Assurly MCP Server

What your agent gets back

Local scans return a Ship Gate summary the agent can read inline. Example output from assurly_scan_path:

⚠️ REVIEW RECOMMENDED                            Ship Score: 88/100
Scanned repository · 0 of 0 source files
Warnings (review):
  · No .env.example file found at the root of the project. It is highly r… → 1 file
  · GitHub Actions workflow for Assurly is missing.     → 1 file
     ↳ Run: npx assurly init

The same tool also returns a markdown report and a JSON payload with verdict, status, shipScore, blockers, reviews, warnings, findings, detectedStack, and scanScope.

assurly_verdict reads the hosted API only — it never scans locally and never triggers an active probe. Pass exactly one of url or repo (owner/name). Alongside status and Ship Score it returns per-rule fixOutcomes (ruleId, outcome, observedAt) — shape-only, from the last re-probe. Example:

Assurly verdict: BLOCKED · Ship Score 42/100
Target: my-app.vercel.app
Top issue: Database exposure — Enable RLS on public tables
Fix outcomes (last re-probe only — may predate your latest edit):
  · runtime-supabase-rls-open: still_open · observed 2026-07-18T06:00:00.000Z
Not yet verified against your latest changes — deploy and re-probe. An unverified claim is not done.
Trust page: https://assurly.dev/trust/my-app

When the hosted status is blocked, the tool returns that text with isError: true, so the agent stops instead of shipping. Fix outcomes alone do not set isError— they may predate the agent's latest edit. After claiming a fix, deploy and re-probe; treat an unverified claim as not done.

Tools

Install

One-click install exists only where the client offers it: Cursor and VS Code each accept a server config over a URL handler. Claude Code installs with a single terminal command and Windsurf with a config file — no less supported, just one copy away in the tabs below.

Prerequisites: Node.js ^20.19.0 || >=22.12.0. Run via npx -y @assurly/mcp-server (package @assurly/mcp-server, bin assurly-mcp).

{
  "mcpServers": {
    "assurly": {
      "command": "npx",
      "args": ["-y", "@assurly/mcp-server"]
    }
  }
}

claude mcp add assurly -- npx -y @assurly/mcp-server

{
  "servers": {
    "assurly": {
      "command": "npx",
      "args": ["-y", "@assurly/mcp-server"]
    }
  }
}

{
  "mcpServers": {
    "assurly": {
      "command": "npx",
      "args": ["-y", "@assurly/mcp-server"]
    }
  }
}

{
  "command": "npx",
  "args": ["-y", "@assurly/mcp-server"]
}

Make the gate automatic

A ship gate nobody remembers to invoke is not a gate. Paste this into .cursorrules, CLAUDE.md, or AGENTS.md so the agent calls Assurly before every deploy without being asked:

# Assurly ship gate
Before deploying, pushing to production, or claiming the app is ready to ship:
1. Call assurly_scan_path (or assurly_scan_files) on the project.
2. Fix every blocker; re-scan until the verdict is READY TO SHIP.
3. If a deployed URL or repo is in scope, call assurly_verdict. A blocked verdict is returned with isError: true — stop and do not ship.
4. After you claim a fix for a hosted finding: deploy, then call assurly_verdict again and confirm a post-deploy re-probe recorded verified_fixed for that rule. Fix outcomes include an observed timestamp — they reflect the last re-probe, not your working tree. An unverified claim is not done.
Do not skip this gate or ask the user whether to run it.

Connect the hosted verdict

assurly_verdict requires ASSURLY_API_KEY. Create a key in the dashboard under Settings → API keys (shown once), then expose it to the MCP server. Optional: ASSURLY_API_URL defaults to https://assurly.dev.

Example Cursor .cursor/mcp.json with the key set (VS Code uses servers instead of mcpServers):

{
  "mcpServers": {
    "assurly": {
      "command": "npx",
      "args": ["-y", "@assurly/mcp-server"],
      "env": {
        "ASSURLY_API_KEY": "ask_your_key_here"
      }
    }
  }
}

Typical agent loop

1. 1Agent writes or edits code.
2. 2Call assurly_scan_path or assurly_scan_files.
3. 3Read blockers from the Ship Gate summary.
4. 4Call assurly_explain_rule for remediation hints.
5. 5Fix issues and re-scan until the verdict is READY TO SHIP.

Troubleshooting

• Node too old. The server requires Node ^20.19.0 || >=22.12.0. Upgrade, then retry npx -y @assurly/mcp-server.
• Tools not appearing after install. Restart the client or reload MCP, then confirm the six assurly_* tools are listed.
• Missing API key. ASSURLY_API_KEY is not set. Create a key in the Assurly dashboard (Settings → API keys) and expose it to this MCP server as ASSURLY_API_KEY.
• Invalid or revoked key. The Assurly API key is invalid or revoked (401). Issue a new key.
• Wrong verdict arguments. Provide exactly one of `url` or `repo`.

Pricing

The MCP server is free. Local scans and explaining blockers before deploy are part of the Free tier — the same distribution model as the URL scan.

Paid plans (Pro and OEM) add monitoring, private repos, auto-fix PRs, regression alerts, AI deep review, and the white-label keyed verdict. Pro includes a 3-day free trial. A payment method is required at checkout; cancel before day 3 and you pay nothing.