← Back to unbreachable

Connect Unbreachable

Add Unbreachable as a remote connector and scan a public site you own or are allowed to test. The scan is passive: it reads pages a stranger could already open. It does not log in to the site or change it.

Connector URL

Use this exact URL. OAuth checks it character for character.

https://www.unbreachable.dev/mcp

Local development uses http://localhost:3000/mcp. Sign-in, when a fix asks for it, uses your existing Unbreachable account (Google).

Add Unbreachable to your AI

Works with any MCP client, e.g. Claude, Cursor, ChatGPT. Pick the one you use.

Claude on the web and Claude Desktop both use a custom connector.

  1. Open Customize, then Connectors.
  2. Choose Add, then Custom, then Web. Some accounts show Add custom connector instead.
  3. Name it Unbreachable and paste the connector URL.
  4. Under Authentication, choose Sign in when needed.
  5. Under OAuth client, choose Use Claude's published identity. Leave request headers empty. There is no API key.
  6. Choose Add.
https://www.unbreachable.dev/mcp

In the chat, mention Unbreachable. For example: scan mysite.com with Unbreachable.

What you can ask

  • Scan mysite.com with Unbreachable.
  • Security scan my live site.
  • Check this deployed app for leaked API keys.

Only point it at a site you own or have permission to test.

Tools

  • scan_url starts a passive scan of a live site and returns a scan id, grade, and score.
  • get_report returns the grade and every finding.
  • get_fix returns the written fix for one finding. The two most serious findings include a fix for any caller. The rest are included for a signed-in account that already has them.

If something fails

  • A 401 on a fix means the app should start sign-in. The two most serious fixes do not need it.
  • Private addresses, localhost targets, and bare hostnames are refused.
  • Deep active testing is not available through the connector. That stays on the website for a verified domain.
  • Help: support.