Compliance checks
inside your coding agent.

1. Step 1

   Create an API key

   In the dashboard, open Settings → API keys. The key is shown once; RuleFix keeps only a hash.

2. Step 2

   Add the server

   Paste the config for your client below and replace the placeholder key with yours.

3. Step 3

   Ask your agent

   Try “Scan the files I changed with RuleFix”. The agent discovers the ten tools on its own.

Claude CodeCursorVS CodeWindsurf

Terminal

claude mcp add --transport http rulefix https://rulefix.in/mcp --header "Authorization: Bearer rf_live_your_api_key"

• Claude Code: Add --scope project to share it with your team via .mcp.json (keep the key in an env var).
• VS Code: VS Code prompts for the key once and stores it securely.

Checks · don't touch your workspace

• Scan filesRead-onlyrulefix_scan_filesCheck file contents against DPDP, GDPR, SOC 2, HIPAA, PCI DSS and more. Returns findings with exact lines and fixes.
• Check a snippetRead-onlyrulefix_check_snippetCheck code before writing it to a file, so the agent never introduces a violation.
• Suggest a fixRead-onlyrulefix_suggest_fixGet a compliant rewrite for a finding: AI-generated when enabled, otherwise the rule's reference fix.
• Verify a fixRead-onlyrulefix_verify_fixRe-scan the edited file and confirm the finding is gone and nothing new was introduced.
• Explain a ruleRead-onlyrulefix_explain_ruleWhat a rule checks, why the regulation cares, and how to comply.
• List rulesRead-onlyrulefix_list_rulesThe rule catalogue, filtered by framework.

Workspace · your projects and issues

• List projectsRead-onlyrulefix_list_projectsProjects in your RuleFix workspace, with their frameworks and latest score.
• Get open issuesRead-onlyrulefix_get_issuesOpen findings from your dashboard (repository and website scans, earlier reports) so the agent can fix them in your codebase.
• Report a scanWrites to workspacerulefix_report_scanScan files and record the results in a project, so your team and auditors see them in the dashboard.
• Resolve an issueWrites to workspacerulefix_resolve_issueMark an issue fixed — only after RuleFix re-scans the submitted file and confirms the finding is gone.

1. YYouAdd a signup endpoint that stores the user's email and name.
2. AAgentChecking the handler with RuleFix before I write it.↳ rulefix_check_snippet · app/api/signup/route.ts
3. RuleFixHigh · DPDP, GDPR. Personal data is stored without a consent record. Fix: record consent with a timestamp and the policy version.
4. AAgentAdded a consent record and re-checked the file.↳ rulefix_verify_fix · finding resolved, no new findings
5. AAgentSaved the scan to your project.↳ rulefix_report_scan · web-app

• Processed in memory

  File contents your agent sends are scanned in memory to produce findings. Checking code doesn't save it.

• Stored only when reported

  rulefix_report_scan saves findings (rule, file, line, severity) and a short code excerpt per finding, encrypted per organisation.

• AI fixes are optional

  Your code goes to a model provider only when AI fixes are enabled. Otherwise you get the rule's reference fix.

• Your agent chooses

  A remote server can't read your disk. The agent sends only the files it picks, and edits stay under its permission settings.

• Keys you control

  Keys are stored as hashes and can be revoked in the dashboard at any time. Requests are rate-limited per key.

• No code in logs

  File contents, snippets and API keys are never written to server logs.

More on how we protect data on the security page.