MCP

MCP server

Ask your coding agent to check an app for leaks. PatchLabs runs a remote MCP server, so Claude Code, Cursor, VS Code, Windsurf and other MCP clients can run the free RLS check, start full checks and re-check monitored apps.

Server URL

https://api.patchlabs.dev/mcp

Tools

Tool	Arguments	What it does	Key
`rls_check`	`repo`	The free static RLS check of a public repo’s migrations. Instant, no sign-up.	No
`start_check`	`repo`, `email`	Requests the full lab check. Returns a check ID and link; the owner still proves ownership by committing the verification file.	No
`get_check`	`check_id`	Status, summary, report and fix for a check.	No
`list_apps`	none	The apps monitored in the key’s workspace, with their latest check.	Yes
`run_check`	`app_id`	Queues a check for a monitored app now. Uses one of the plan’s monthly runs.	Yes

Install

The first three tools work with no key. To use list_apps and run_check, add a workspace API key as the X-API-Key header, as shown in each snippet.

Claude Code

Terminal

claude mcp add --transport http patchlabs https://api.patchlabs.dev/mcp

With an API key for the app tools:

Terminal

claude mcp add --transport http patchlabs https://api.patchlabs.dev/mcp \
  --header "X-API-Key: pl_live_…"

Run claude mcp list to confirm it connected.

Cursor

Add this to .cursor/mcp.json in your project (or ~/.cursor/mcp.json for every project):

.cursor/mcp.json

{
  "mcpServers": {
    "patchlabs": {
      "url": "https://api.patchlabs.dev/mcp",
      "headers": { "X-API-Key": "pl_live_…" }
    }
  }
}

Leave out headers if you only need the open tools. Don’t commit a file that contains your key.

VS Code

Add this to .vscode/mcp.json. VS Code asks for the key the first time and stores it for you, so it never sits in the file:

.vscode/mcp.json

{
  "inputs": [
    { "type": "promptString", "id": "patchlabs-key", "description": "PatchLabs API key", "password": true }
  ],
  "servers": {
    "patchlabs": {
      "type": "http",
      "url": "https://api.patchlabs.dev/mcp",
      "headers": { "X-API-Key": "${input:patchlabs-key}" }
    }
  }
}

Windsurf

Add this to ~/.codeium/windsurf/mcp_config.json (or open it from Windsurf’s MCP settings), then refresh the server list:

mcp_config.json

{
  "mcpServers": {
    "patchlabs": {
      "serverUrl": "https://api.patchlabs.dev/mcp",
      "headers": { "X-API-Key": "pl_live_…" }
    }
  }
}

Other clients

Any client that supports remote servers over Streamable HTTP works. Give it the URL above and, if it lets you set headers, X-API-Key. The server doesn’t use OAuth.

Editors change their configuration formats from time to time. If a snippet doesn’t connect, check your editor’s MCP docs for remote (HTTP) servers with custom headers.

Things to ask

“Run a PatchLabs RLS check on github.com/you/your-app and explain each finding in plain English.”
“Start a full PatchLabs check of you/your-app and send the report to me@company.com.”
“List my PatchLabs apps and re-run the check on the one that’s leaking.”
“Get PatchLabs check 7c1e… and show me the fix migration.”

Your agent can’t skip verification. start_check creates the check, but it only runs after someone commits patchlabs-verify.txt to the repo. And when your agent shows you a fix, apply it as written: the proof covers the exact file.

Protocol details

Transport: JSON-RPC 2.0 over Streamable HTTP: POST /mcp. Stateless, with plain JSON responses (no server-sent events). GET /mcp answers 405.
Methods: initialize, ping, tools/list, tools/call. Batches are accepted; notifications get 202 with no body.
Versions: 2025-06-18, 2025-03-26 and 2024-11-05. We answer with the version you ask for when we support it.
Errors: A failing tool returns a normal result with isError: true and the plain-English reason, such as an invalid key or a run limit.
Results: Tool results carry the JSON both as text and as structuredContent.

Terminal

curl -s https://api.patchlabs.dev/mcp -H 'Content-Type: application/json' \
  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call",
       "params": {"name": "rls_check", "arguments": {"repo": "manra399/patchlabs-demo-app"}}}'

curl -s https://api.patchlabs.dev/mcp -H 'Content-Type: application/json' \
  -H "X-API-Key: $PATCHLABS_API_KEY" \
  -d '{"jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": {"name": "list_apps", "arguments": {}}}'

Try it

List the server’s tools, live, from your browser.

Request body

Needs JavaScript; use the curl example instead.

The same limits apply as for the API: the RLS check allows 20 requests an hour per network, and run_check uses the workspace’s monthly runs. See rate limits.

Updated 10 Nov 2026Something unclear or wrong? Tell the founder