MCP server installation

Install the runtime environment

Follow these steps to install Node.js, which is required for using Fluid Attacks' MCP server. If you already have Node.js v22 installed, simply skip to the next section according to your needs.

1. It is recommended that you install Node Version Manager (nvm), as it allows you to have different versions of Node.js and switch between them according to your current needs. To install nvm, open your terminal and run the following:

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.2/install.sh | bash

Close and reopen your terminal or run the following command to load nvm into your current session:

\. "$HOME/.nvm/nvm.sh"

2. Install the Node.js version 22 with the following command (v18 or higher is required):

nvm install 22

Set up in Claude

Set up Fluid Attacks' MCP server in Claude following these instructions:

1. Go to the menu bar, click on Claude and then Settings.

2. Switch to the Developer tab and click the Edit Config button.

3. You are presented with a folder that contains the file claude_desktop_config.json. Open this file with a text editor.

4. Paste the following into the configuration file:

   {
     "mcpServers": {
       "fluidattacks-mcp": {
         "command": "npx",
         "args": [
           "--cache",
           "/tmp/fluidattacks-mcp",
           "mcp-remote",
           "https://app.fluidattacks.com/mcp/messages/"
         ]
       }
     }
   }

5. Save the file and close both it and Claude.

6. Reopen Claude Desktop. On startup, mcp-remote opens your default browser and redirects you to the Fluid Attacks sign-in page, where you grant Claude Desktop access to the information stored in your Fluid Attacks platform account. After you authorize the request, the browser returns to Claude Desktop and the fluidattacks-mcp server appears as connected.

You can now start chatting with the platform.

Configuration

Use Fluid Attacks' remote MCP server in Claude Code, following these instructions:

1. From your project root, add the server using the Claude Code CLI:

   claude mcp add --transport http fluidattacks-mcp https://app.fluidattacks.com/mcp/messages/

   To make the server available across all your projects, use the --scope user flag instead:

   claude mcp add --scope user --transport http fluidattacks-mcp https://app.fluidattacks.com/mcp/messages/

2. Alternatively, create a .mcp.json file in your project root and declare the server:

   {
     "mcpServers": {
       "fluidattacks-mcp": {
         "type": "http",
         "url": "https://app.fluidattacks.com/mcp/messages/"
       }
     }
   }

3. Start an interactive Claude Code session and run the /mcp command. Select fluidattacks-mcp from the list and choose the Authenticate option to start the OAuth flow in your browser. After authorizing, the server status should change to connected.

4. You can now use the Fluid Attacks MCP server in Claude Code.

Configuration

Use Fluid Attacks' remote MCP server in Cursor, following these instructions:

1. Go to Cursor's MCP Directory and search for the Fluid Attacks server.
2. Click on the Add to Cursor button:

3. Once you see this warning message in your browser, click the Open Link or Open Cursor.app button:

4. Add the Fluid Attacks API token in the configuration field. Authentication is required to use any of the MCP tools.

5. Click on the Install button.

6. Verify that the server is active before using it to request vulnerability scans or reports containing information about your groups.

   

7. You can now use the Fluid Attacks MCP server in Cursor.

   

Configuration

Use Fluid Attacks' remote MCP server in VS Code, following these instructions:

1. Open VS Code's search bar (cmd + P) and type "> MCP: Open User Configuration".

2. Select the option shown in the image below:

   

3. Add Fluid Attacks' MCP Server in the servers section of the configuration:

   {
     "servers": {
       "fluidattacks-mcp": {
         "type": "http",
         "url": "https://app.fluidattacks.com/mcp/messages/"
       }
     }
   }

4. Save the file.

5. As shown in the image below, click on Start.

   

6. Authenticate

   • click on allow
   
   • Click on open
   
   • Select the account you use to access the Fluid Attacks platform and accept
   
   • Click on the link or accept opening the app
   

7. Once again on VS Code, the number of tools and prompts should be shown.

8. To enable the AI Agent to use our MCP tools, click on the Configure tools option.

   

9. On the opened window, search for "fluidattacks-mcp", enable the tools you want to use, and click the OK button:

   

10. You can now use the Fluid Attacks MCP server in VS Code.

    

Configuration

Use Fluid Attacks' remote MCP server in Windsurf, following these instructions:

1. Open the ~/.codeium/windsurf/mcp_config.json file in your home directory. If the file does not exist, create it.

2. Add Fluid Attacks' MCP server under the mcpServers section:

   {
     "mcpServers": {
       "fluidattacks-mcp": {
         "serverUrl": "https://app.fluidattacks.com/mcp/messages/"
       }
     }
   }

   Alternatively, you can manage the server from the UI: open the Cascade panel, click the MCPs icon in the top-right menu, then open Windsurf Settings > Cascade > MCP Servers and add the server entry above.

3. Save the file and refresh the MCP servers list in Cascade. Windsurf opens your default browser to start the OAuth flow. After you authorize the request, the browser returns to Windsurf and the fluidattacks-mcp server appears as connected.

4. You can now use the Fluid Attacks MCP server in Windsurf.