valiqai mcp lets an AI coding tool use ValiqAI: start a scan of your staging site, wait for it, read what it found, and fix it in the same conversation. It's an MCP server that ships with the CLI and uses the same key.

Set it up

Terminal

$ npx -y @valiqai/cli login

Then add the server to your tool.

Claude Code

Terminal

$ claude mcp add valiqai -- npx -y @valiqai/cli mcp

Cursor: in .cursor/mcp.json (this project) or ~/.cursor/mcp.json (every project):

JSON

{
  "mcpServers": {
    "valiqai": { "command": "npx", "args": ["-y", "@valiqai/cli", "mcp"] }
  }
}

VS Code: in .vscode/mcp.json:

JSON

{
  "servers": {
    "valiqai": { "type": "stdio", "command": "npx", "args": ["-y", "@valiqai/cli", "mcp"] }
  }
}

Other tools take the same command: npx -y @valiqai/cli mcp, over stdio.

Which key and workspace it uses

The same as every other command (Configuration): VALIQAI_API_KEY if your tool sets it, else the workspace in this folder's valiqai.json, else the one you're signed in to. Add --workspace acme to the command to pick one. Without a key the server still starts, and each tool answers with how to sign in.

Don't put a key in a config file you commit. Signing in keeps it in your user settings instead.

What it can do

Tool	What it does
`start_scan`	Starts a scan of an address and returns at once with its id and results link. Uses credits.
`get_scan`	A scan's status, progress, score, open problems by severity and the worst problems. With `wait_seconds` (up to 50), waits for it to finish first.
`list_problems`	A scan's problems, worst first, with the pages each was found on. Filters by severity, category and status.
`list_scans`	Recent scans, newest first, by site and status.
`cancel_scan`	Stops a scan that's still running. Unused credits come back.
`list_domains`	The domains you can scan, and whether each is verified.
`get_credits`	Your credits, and what each scan type reserves.
`whoami`	The user, workspace and key the server uses.

It can't add or verify domains, change keys or settings, or dismiss problems: those stay in ValiqAI and the CLI.

A scan takes several minutes. Ask for it the way you'd ask a teammate:

Scan https://staging.example.com, wait for it to finish, and fix the blockers it finds.

The tool starts the scan, checks on it until it's done, then reads the problems and the pages they're on.

Good to know

Credits: start_scan reserves credits like valiqai scan does, and gives back what the scan doesn't use. Most tools ask you before each tool call that changes something; keep that on for start_scan.
Scans started this way show MCP as where they came from on the results page and in valiqai scans, with the label if one was given.
One scan at a time per workspace. If another is running, start_scan says so, and the tool can wait for it with get_scan.
Problem titles and pages come from your site. The server tells the tool to treat them as data, but review what it does with them like any other change.
The same rules as any scan apply: a verified domain, and no protected sites yet.