Acutis — Security Verification for AI Coding Assistants

Get Started in Seconds

One tool. Zero context bloat. Works with every major AI coding assistant.

One-Click

Add to Cursor Instantly

Click the button below. Cursor will prompt you to confirm, then Acutis is ready to use — no configuration needed.

Add to Cursor

Requires Cursor IDE

Manual Config

Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):

{
  "mcpServers": {
    "acutis": {
      "url": "https://mcp.acutis.dev/mcp",
      "auth": "oauth"
    }
  }
}

One-Click

Add to VS Code Instantly

Click the button below. VS Code will open and prompt you to install Acutis — no configuration needed. Requires VS Code 1.96+ with GitHub Copilot.

Add to VS Code

Requires VS Code with GitHub Copilot

Manual Config

Create .vscode/mcp.json in your workspace root:

{
  "mcpServers": {
    "acutis": {
      "url": "https://mcp.acutis.dev/mcp"
    }
  }
}

Custom Connector

Claude Desktop

The easiest way: open Settings → Connectors, click “Add custom connector,” and enter the server URL.

https://mcp.acutis.dev/mcp

JSON Config

Edit claude_desktop_config.json (Settings → Developer → Edit Config):

{
  "mcpServers": {
    "acutis": {
      "command": "npx",
      "args": ["mcp-remote", "https://mcp.acutis.dev/mcp"]
    }
  }
}

Cascade AI

Windsurf

Open Settings → MCP or use the command palette: Windsurf: Configure MCP Servers.

https://mcp.acutis.dev/mcp

JSON Config

Edit ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "acutis": {
      "command": "npx",
      "args": ["mcp-remote", "https://mcp.acutis.dev/mcp"]
    }
  }
}

Under the Hood

A fundamentally different approach to AI code security.

Zero Trust by Default

Function parameters start at maximum danger. Unknown functions return maximum danger. Missing annotations block — never warn.

True Zero Enumeration

No function name lists. No regex patterns. No stdlib defaults. AI provides ALL semantic information — Acutis provides formal verification.

Multi-Language

Python, JavaScript, and PHP via tree-sitter. Detects cross-language vulnerabilities spanning client-server boundaries.

Proof Artifacts

Every verdict includes property flow traces, trust assumptions, and remediation guidance. Auditable proofs — not just pass/fail.

Works Everywhere

Cursor, VS Code, Claude Desktop, and Windsurf. One-click install or manual config. Cloud-hosted with OAuth 2.1.

Extensible

Adding a new CWE requires ~30–50 lines. Define a security property, a boundary constraint, and a category. No function databases.

The Type System Paradigm

Existing tools (Semgrep, CodeQL) maintain human-curated function databases. Acutis eliminates that entirely.

Traditional Approach

Human-maintained function databases
Pattern enumeration (regex, AST patterns)
Scales poorly for novel AI-generated code
Heuristic-based — bypassable

Acutis Approach

AI declares function semantics
Formal property lattice verification
Works with any function, any library
Zero Trust — no heuristic bypass

What It Detects

Currently shipping with CWE-79 and CWE-89 detection. Extensible to any CWE expressible as property constraints.

CWE-79

Cross-Site Scripting (XSS)

Detects user-controlled data flowing to HTML output sinks without proper escaping. Tracks MAY_CONTAIN_HTML_META and MAY_BE_URL_ENCODED properties.

innerHTML document.write .html() Jinja2 |safe

CWE-89

SQL Injection

Detects user-controlled data in SQL query strings without parameterization or escaping. Tracks MAY_CONTAIN_SQL_META property through the flow.

cursor.execute mysql_query f-string SQL string concat

Future

Extensible Architecture

Adding a new boolean-taint CWE requires ~30–50 lines: a SecurityProperty enum, a BOUNDARY_CONSTRAINTS entry, and a BoundaryCategory enum.

CWE-22 Path Traversal CWE-120 Buffer Overflow CWE-190 Integer Overflow

Your security tools were built for
human-written code.

See It in Action

Get Started in Seconds

Add to Cursor Instantly

Manual Config

Add to VS Code Instantly

Manual Config

Claude Desktop

JSON Config

Windsurf

JSON Config

Under the Hood

Zero Trust by Default

True Zero Enumeration

Multi-Language

Proof Artifacts

Works Everywhere

Extensible

The Type System Paradigm

Traditional Approach

Acutis Approach

What It Detects

Cross-Site Scripting (XSS)

SQL Injection

Extensible Architecture

Human-written code had its tools.
AI-generated code has Acutis.

Your security tools were built for human-written code.

See It in Action

Get Started in Seconds

Add to Cursor Instantly

Manual Config

Add to VS Code Instantly

Manual Config

Claude Desktop

JSON Config

Windsurf

JSON Config

Human-written code had its tools.AI-generated code has Acutis.

Your security tools were built for
human-written code.

Human-written code had its tools.
AI-generated code has Acutis.