# AURI for Developers

## Secure your code where you write it

Fix vulnerabilities, detect secrets, and block malicious dependencies in your AI coding workflow.

Start free with the MCP server

[Cursor](/content/platform/developer#w-tabs-0-data-w-pane-0/index.html) [Claude Code](/content/platform/developer#w-tabs-0-data-w-pane-1/index.html) [Codex](/content/platform/developer#w-tabs-0-data-w-pane-2/index.html) [VS Code / Copilot](/content/platform/developer#w-tabs-0-data-w-pane-3/index.html) [Antigravity](/content/platform/developer#w-tabs-0-data-w-pane-4/index.html)

[Install in Cursor with one click](/content/platform/developer#/index.html)

Or add manually to .cursor/mcp.json

```json
{
  "mcpServers": {
    "endor-cli-tools": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "endorctl", "ai-tools", "mcp-server"]
    }
  }
}
```

Authenticates via your browser on first run. No account, no credit card.

Downloads endorctl automatically on first run. Your code never leaves your machine.

[Read the docs](https://docs.endorlabs.com/setup-deployment/mcp/index)

Run the following command in your terminal to install the MCP server.

```bash
claude mcp add endor-cli-tools -- npx -y endorctl ai-tools mcp-server
```

Copy

Authenticates via your browser on first run. No account, no credit card.

Downloads endorctl automatically on first run. Your code never leaves your machine.

[Install in VS Code with one click](/content/platform/developer#/index.html)

Or add manually to .vscode/mcp.json

```json
{
  "servers": {
    "endor-cli-tools": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "endorctl", "ai-tools", "mcp-server"]
    }
  }
}
```

## Free for you. A platform for your whole team.

AURI for Developers runs the MCP server locally for free. Paid plans add full-stack reachability, deep code reasoning across every application layer, and audit-ready evidence for every finding.

| Feature | AURI for Developers | Paid Plans |
|---|---|---|
| Detect and fix vulnerabilities in code | Yes | Yes |
| Detect and fix exposed secrets | Yes | Yes |
| Detect and fix open source vulnerabilities | Yes | Yes |
| Detect malicious packages | Yes | Yes |
| Block malicious packages | Yes | Yes |
| Review PRs with AI Security Code Review | Yes | Yes |
| Reduce noise with full-stack reachability | Yes | Yes |
| Identify upgrades that won’t break your code | Yes | Yes |
| Use REST API to build integrations | Yes | Yes |
| Create and enforce policies | Yes | Yes |
| Dashboard and compliance reporting | Yes | Yes |

## What it looks like in your workflow

Implementing Endor Labs is easy. I had exactly what I needed between the docs, CLI tool, a GitHub Action, and a GitHub app—all readily available.

Alex Olea
DevSecOps Engineer, Starburst

## AURI Agents

.webp)

Let agents do the security work for you, like remediating vulnerable dependencies, triaging SAST findings, and diagnosing scan failures.

**Pre-built and open source:** Install into the AI coding tools you already use and ask for a workflow in plain language.

**Runs on your infrastructure:** Your LLM keys, your credentials. Read-only by default, and mutating actions ask first.

**Build your own:** Describe an agent in plain English and the Agent Kit authors, validates, and packages it for every supported host.

1. Install the plugin

```
   /add-plugin endorlabs
   
   Use the endor-agent-kit-setup skill to set up endorctl
   ```

2. Run your agent

```
   Use the AI SAST triage agent to fix the top 3 critical or high findings
   ```

### Command Line Interface (CLI)

Use the Endor Labs CLI to run security scans locally, integrate into your own scripts, and build scanning into CI scripts.

