Charges nothing and records no new authorization.
GET /always/quote?repository=&schedule=&tier=writeFor the plan chosen (always, plus or pro; always if none is given): the monthly price, any free trial, the schedule in words, how it would be paid, and the authorization text. Changes nothing.
POST /alwayswriteSubscribes the repository on the plan the quote described, or moves it from Once to Always.
PATCH /plans/{id}/schedulewriteChanges when an Always repository is scanned. Charges nothing; one call.
GET /plans/{id}/cancel-previewwriteNames the repository and the date its scans would stop. Changes nothing.
POST /plans/{id}/cancelwriteCancels Sekura Always at the end of the period already paid for.
GET /scans/{id}/cancel-previewwriteWhether the scan can still be cancelled, and whether cancelling is certain. Changes nothing.
POST /scans/{id}/cancelwriteCancels the scan in its first five minutes.
GET /openapi.jsonnoneThe OpenAPI 3.1 document for every operation above.

Aider and Jules

Neither can connect to an MCP server, so neither gets a Sekura connector.

  • Aider has no MCP support. Copy the findings you want fixed from the report on sekura.ai into a file and give it to Aider with aider --read findings.md. Each finding names its file, which is what Aider needs to find the code.
  • Jules connects only to servers Google has chosen. A section like the one below in the repository’s AGENTS.md tells Jules how to treat a task that names a Sekura finding. Never put a Sekura key in AGENTS.md: it is committed with the repository.
## Security findings

Sekura scans this repository. When a task names a Sekura finding, the
finding's file and line are in the task; fix it there and keep the fix to
that finding. Sekura's API is documented at https://sekura.ai/connect/#developers.

Amazon Q Developer and Gemini Code Assist

  • Amazon Q Developer takes no new sign-ups, and its support ends on 30 April 2027. Kiro, its successor, copies Q Developer’s MCP configuration when you move, so follow Kiro.
  • Gemini Code Assist and Gemini CLI have been replaced by Antigravity; follow Antigravity. Where Gemini Code Assist Standard or Enterprise is still in use, its agent mode reads ~/.gemini/settings.json. It cannot sign in, so it needs a key, and it reads httpUrl where Antigravity reads serverUrl.
{
  "mcpServers": {
    "sekura": {
      "httpUrl": "https://sekura.ai/mcp",
      "headers": {
        "Authorization": "Bearer sek_live_…"
      }
    }
  }
}

Example prompts

  • Which of my repositories can Sekura scan?
  • Run a Sekura scan on your-org/your-repo.
  • Is my Sekura scan of your-org/your-repo finished yet?
  • What did my last Sekura scan find? Summarise the critical and high findings.
  • Give me the link to the full report for that scan.
  • Subscribe acme/shop to Sekura Always every Monday at 02:00.
  • Cancel the scan that just started.
  • Move my Always scan of acme/shop to Fridays.

Help

  • Write to support@sekura.ai with the time and what you asked the tool. Never send an API key.
  • The support icon on any sekura.ai page opens an agent that can read your account’s situation and help you get unstuck.
  • If you think a connection or a key has leaked, remove it in Settings → Agents and API keys first, then write to us.