What is the Pugi remote MCP server?
The Pugi remote MCP server is a hosted Model Context Protocol endpoint at https://api.pugi.io/api/agent/v1/mcp, so AI assistants can connect to it without installing or running anything locally.
Pugi MCP ServerVerifiedFeatured
@Pugi Inc.
Basic information
Transport
Streamable HTTP
Authentication
API Key
Category
Developer Tools
Author
Pugi Inc.
Submitted by
Pugi Team
About Pugi MCP Server
Pugi is an AI product team that builds, checks and publishes websites and apps. Its MCP server gives agents a passive website security check graded A+ to F (headers, TLS, cookies, exposed keys in scripts), free with a no-signup agent key (10 checks a day), plus credit balance, card top-up links, published app status, and paying for credit with USDC on Base over x402. Create a key with POST https://api.pugi.io/api/agent/v1/keys; docs at https://pugi.io/agents.md.
Connection details
https://api.pugi.io/api/agent/v1/mcpSetup
claude mcp add pugi --transport http https://api.pugi.io/api/agent/v1/mcpPugi MCP Server tools
7Shows the credit balance of this account in USD, what this key spent today, its daily spend cap, and the price of each tool. Paid tools spend this balance; when it runs out, ask a person to add credit with buy_credits_link, or pay with add_credit (a business purchase).
Returns a card checkout link for this account. A person opens it and pays there. This tool never charges anything by itself. Tax, where it applies, is added at checkout.
A free, passive, read-only check of a public website: HTTPS and the redirect to it, five security headers, cookie flags, and the page's own scripts read for leaked keys. Returns a grade from A+ to F, counts by severity and the most serious finding. 10 checks a day per key. It is not a pentest and does not prove a site is secure.
Draws four whole logos for a business name: the name set as lettering with a drawn mark (a lockup, a wordmark, an emblem and a second lockup), PNG on white, returned as images. Three free calls a day per key (512 px logos), then $0.25 a call from prepaid credit (1024 px logos), charged only when at least one logo comes out; if none does, nothing is charged. Pass an idempotency_key so a retry of the same call is never charged twice. industry and description only choose the kind of imagery; they are not drawn as text. Names of well-known brands are refused.
Lists the apps this account has published, newest first, with their status and live address. Pass project_id to see one project.
Free. Searches the public Pugi catalogue of published sites and apps people built with Pugi. Filter by words in the title or description, tags (a card must carry all of them) and one category. Each result has a title, a short description, tags, a preview image, its public page on pugi.io and a start_from_this_url: the Pugi console with a brief for a new project like it (a person signs in there; it does not copy the code).
Checks a public GitHub repository branch for leaked secrets, vulnerable or malicious dependencies and risky code, and returns each finding with its severity, rule, file and line (or package) and a short fix hint, plus a summary. No code is run. $1 from prepaid credit, charged only when the check finishes; a failed check costs nothing. Pass an idempotency_key: a check can take a few minutes, and when the answer is state "running", call again with the same idempotency_key and repo_url to collect the result (never charged twice). Private repositories, other hosts, tags and commit SHAs are not supported yet; repositories up to 50 MB.
Overview
What is Pugi?
Pugi is an AI product team that builds, checks and publishes websites and apps. This MCP server is how agents use it.
Tools
| Tool | What it does | Price |
|---|---|---|
scan_url | Passive, read-only security check of a public website, graded A+ to F: security headers, TLS, cookies, keys exposed in scripts. It is not a pentest. | Free, 10 a day per key |
get_balance | Credit balance, today's spend, the daily cap and the price list. | Free |
buy_credits_link | A card checkout link a person opens to add credit. It never charges by itself. | Free |
publish_status | Status and address of the apps this account has published. | Free |
Get a key
curl -X POST https://api.pugi.io/api/agent/v1/keys
No signup. A new key comes with $0.50 of credit. Send it as Authorization: Bearer pugi_agent_... (or in the X-Pugi-Agent-Key header).
Paying without a person
When credit runs out, a paid call answers HTTP 402 with two ways to pay: a card through an agent wallet (Stripe Shared Payment Token over MPP) or USDC on Base over x402. Agent payments are business purchases; buyers in the EU and the UK need a valid VAT number.
Links
- Docs for agents: https://pugi.io/agents.md
- Server card: https://api.pugi.io/.well-known/mcp/server-card.json
- Official MCP Registry:
io.pugi/pugi - Website: https://pugi.io
Frequently asked questions
How do I connect to the Pugi MCP server?
Add the endpoint https://api.pugi.io/api/agent/v1/mcp to any MCP-compatible client such as Claude Code, Cursor, or VS Code. The setup snippets on this page configure each client in one step.
Does the Pugi MCP server require authentication?
Yes. Pugi requires an API key — check the official documentation for how to obtain one, then include it in your client's configuration.
Which transport does the Pugi MCP server use?
Pugi exposes a Streamable HTTP endpoint, the transport used by remote MCP servers and supported by all major MCP clients.
More remote MCP servers
A
Aayat AI
Pay-per-use data and tools for AI agents: crypto token safety and rug checks, web search with cited answers, page-to-Markdown, up-to-date library docs, package safety, company research and UK/EU open data. 160 tools, 20
A
AIS Gateway
CVE prioritization using exploitation signals, plus agent heartbeat monitoring and state capsules. Some tools use API-key or x402 access.
Aard
Aard connects Macroeconomic and other official data from 170+ publishers including World Bank, IMF, BIS, ECB, Eurostat, and National Statistical Offices. Aard is powered by a large graph of the metadata universe and an
AIsa
AIsa is one key for 950+ data APIs across SEO and AI visibility, finance, social, web search, sales and agent mail — the go-to-market data stack behind prospecting, competitor research and brand monitoring. Five tools ra
AdWhispr
Research competitors' winning ads, clone them for your brand and launch paused campaigns on Meta, Google and TikTok from chat.
Comments