Jikida MCP

Jikida.io The hosted AI pentester for people who ship — not just security engineers.

Pentest your live app, scan your repo, protect it with a WAF, and watch its uptime. One account. No Docker, no LLM key, free tier.

Why it beats Nuclei / Strix / Shannon ↓ · Install · MCP · SDKs · Compare

Install it, scan it, or plug it into your AI editor:

npx @jikida/init      # add the SDK + protection to your app in 30 seconds

npx @jikida/scan # pentest any site or repo from your terminal npx -y @jikida/mcp # security tools inside Claude Code, Cursor, Windsurf

██ ██ ██ ██ ██ █████ ████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ████ ██ ██ ██ ██████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ███ ██ ██ ██ ██ █████ ██ ██ pentest · repo scan · uptime · alerts https://jikida.io

→ scanning example.com … ✓ 41 checks · grade B (88/100)

CRITICAL Exposed .env file /.env CWE-538 CRITICAL Stripe secret key in JS /app.js:1204 CWE-312 HIGH Missing Content-Security-Policy CWE-693 MEDIUM Cookie without Secure flag session CWE-614

Every finding has a fix. Full report: https://app.jikida.io

Pentest & scan for developers, AI IDEs & vibe coders

Pentest and scan websites, web apps, code and GitHub for vulnerabilities and exposed keys. Secure vibe-coded apps, monitor uptime, SSL and domains, and rate-limit APIs. One platform.

Website & app pentest · Code & repo scan · Deep pentest · MCP for AI IDEs · Agentic & vibe-coded security · SDKs

---

Jikida.io is a developer-first security platform. The core is pentest and scanning: it pentests your live website and app, scans your code and connected GitHub/GitLab/Bitbucket repos for exposed secrets and vulnerable dependencies, runs a deeper authenticated pentest, and plugs into your AI IDE (Claude Code, Cursor, Windsurf) over MCP so it guides agentic and vibe-coded work to write secure code and catches mistakes before they ship. Uptime, SSL & domain monitoring, a managed WAF, and a compliance generator come bundled as complementary extras — installed in one line for Node, PHP/Laravel, Python, Go, Ruby, Java, .NET, Rust, Bun, or Deno.

Your security layer. Shipped in 30 seconds. One line — npx @jikida/init — and every SDK fails open, so if Jikida.io is ever down your app keeps serving.

---

Why Jikida beats the other security tools

The strongest open-source security tools are deep but narrow — pentest-only, self-hosted, bring-your-own-LLM-key. Jikida does the deep work and hosts it, runs with no key of your own, and adds a WAF, uptime and repo scan the pentest-only tools skip. ✅ full · ⚠️ partial · ❌ none.

The one axis the AI pentesters still go deeper on is raw exploitation — exactly what our source-to-exploit deep pentest is closing. Everywhere else, the builder who shipped with Cursor last week wins with Jikida: nothing to self-host, no key to buy, the whole stack in one account. Full breakdowns: nuclei · strix · shannon · snyk · cloudflare.

---

Get started — pick your entry point

Every command below sits in its own copy box. Lines that start with ! are notes, not commands — do not copy those.

Scan a URL or repo — no account needed.

npx @jikida/scan https://your-app.com

! Scan a local repo for committed secrets:

npx @jikida/scan ./

Add the WAF + SDK — auto-detects your framework.

npx @jikida/init

Install a language SDK — Node shown; PHP, Python, Go and the rest are in the SDK table.

npm install @jikida/sdk-node

MCP server for Claude Code, Cursor and Windsurf — add this to ~/.claude/mcp.json:

{ "mcpServers": { "jikida": { "command": "npx", "args": ["-y", "@jikida/mcp"] } } }

Agent skills — copy the skills/ folder into your assistant's skills folder (.claude/skills/, Cursor rules, and the like). Three skills: security, clean-code, UX design — see the table below.

Full details for each are below.

Where things live

Get a token at app.jikida.io/developer. Set it as JIKIDA_TOKEN.

---

See it in action

One dashboard for a site's whole security posture — protection status, uptime, pentest grade, email security (SPF/DKIM/DMARC) and compliance — with instant alerts to your phone, Slack, Telegram, Discord, email or a webhook.

• Uptime & performance — response-time trend, uptime %, P95 and an incident timeline for every page and API you watch.
• API rate-limits & rules — your SDK auto-detects endpoints from real traffic; approve per-endpoint rate caps and WAF rules, or dismiss the ones you don't need.

---

Table of contents

• Why Jikida beats the other security tools
• Why Jikida.io
• How access works
• What's inside
• Quick install
• Security for your stack
• SDKs — every language
• MCP server for AI IDEs
• Free tools
• Skill for Claude Code
• Standards & mappings
• Threats Jikida.io stops
• Contributing

---

Why Jikida.io

Most small teams ship without a Web Application Firewall in front of their app. They know they should. They put it on the backlog. Then the free trial ends, or a user reports a slow page, and the WAF ticket rots another quarter.

Jikida.io removes three specific frictions:

1. Install — one line, one language, five minutes.
2. Downside risk — every SDK is fail-open. If Jikida.io is down, your app keeps serving. You lose protection, not availability.
3. Cost — there's a real free tier that protects a hobby project. Plans and current pricing live at jikida.io.

How access works — free, then account-gated, then plan-gated

Everything in this repo is open source, and a lot of Jikida.io is usable before you ever sign up. The model is three tiers of friction, on purpose:

• Free, no account. The SDKs, the WAF rule packs, the CLI scanner and four MCP tools (scan_domain, check_headers, guard_code, check_s3_bucket) run with no login at all — rate-limited by IP. You can protect an app or scan a URL in one command and never create an account. This is the open-source, try-it-now surface.
• Account-gated (still free). Sign up — no card — and the hosted layer turns on: uptime monitoring, one live-site pentest, one repo scan, a basic managed WAF, mobile push, a public status page. This is where a hobby project actually gets protected. The free tier is deliberately useful, not a teaser.
• Plan-gated. The deep, repeated and heavy work sits behind a plan: scheduled deep pentests, the source-to-exploit crawl, more monitors at faster intervals, higher scan quotas, the CNAME edge WAF, team seats and longer log retention. Current caps and pricing live at jikida.io/pricing — plans start at $19/mo billed yearly.

Two different things are hosted, don't confuse them: the pentest and scan analysis runs on Jikida's own servers, which is why you never bring an LLM key for it. The MCP server is the opposite — it calls no model of its own and runs inside *your* AI editor (Claude Code, Claude chat, Cursor, Windsurf, VS Code), so it spends your editor's AI credits and enforces the same per-site plan quotas. Open where it helps, gated where it costs — usable first, paid when it's worth paying for.

What's inside