MCP server

Claude

1. Open claude.ai and go to Settings › Connectors.
2. Choose Add custom connector. Enter Hullwise as the name and the connector URL above as the URL.
3. Save the connector. No sign-in or approval is needed. It is then also available in the desktop and mobile apps.

In Team and Enterprise accounts, an admin usually adds the connector once for everyone.

ChatGPT

1. In settings, under Apps and Connectors (usually in the advanced section), turn on developer mode.
2. Create a new connector. Enter the connector URL above as the URL and choose None for authentication.
3. Save the connector and select it in the chat.

OpenAI renames these menus regularly, and not every plan has developer mode. If a step looks different, look for the place where you add your own MCP server by URL. The URL is all it takes.

Claude Code

claude mcp add --transport http hullwise https://hullwise.co/mcp

For the higher limit and, with Business, the full report, add your key as a header. With --scope user, the server is available in all projects. Run /mcp in Claude Code to see whether the connection works.

claude mcp add --transport http --scope user hullwise https://hullwise.co/mcp \
  --header "Authorization: Bearer $HULLWISE_API_KEY"

Codex

[mcp_servers.hullwise]
url = "https://hullwise.co/mcp"
bearer_token_env_var = "HULLWISE_API_KEY"

Codex reads the key from the environment variable HULLWISE_API_KEY. Without a key, leave out the last line.

Cursor

{
  "mcpServers": {
    "hullwise": {
      "url": "https://hullwise.co/mcp"
    }
  }
}

With a key, add the entry "headers": { "Authorization": "Bearer ${env:HULLWISE_API_KEY}" } next to url. Do not commit the file to Git with a real key in it.

VS Code

{
  "servers": {
    "hullwise": {
      "type": "http",
      "url": "https://hullwise.co/mcp"
    }
  }
}

The file applies to this project. GitHub Copilot in agent mode then finds the tools on its own. Provide a key through an input prompt rather than writing it into the file.

Tools

There are two tools, and both only read. Inputs and outputs of scan_website are documented in the API reference. The tool returns a short text summary and the report as structuredContent, in the same shape as the API's data field. Finding texts and error messages are in English. For German texts, pass the argument lang: "de" to scan_website.

Read-only means the tool changes nothing, neither on our side nor on the checked site. Idempotent means a second call does no harm. Reaches outside means the tool requests an external website.

Shortened report without Business

Without a key, or with a key that has no paid plan, the server shortens the report. 2 findings come in full; the rest appear in structuredContent only with severity and locked: true. The text for the assistant states the number of locked findings and ends with a pointer to Business.

- 3 further findings locked

3 more findings are only included with a Business plan: https://hullwise.co/pricing

With a key from an account on Business, both lines are gone and every finding comes with ID and text. What a locked finding looks like in the JSON is shown under Shortened reports.

Example prompts

• “Check our Lovable app customers.example.com with Hullwise. Are any keys exposed in the JavaScript files?”
• “Check the staging site after the deploy and compare the grade with yesterday.”
• “Which findings on example.com are warnings? Explain each one in a sentence for our team.”
• “Which headers are missing on example.com, and how do we set them in nginx?”
• “What does Hullwise check, and what does it explicitly not do?”

Protocol

• The transport is Streamable HTTP via POST https://hullwise.co/mcp. The server answers a GET with 405.
• The server is stateless. There are no sessions and no Mcp-Session-Id; every request stands on its own.
• Responses are always JSON, never an event stream. You can send several requests in one array.
• Supported protocol versions are 2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05. If your client requests a different one, the server answers with 2025-11-25.
• The server supports the methods initialize, ping, tools/list and tools/call.
• There is no OAuth. You can send a key in the header Authorization: Bearer sc_live_…. An invalid key returns status 401.
• A check usually takes a few seconds. The checked site has 8 seconds to respond, and its JavaScript files get another 6 seconds in total.
• CORS is open to all origins, so you can also call the server from the browser.

curl -X POST https://hullwise.co/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"scan_website","arguments":{"url":"example.com"}}}'