RuleFix documentation
RuleFix checks code and websites against privacy and security frameworks — DPDP, GDPR, SOC 2, HIPAA, PCI DSS, ISO 27001, CCPA and LGPD — and helps your AI coding agent fix what it finds. Start with the quickstart, or jump to a section below.
On this page
How RuleFix fits together
Your AI coding agent
Sends changed files to the MCP server (10 tools).
Imported repositories
GitHub App or public GitHub, GitLab, Bitbucket URL.
Your public website
Up to 12 pages read, 21 checks.
RuleFix engines
18 deterministic code rules and 21 website checks, mapped to 8 frameworks. Same input, same findings.
Your workspace
Projects, issues, framework coverage, evidence reports and an audit log.
- The rule engine reads code as text — it never runs or imports it — and reports findings with the exact line, severity, framework, a stable fingerprint and how to fix it. See every rule in the rules reference.
- The MCP server lets Claude Code, Cursor, VS Code and Windsurf check code before and after they write it, get a fix, verify it and record the result. Set it up with the MCP server guide.
- Dashboard scans read an imported repository server-side and track findings as issues over time. See Importing code.
- Website scans check your public site for a privacy notice, cookie consent, safe forms and security headers. See Website scans.
- The workspace holds projects, issues, framework coverage and printable evidence reports. See Dashboard & reports.
Engineering guidance, not legal advice
RuleFix findings point to code and configuration that commonly breach a requirement. A clean scan does not mean you are compliant.
Explore the docs
Frameworks covered
Every code rule and website check maps to one or more frameworks. Pick the frameworks for each project; only matching rules run. Counts below are generated from the live rule catalogue.
| Framework | Code rules | Website checks |
|---|---|---|
| DPDP · India | 5 | 17 |
| GDPR · Europe | 5 | 16 |
| SOC 2 · Global | 9 | 11 |
| HIPAA · US | 2 | 4 |
| PCI DSS · Global | 8 | 9 |
| ISO 27001 · Global | 8 | 11 |
| CCPA · US · California | 2 | 6 |
| LGPD · Brazil | 4 | 7 |
- Code rules
- 5
- Website checks
- 17
- Code rules
- 5
- Website checks
- 16
- Code rules
- 9
- Website checks
- 11
- Code rules
- 2
- Website checks
- 4
- Code rules
- 8
- Website checks
- 9
- Code rules
- 8
- Website checks
- 11
- Code rules
- 2
- Website checks
- 6
- Code rules
- 4
- Website checks
- 7
Connect your AI agent
The fastest way to start is the remote MCP server at https://rulefix.in/mcp. Create an API key under Settings → API keys, then add the server. For Claude Code:
claude mcp add --transport http rulefix https://rulefix.in/mcp --header "Authorization: Bearer rf_live_your_api_key"Cursor, VS Code and Windsurf configs, every tool and the limits are in the MCP server guide. New to RuleFix? Follow the quickstart.
Not available yet
These are on the roadmap but do not exist yet. Don't build on them; today, use the MCP server for anything programmatic.
Command-line interface
There is no published RuleFix CLI package yet. To scan local files, connect your coding agent over MCP and ask it to run rulefix_scan_files.
IDE extensions
There are no RuleFix editor extensions yet. Editors with MCP support — Cursor, VS Code and Windsurf — can use the MCP server today.
CI/CD integration
There is no RuleFix GitHub Action or pipeline integration yet. To keep findings current, use Scan now on imported repositories (how scans work) or have your agent call rulefix_report_scan.
REST API
A public REST API is planned. Read the REST API status page for what is coming and what to use instead.