Defen.so
A security layer for Modern Apps/sites
Ads
Overview
Scan your website, apps & GitHub for vulnerabilities. Block attacks & bad bots, rate-limit your APIs, monitor uptime, domain & SSL expiry — all in one security platform. Scan & pentest · Monitoring & uptime · Instant alerts · API rate limits · 360° protection · MCP & SDKs Defen.so is a developer-first web security SaaS. Managed WAF, uptime monitoring, quick pentest (headers, TLS, email security — SPF/DKIM/DMARC — and compliance-style findings), vibe-coder scan, repo/secret scan, Cloudflare DDoS wrap, bot detection, active deception, and file-upload scanning — installed in one line for Node, PHP/Laravel, Python, Go, Ruby, Java, .NET, Rust, Bun, or Deno.
Installation
npx @defen.so/init
Configuration
{
"mcpServers": {
"defenso": {
"command": "npx",
"args": ["-y", "@defen.so/mcp"],
"env": { "DEFENSO_TOKEN": "df_live_..." }
}Capabilities
- Scan a domain's security posture
Ask for a full surface scan of any domain via `scan_domain`, covering headers, TLS, email security (SPF/DKIM/DMARC), and compliance-style findings with an A–F grade.
- Inspect HTTP security headers
Use `check_headers` to verify a site's response headers against best practices and identify missing or misconfigured protections.
- Manage WAF rules and IP blocks
Add custom WAF rules with `add_waf_rule` or permanently block a malicious IP using `block_ip`, then review recent attacks with `list_recent_attacks`.
- Monitor uptime and sites
List all registered sites and their uptime monitors via `list_sites` and `list_monitors`, then drill into recent scan history with `list_recent_scans`.
- Explain WAF verdicts
Feed any blocked request's details into `explain_verdict` to understand exactly which rule fired and why the action was taken.
- Run vibe-coder and repo scans
Trigger `run_vibe_scan` to catch exposed secrets, open buckets, or misconfigured Firebase/Supabase rules, or use `scan_repo` to audit a codebase for vulnerabilities.
Tags
- development
Related MCP servers
Context7 MCP
OfficialOfficial Context7 MCP server that brings up-to-date, version-specific library documentation and code examples into AI coding prompts.
Chrome DevTools MCP
OfficialOfficial Chrome DevTools MCP server for controlling and inspecting a live Chrome browser from coding agents such as Gemini, Claude, Cursor, and Copilot.
Mastra/mcp
OfficialClient implementation for Mastra, providing seamless integration with MCP-compatible AI models and tools.
GitHub MCP Server
OfficialConnect your AI assistant to GitHub repositories, issues, pull requests, and search.