Magery Forge
mageryai/forgeMagery Forge is a security-audit engine for people who ship code fast and don't have a security team. It checks your website and turns raw scanner output into plain-English risks with concrete fixes — then delivers a weekly report to your inbox. Built for VibeCoders, indie hackers, and solo founders: you add a domain, Forge checks it, and you learn what's wrong in language you actually understand. No "Missing Strict-Transport-Security header" — instead, "Your site allows unencrypted connections; here's how to fix it." This MCP server exposes the same engine to your AI agent. Your agent in Cursor, Copilot, Claude, or OpenClaw can trigger scans and read reports without opening the UI — one engine, two ways in. What Forge checks: • Passive checks (run instantly): DNS, SSL/TLS, HTTP headers, SEO, AEO, Open Graph / social markup. • Active checks (unlock after domain verification): crawling, forms/CSRF, secret-leak scanning, outdated components. Every finding ships as a plain-English risk plus a concrete mitigation step — never just a red flag. Checks are non-destructive: Forge scans, it doesn't attack. How it works: 1. Add a domain and verify ownership (email or TXT). 2. Run passive checks instantly. 3. Unlock active checks by verifying the domain. 4. Read human-readable risks with fixes, or let your agent do it over MCP. 5. Get a weekly automatic report by email. Why it's cost-efficient: Forge runs on a purpose-built harness that optimizes token spend and needs no heavy dedicated server, so it stays far cheaper than asking a general-purpose agent to audit a site from scratch. Use cases: • Pre-release security check • Weekly automated security monitoring • Agent-driven security scanning (MCP) • Clearing a shipped product of common vulnerabilities before users hit them Endpoint: https://forge.magery.ai/mcp Free while in beta — Pro plan launches later. Feedback from fast-shipping builders is welcome.
Score: 100/100
Handshake verified by our own probe.
Tools · 6
List every domain registered on your account. Takes no arguments. For each domain, returns its id, its name, when it was added, whether it has proven ownership by email verification or by …
Look up one domain on your account by its id. Requires domain_id, the id of a domain previously returned by list_domains. Returns the same fields list_domains does, for that one domain. A…
List security audits run on your domains, newest first. Every argument is optional. domain matches domains whose name contains the given text. date_from and date_to (each a calendar date) bou…
Start a new security audit on one of your domains. Requires domain_id, the id of a domain on your account that is active for checks. Runs every check your plan grants for whatever the domain …
Check the progress of an audit, cheaply. Requires audit_id, the id returned by start_audit or list_audits. Returns just the audit's current status ("new", "in_progress", "done", or "error…
Get the full results of one audit. Requires audit_id, the id returned by start_audit or list_audits. Returns the audit's status, overall result and score, an overview description and top-…
How to use
Claude Desktop or claude.ai: add a custom connector (Customize → Connectors; on Team and Enterprise plans an owner adds it under Organization settings → Connectors) with this server URL: https://forge.magery.ai/mcp
Cursor or Cline: add to your MCP config:
{
"mcpServers": {
"magery_forge": {
"url": "https://forge.magery.ai/mcp",
"transport": "http"
}
}
}