The vibe-coder stack
You built the app with Lovable, Bolt, Cursor or Claude Code. Now it has to be safe to launch and easy to find. These are the checks for every step after the AI writes the code: free in your browser, and on one key for your agent and CI.
20 free calls a day on the key. After that, card credit from $5, and you see the price before every call.
Before you commit
Are my AI config files safe?
Check .cursorrules, CLAUDE.md, AGENTS.md and MCP configs for hidden instructions, curl | sh commands and leaked keys.
Is this MCP server safe to add?
Before you give your coding agent a new MCP server, audit its tools for hidden instructions and risky permissions.
Did a key end up in my code?
Find OpenAI, Anthropic, Stripe, Supabase, AWS and GitHub keys in code, logs or a diff, shown masked.
Before you launch
Is my live app leaking?
Paste your app's URL and see what any visitor can see: keys in your JavaScript bundles, a public Supabase service_role key, downloadable .env and .git files, missing security headers and email setup. Each issue comes with a fix prompt for your AI builder.
Can users break my AI chat?
If your app has an AI feature, check what users type (and what it reads) for prompt injection before it reaches the model.
Is my AI reading poisoned pages?
When your app's AI reads web pages or documents, strip hidden text and injected instructions first.
Am I logging personal data?
Find and redact emails, phone numbers, card numbers and IDs before they land in logs, prompts or analytics.
After you launch
Can ChatGPT and Claude find my app?
See which AI crawlers your robots.txt blocks, check llms.txt and sitemap, and get a 0-100 score with fixes and a badge.
Will Google show my app properly?
Title, description, share image, blank-without-JavaScript, soft 404s and sitemap: the basics Google and link previews need, with copy-paste fixes. Part of the launch scan.
Use it from Cursor or Claude Code
Most checks above are also tools your coding agent can call. One line adds them all:
claude mcp add --transport http exepal "https://api.exepal.com/mcp?key=YOUR_KEY"Cursor, VS Code, Windsurf and others: one-click setup. Plain HTTPS works too: API docs.
How it works
Free to start
The browser checks are free with a daily limit. The key gives 20 free calls a day across the everyday tools.
Pay per call after that
Card credit packs of $5, $20 or $50. Most checks cost a fraction of a cent. Failed calls are never charged.
Your code stays yours
Files and text are scanned in memory and not stored. Keys we find are shown masked.