Hakira MCP

Give Claude Code, Cursor, or Windsurf access to Hakira via MCP.

Running a security audit spends credits.

Install

Pick your coding agent, then restart it — MCP config is only read at startup.

Quick install

terminal

1claude mcp add hakira -- npx -y hakira-mcp

Add --scope project to write it to the repo's .mcp.json, or --scope user for all projects. Headless / CI:

terminal

1claude mcp add hakira -e HAKIRA_TOKEN=hk_pat_... -- npx -y hakira-mcp

Manual config

.mcp.json (project) or ~/.claude/.mcp.json (global) — browser login, no token:

.mcp.json

1{
2  "mcpServers": {
3    "hakira": {
4      "type": "stdio",
5      "command": "npx",
6      "args": ["-y", "hakira-mcp"]
7    }
8  }
9}

Headless / CI — add a token:

.mcp.json

1{
2  "mcpServers": {
3    "hakira": {
4      "type": "stdio",
5      "command": "npx",
6      "args": ["-y", "hakira-mcp"],
7      "env": { "HAKIRA_TOKEN": "${HAKIRA_TOKEN}" }
8    }
9  }
10}

Authentication

Browser login — the default. First tool call opens your browser to authorize the machine; the credential is cached at ~/.hakira/credentials.json.

Token — for SSH, CI, or anywhere without a browser. Generate one from Settings → API Tokens on the Hakira dashboard (copy it now, it's shown once), then set it as HAKIRA_TOKEN in the config's env block. Revoke it anytime from the same page.

Tools

Eight tools. Only one spends credits — the rest are free to call as often as you like.

start_auditcredits

Zip the working tree (gitignore-respecting, secrets stripped), upload it, and start a cloud audit.

get_audit_status

Poll an audit: queued → provisioning → running → ready (or canceled / error).

get_audit_events

Activity trail — what Hakira is doing or has done, as it happens.

get_audit_findings

Finding summaries for a completed audit, grouped by severity.

get_finding

Full detail for one finding — description, evidence, recommended fix.

list_audits

Recent audits across your account, with the current project marked.

list_workspaces

All workspaces on your account, with the current project marked.

cancel_audit

Request cancellation of a running audit.

Privacy

start_audit uploads a ZIP of your working tree, honoring .gitignore plus an always-excluded deny-list — secrets, keys, and credentials never leave your machine:

always excluded

1.env*, *.pem, *.key, id_rsa*, *.p12, *.pfx, .ssh/, .aws/, .npmrc, *.keystore

Add more patterns in .hakiraignore. Every run prints exactly what was uploaded before the paid call runs.