complyeah
Integrations

Findings should reach the agent that can fix them.

Connect complyeah to your AI coding workflow. Your agent reads the finding and remediation, changes your code, helps deploy it, then asks complyeah to independently re-verify the live site.

Create an API key Connect with MCP

Slack notifications

Send scan completion, new finding, and verified fix updates to your chosen Slack channel.

Connect Slack

Linear issues

Create one issue per new finding and add an update when complyeah verifies a fix.

Connect Linear

Signed webhooks

Deliver scan and finding events to your HTTPS endpoint with HMAC signatures and retry history.

Read contract

GitHub Issues

Draft an issue from a finding with remediation guidance and a private report link. Review before posting.

Open report

MCP server

Give Claude, Cursor, Codex, and other MCP clients structured access to domains, findings, reports, and re-verification.

Setup guide

ChatGPT skill

Use a report or remediation task to guide your agent through fix → deploy → verify. MCP access is optional.

Download skill

REST API

Use bearer-token JSON endpoints for custom automations, CI, reports, and external security.

Open API docs
Outbound webhooks

Route verified work to your own systems.

Organization owners and admins can create a destination in the Integrations panel. Subscribe to scan completed, finding created, or finding fixed events. We show the signing secret once and record each delivery and retry.

Verify each request

Compute HMAC-SHA256 with the signing secret over the timestamp, a period, and the raw body. Compare it with X-Complyeah-Signature in constant time and reject timestamps older than five minutes.

Handle retries safely

Deduplicate by X-Complyeah-Event-ID and return 2xx promptly. Temporary failures retry automatically. Payloads carry a private report path, not raw vulnerability evidence.

MCP server

A verified fix loop, inside your agent.

The MCP server is a thin client of your complyeah account. The API key stays in the client environment, outside the model conversation. Reads and finding re-verification are free; paid scans keep the same account allowances.

  1. 1

    Read the evidence

    The agent retrieves exact findings, affected targets, and remediation guidance.

  2. 2

    Apply and deploy

    It edits your own code or hosting configuration. Complyeah never receives repository access.

  3. 3

    Re-verify independently

    The agent calls complyeah against the live site. Only that check can mark the finding fixed.

MCP client configurationstdio
{
  "mcpServers": {
    "complyeah": {
      "command": "npx",
      "args": ["-y", "complyeah-mcp@latest"],
      "env": { "COMPLYEAH_API_KEY": "cmply_live_..." }
    }
  }
}
Create the key under API in your account, add this configuration to your MCP client, and restart the client.
Agent skill

The workflow, not just the tools.

Upload the complyeah skill in ChatGPT and give it a report or remediation task. It guides the agent through inspection, a fix, deployment, and independent verification. In an MCP-enabled coding client, it can also read findings directly from complyeah.

Read security evidence
Apply fixes in the customer's repository
Re-verify findings on the live domain
Keep credentials outside model context

ChatGPT skill package

Download the skill ZIP below. In a ChatGPT workspace agent, choose Add skill and upload it.
Download skill ZIP

No API key is included. The skill works from a report you provide; a separate MCP client can add direct account access.

Building your own integration?

The API reference remains a separate, focused developer document with authentication, endpoints, errors, and examples.

Read the API docs