docs / how-it-integrates

Integrations

MCP setup for every IDE, CI/CD, alerts, and team access — all integration surfaces in one place.

⏱ 8 min read

IDE — MCP server

Add one entry to your IDE's MCP configuration file. The ekmire MCP server uses the stdio transport and runs locally.

Cursor

Edit ~/.cursor/mcp.json (or the project-level .cursor/mcp.json):

{
  "mcpServers": {
    "ekmire": { "command": "ekmire", "args": ["mcp", "start"] }
  }
}

Claude Code

Add to ~/.claude/settings.json under mcpServers:

{
  "mcpServers": {
    "ekmire": { "command": "ekmire", "args": ["mcp", "start"] }
  }
}

Continue.dev

In ~/.continue/config.json:

{
  "experimental": {
    "modelContextProtocolServers": [
      { "transport": { "type": "stdio", "command": "ekmire", "args": ["mcp", "start"] } }
    ]
  }
}

Zed

In ~/.config/zed/settings.json:

{
  "context_servers": {
    "ekmire": { "command": { "path": "ekmire", "args": ["mcp", "start"] } }
  }
}

NOTEThe MCP server runs in deterministic mode by default (<50ms, no network). To enable AI-backed analysis in the IDE buffer, pass --mode=full as an argument and configure an LLM provider in the dashboard.

CI/CD — GitHub Actions

Add Build Guard scanning to your CI pipeline. Findings are uploaded to GitHub Security → Code Scanning as SARIF annotations on pull requests.

1. Create .github/workflows/ekmire.yml in your repo (template also in ekmire-backend/templates/):

name: ekmire Security Scan
on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: "0 3 * * *"

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - run: pip install ekmire
      - name: Deep scan (SARIF)
        env:
          EKMIRE_API_KEY: ${{ secrets.EKMIRE_API_KEY }}
        run: ekmire scan --deep . --output sarif --fail-on high > results.sarif
        continue-on-error: true
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: results.sarif

2. Add your project API key as a GitHub Actions secret named EKMIRE_API_KEY.

NOTEWithout EKMIRE_API_KEY, the scan runs in offline mode — deterministic rules only, no telemetry to the dashboard. The SARIF upload still works.

Proxy — upstream patterns

The EKMIRE_UPSTREAM variable accepts any HTTP URL reachable from the proxy container.

SCENARIO	EKMIRE_UPSTREAM VALUE
Docker Compose service named `app` on port 3000	`http://app:3000`
Localhost service (bare-metal deploy)	`http://host.docker.internal:3000`
Kubernetes ClusterIP service	`http://my-service.default.svc.cluster.local:80`
External service (staging)	`https://staging.example.com`

Alerts — Slack, email, webhook

Configure alert destinations in the Dashboard → Alerts tab. Alerts fire when an event meets the configured severity threshold.

Slack

Create an incoming webhook in your Slack workspace: Settings → Integrations → Incoming Webhooks. Paste the URL into the ekmire dashboard. ekmire posts a formatted message with severity, rule ID, and a link to the event detail.

Email

Enter one or more email addresses. ekmire sends via Resend with a plain-text and HTML body.

Generic webhook

Any HTTPS endpoint. ekmire POSTs a JSON body:

{
  "event_type": "proxy.block",
  "severity": "critical",
  "rule_id": "PROMPT_INJECTION",
  "project_id": "...",
  "payload_hash": "sha256:...",
  "timestamp": "2026-05-30T10:00:00Z"
}

Team — roles and access

Available on Pro and Team plans. Invite members from Dashboard → Team → Invite.

ROLE	CAN DO
owner	Everything — billing, API keys, rules, alerts, team management.
admin	Rules, alerts, events. Cannot change billing or rotate keys.
member	View events and rules feed. Read-only.

API keys are scoped to a project, not a team member. Rotating a key invalidates all proxy and CLI instances using that key immediately.

Self-hosted control plane

The ekmire API and proxy can be deployed entirely on your own infrastructure. Use docker-compose.selfhost.yml from the repo root.

Requirements:

A Supabase project (cloud or self-hosted) with migrations applied from supabase/migrations/
A .env.selfhost file based on .env.selfhost.example

Once running, point your CLI and proxy to your local control plane by setting EKMIRE_CLOUD=http://localhost:8000.

How ekmire works