Storafix Guard API

The Guard API lets you run security scans, retrieve findings, open auto-fix pull requests and query your monthly action quotas. It is used by developers, CI pipelines and AI coding agents alike. Two surfaces are available:

• REST v1 — standard HTTPS/JSON endpoints under /api/v1/*.
• MCP — a Model Context Protocol server at /mcp for AI agents.

1. Create an account and open the Developer space.
2. Click Create key, pick test or live, copy the revealed key (shown once).
3. Make your first call:

curl https://guard.storafix.com/api/v1/usage \
  -H "Authorization: Bearer sk_test_your_key_here"

Every REST v1 request must include your API key in the Authorization header (bearer scheme). The x-api-key header is accepted as a fallback.

Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

• sk_test_… — sandbox key. Requests are authenticated but consume no quota. Perfect for CI and local dev.
• sk_live_… — production key. Successful actions consume your monthly action quota.

Revoked or malformed keys return 401 Unauthorized.

POST /api/v1/scan/live

Run an SSRF-safe live URL scan. Consumes one scan from your monthly quota (live mode).

curl -X POST https://guard.storafix.com/api/v1/scan/live \
  -H "Authorization: Bearer sk_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

{
  "id": "b1c…",
  "url": "https://example.com/",
  "score": 82,
  "findings": [
    { "id": "hsts", "severity": "medium", "title": "HSTS missing" }
  ],
  "scanned_at": "2026-07-25T09:14:22Z"
}

GET /api/v1/scans

List the calling user's most recent live scans. Query ?limit=1..200.

curl https://guard.storafix.com/api/v1/scans?limit=20 \
  -H "Authorization: Bearer sk_live_xxx"

{
  "mode": "live",
  "count": 2,
  "scans": [
    { "id": "b1c…", "url": "https://example.com/", "score": 82, "scanned_at": "…" }
  ]
}

GET /api/v1/usage

Return your monthly action quotas and current consumption. Free, consumes no quota.

curl https://guard.storafix.com/api/v1/usage \
  -H "Authorization: Bearer sk_test_xxx"

{
  "period": "2026-07",
  "plan": "dev",
  "quotas": {
    "scans":       { "used": 12, "limit": 1000, "remaining": 988 },
    "ai_analyses": { "used": 3,  "limit": 300,  "remaining": 297 },
    "auto_fixes":  { "used": 0,  "limit": 100,  "remaining": 100 }
  }
}

null for limit and remaining means no monthly quota, subject to a fair-use throughput limit.

Plug your AI coding agent (Cursor, Claude Desktop, Copilot Chat, custom LangChain, …) directly into Guard using the Model Context Protocol. The agent authenticates via OAuth against your Guard account, then calls tools on your behalf.

Server URL:  https://guard.storafix.com/mcp
Transport:   HTTP (Streamable)
Auth:        OAuth 2.1 (Supabase issuer)

Available tools

• list_my_projects — list your Guard projects.
• list_scan_results — recent findings for a project.
• get_usage — current plan, monthly quotas and consumption.
• scan_url — run a live URL scan (consumes one scan).
• auto_fix_dependency — open a PR that bumps a vulnerable dependency (consumes one auto-fix).

Example prompt inside Cursor after connecting Guard:

Scan https://staging.myapp.com and if you find a vulnerable
npm dependency in the latest scan, open a fix PR.

Any sk_test_ key runs in sandbox mode: requests are fully authenticated and rate-limited, but quota-consuming actions return realistic mocked responses and never consume quota. Ideal for CI, integration tests and local development.

Actions are metered as monthly quotas, reset on the first day of each calendar month. Unused actions do not carry over. Quotas depend on your plan — see Developer space or call GET /api/v1/usage.

Attestations are billed per unit in USD, outside the quota system — $19 standard, $99 white-label. Each paid plan includes a monthly quota of attestations.

Requests per minute per API key, based on the owning account's plan:

• Sandbox — 30 req/min
• Dev — 60 req/min
• Scale — 300 req/min
• Business — 1,000 req/min

Exceeding the limit returns 429 Too Many Requests. The window is a fixed 60-second window per key.

• 400 — invalid or missing request parameters.
• 401 — missing, malformed, invalid or revoked API key.
• 403 — account disabled or plan does not include this feature.
• 429 — rate limit exceeded, or monthly quota exhausted (quota_exceeded).
• 500 — internal error; safe to retry with backoff.

Error responses share this shape:

{ "error": "quota_exceeded", "action": "scan", "used": 1000, "limit": 1000,
  "upgrade": "https://guard.storafix.com/#pricing" }

Dedicated developer plans, independent from the product tiers.

Prices in USD. Billing coming soon — sandbox is available immediately from the Developer space.