Your AI Coding Agent Can Now Trigger a Decloak Scan Itself, No Glue Code Required
If you're building with an AI coding agent in 2026, there's a decent chance you've already run into Model Context Protocol without necessarily naming it. It's the open standard, introduced by Anthropic in late 2024 and donated to the Linux Foundation's Agentic AI Foundation in December 2025, that lets an AI agent connect to real tools and data sources without a developer writing custom integration code for every single one. The Python and TypeScript SDKs alone now see roughly 97 million monthly downloads, and it's been adopted by every major AI lab, Anthropic, OpenAI, Google, and Microsoft among them.
Decloak now ships an MCP server, so an AI agent that speaks MCP, Claude, Cursor, or anything else compatible, can trigger a scan and pull results directly, as part of its own workflow.
What this actually unlocks
Before MCP, connecting an AI agent to an external tool meant writing custom glue code specific to that tool, and doing it again for the next one. MCP standardizes the connection itself: an agent that speaks MCP can use any MCP server without bespoke integration work. Decloak's server exposes four tools directly to a connected agent:
create_scan- trigger a new scan against a URL or domainget_scan- retrieve the full results of a specific scanlist_scans- see scan history for a domainwait_for_scan- block until a running scan completes, useful for an agent that needs the result before its next step
What this looks like in practice
An agent working on your codebase can trigger a scan against a staging deployment as part of its own review process, wait for the result, and factor real findings into what it does next, all without you switching context to a separate dashboard or writing a script to bridge the two tools together. If you're using an agent to help ship code faster, this closes a loop that would otherwise require you to remember to check manually, which is exactly the kind of step that gets skipped under deadline pressure.
Why this matters beyond convenience
The MCP ecosystem has grown fast enough that it's also developed a real security problem worth being honest about: independent research has found security issues in a majority of publicly listed MCP servers, and confirmed malicious payloads in a meaningful share of published agent tools. Baseline good practice for anyone building an MCP server includes validating all inputs, never passing user content into shell commands, keeping tool descriptions honest about what they actually do, and applying rate limiting, and that's exactly the standard we built ours to.
There's also something fitting about a security scanning tool being reachable by the same AI agents writing the code it scans. As more software gets built by AI coding agents with less manual review at each step, having the ability to check that code's actual security posture from inside the same workflow, rather than as a separate manual task someone has to remember to run, is worth more than it might sound.
Availability
The MCP server is available on Decloak Starter and above, no glue code required, connect your MCP-compatible agent and the four tools are available immediately.
The Decloak MCP server is available on Starter and above. See plans →