[Get started with CLI](https://docs.endorlabs.com/developers-api/cli/install-and-configure/)

```bash
brew install endorlabs/tap/endorctl
brew install endorctl
```

```bash
npm install -g endorctl
```

```bash
# Download the latest CLI for Linux amd64
curl https://api.endorlabs.com/download/latest/endorctl_linux_amd64 -o endorctl
# Verify the checksum of the binary
echo "$(curl -s https://api.endorlabs.com/sha/latest/endorctl_linux_amd64)  endorctl" | sha256sum -c
# Modify the permissions of the binary to ensure it is executable
chmod +x ./endorctl
# Create an alias endorctl of the binary to ensure it is available in other directory
alias endorctl="$PWD/endorctl"
```

```bash
# Download the latest CLI for Windows amd64
curl -O https://api.endorlabs.com/download/latest/endorctl_windows_amd64.exe
# Check the expected checksum of the binary file
curl https://api.endorlabs.com/sha/latest/endorctl_windows_amd64.exe
# Verify the expected checksum and the actual checksum of the binary match
certutil -hashfile .\endorctl_windows_amd64.exe SHA256
# Rename the binary file
ren endorctl_windows_amd64.exe endorctl.exe
```

## Enterprise Setup

Already have an Endor Labs account?

Connect your developer tools to your organization's namespace, policies, and centralized reporting.

Authenticate with an API key or enterprise SSO

Set your namespace

Centralized reporting and policy enforcement

Team management and SIEM integrations

## Resources

[Endor Labs MCP Server](https://docs.endorlabs.com/setup-deployment/mcp/index)

Installation guides, advanced options, and example workflows.

[Fix Flaws with AURI Agents](/content/learn/agentic-appsec-and-agentic-remediation-is-finally-here/index.html)

Pre-built security agents that triage and remediate findings.

[Block Malware with Cursor Hooks](https://www.youtube.com/watch?v=a07HM9P-Ai4)

Learn how to intercept malicious packages before they land on your machine.

## FAQs

### What is the Developer Edition?

Developer Edition is a free tier for individual developers. Free scanning runs through the AURI MCP Server in your AI editor of choice. It includes SAST, SCA, secrets detection, and malicious open-source package detection — the core scanning capabilities you need to write secure code from day one.

### What does the MCP Server actually do?

The MCP Server connects AURI's security intelligence to your AI coding assistant. When you or your AI writes code, the server scans for vulnerabilities, insecure patterns, hardcoded secrets, and risky dependencies in real-time — then helps fix them inline, right where you're working.

### Which editors and tools are supported?

The MCP server works with Cursor, VS Code, Devin, Claude Code, Gemini, and any MCP-compatible client.

### Is Developer Edition really free?

Yes. Developer Edition requires no credit card and no paid subscription. You authenticate once via GitHub, GitLab, or Google and you're up and running. There's no trial period — it's free to use, forever.

### What kinds of scans does it run?

Developer Edition includes four core scan types: static application security testing (SAST) for code-level issues, software composition analysis (SCA) for dependency vulnerabilities, secrets detection for exposed credentials, and malicious package detection to catch supply chain attacks before they reach your environment.

### Does my code leave my machine?

No. All scans run locally. The MCP Server accesses AURI's vulnerability database for intelligence (read-only), but your source code stays on your machine and is never uploaded to Endor Labs' platform.

### How is this different from other free security MCP servers?

Most free MCP servers focus on code scanning alone. The AURI Developer Edition combines code scanning (SAST and secrets) with full supply chain security — including CVE detection and malicious open-source package identification in your dependencies.

### Do I need to install anything besides the MCP Server?

No. The MCP Server fetches everything it needs on demand, including endorctl, the Endor Labs CLI. There's no separate installation step, no pre-configuration, and no dependency management required to get started.

### Can I use Developer Edition with my team?

Developer Edition is designed for individual developers. If your team needs shared policies, centralized reporting, or platform-level visibility, Endor Labs offers team and enterprise tiers that build on the same scanning engine with collaboration and governance features.

### What's the difference between Developer Edition and the full Endor Labs platform?

Developer Edition gives you the MCP Server with default security policies and local-only results. The full platform adds AURI Agents, CLI, web UI, custom policies, centralized reporting, team management, and integrations with SIEM and vulnerability management tools for organization-wide security programs.

### What are AURI Agents?

AURI Agents are a catalog of ready-to-use security agents that run inside your AI coding assistant. Each agent packages a specific Endor Labs workflow, such as triaging findings, remediating vulnerable dependencies, or diagnosing scan failures, with a built-in safety contract, approval gates, and evidence requirements.