Cycling through all six. Tap any point to stop.

Measured on six things

Weekly security audits for vibe-coded sites, explained in...

Growth

Sharp wedge: security autopilot for indie devs and 'vibecoders', with a human UI plus API/MCP for AI agents — a lane Intruder and Detectify don't foreground. $5/month Pro undercuts enterprise scanners. Early stage (domain ~0.5 years old).

Screenshots

1 / 1

Magery Forge

About this app

Magery Forge is a security auditing tool built for developers who ship fast and may not have a security team. It automatically checks your website's DNS, TLS, security headers, exposed files, and more on a weekly basis, delivering reports that explain each risk in plain English along with a concrete fix. The tool offers both passive checks (available immediately) and active checks (after domain verification), covering everything from SSL configuration to secret leaks and outdated components. What sets Forge apart is its dual interface: a friendly UI for humans and an API/MCP integration for AI agents like Cursor or Claude, allowing automated scans and report retrieval. Pricing is straightforward: a free tier for one domain with weekly checks, Pro at $5/month for three domains with subdomains, and custom enterprise options. For anyone who's ever rushed a site live without a security review, Forge acts as a safety net, ensuring you're not leaving the door open for attackers.

Key features

1Automated weekly security audits covering DNS, TLS, headers, exposed files, secret leaks and outdated components.
2Passive checks run instantly; active checks unlock after domain verification via email or TXT record.
3Plain-English findings with concrete remediation steps instead of raw technical noise.
4Dual interface: human-friendly UI plus API/MCP integration for AI agents like Cursor, Copilot and Claude.
5Simple pricing: free for one domain, $5/month Pro for three domains plus subdomains, custom enterprise.

Target customer profile

Drawn from the product itself, not from a survey.

Demographic

Indie developers and solo founders

Pain points

Lack of security expertise; no time for manual audits; fear of exposing user data.

Primary needs

Affordable, automated security checks with clear remediation steps.

Demographic

Vibe coders (rapid prototypers)

Pain points

Ship fast but skip security; unsure how to verify if their site is secure.

Primary needs

Quick, non-technical security reports integrated into their workflow.

Demographic

Small development teams

Pain points

No dedicated security personnel; limited budget for enterprise tools.

Primary needs

Scalable security monitoring with agent integration for automation.

Scout Review

Written by AI from measured evidence, scored out of 100.

Magery Forge is a security auditing tool aimed squarely at indie developers and solo founders who ship fast and skip security reviews. It runs passive checks (DNS, TLS, headers, SEO, OG) instantly and unlocks active checks (crawling, forms, secret leaks, outdated components) after domain verification, then delivers plain-English findings with concrete fixes on a weekly cadence. The dual interface — friendly UI for humans, API/MCP for AI agents — is the standout idea and a genuine differentiator against Intruder and Detectify. Pricing is refreshingly simple: free for one domain, $5/month Pro for three domains plus subdomains, custom enterprise. The site is fast (98 mobile / 100 desktop Lighthouse) and accessible (97), but the product's own security posture has gaps — no CSP, Referrer-Policy or Permissions-Policy, and no published audit — which is awkward for a security vendor. Design is clean but screenshot-light, and the 'Beta' label signals the product is still maturing.

Measure by measure

Usability

Domain-first onboarding (type domain, verify via email/TXT, run checks) is fast to value. Passive checks run instantly, active checks unlock after verification. Two onboarding videos and a checks catalogue help; plain-English findings are the core promise.

Design

Clean, modern dark-accented landing page with a clear hero, domain-check input above the fold, a numbered 5-step flow and a tidy 3-tier pricing block. Consistent typography and spacing; leans on feature cards rather than real product screenshots.

Speed

Lighthouse mobile 98/100 (LCP 954ms, CLS 0, TBT 27ms) and desktop 100/100. The marketing site is lightweight and snappy, with no reported lag complaints in the collected evidence.

Security

HTTPS enforced with HSTS, frame protection and nosniff present; SPF and DMARC configured. Missing CSP, Referrer-Policy and Permissions-Policy (8/12 probe points). No SOC 2, ISO or bug-bounty page found — notable for a product that sells security.

Accessibility

Lighthouse accessibility 97/100 with one failing audit ('links do not have a discernible name'). Responsive layout and readable contrast; no published WCAG statement or a11y page found in the fetched content.

Growth

Improvement areas

Own-site security headers: add CSP, Referrer-Policy and Permissions-Policy to pass its own probe.
Trust signals: publish a security page, pen-test summary or bug bounty to back the security pitch.
Landing page: replace stock feature cards with real product screenshots and a sample report.
Accessibility: fix the unnamed-links audit and add a short WCAG statement.

Design & Usability

The landing page is confident and clean: a dark-accented hero with a domain-check input, a five-step 'how it works' flow, and a three-tier pricing block that's easy to scan. Design is consistent but relies on feature cards over real product screenshots, and the 'Beta' badge is front and center. Usability is where Forge earns its keep — onboarding is domain-first (type, verify via email/TXT, scan), passive checks run instantly, and active checks unlock after ownership verification. Two onboarding videos and a checks catalogue support the flow, and the plain-English framing ('Your site allows unencrypted connections — here's how to turn on protection') is the right instinct for a non-security audience. The friction is that the value story is spread across five steps when a single 'Scan my site' button would say more.

Speed & Security

Speed is a genuine strength: Lighthouse mobile 98/100 with LCP under a second, CLS 0 and TBT 27ms, and a perfect 100 on desktop. The marketing site is lightweight and there are no lag complaints in the collected evidence. Security is more mixed. The probe confirms HTTPS enforcement, HSTS, frame protection, X-Content-Type-Options, SPF and DMARC — solid table stakes. But CSP, Referrer-Policy and Permissions-Policy are all missing (8/12 checklist points), and there's no SOC 2, ISO certification, pen-test report or bug bounty page in the fetched content. For a product whose entire pitch is 'we find your security gaps', shipping a site with its own header gaps and no published audit is a credibility problem worth fixing before charging anyone.

Accessibility & Growth

Accessibility scores 97/100 on Lighthouse with a single failing audit — links without a discernible name — plus responsive layout and readable contrast. There's no WCAG statement or dedicated a11y page, which is normal for an early-stage tool but worth adding as the product matures. Growth is the most interesting dimension. The wedge is specific: indie devs and 'vibecoders' who ship fast without a security team, served by a human UI plus API/MCP integration for AI agents like Cursor and Claude. That agent angle is a real differentiator against Intruder and Detectify, which are built for teams with security staff. The $5/month Pro price undercuts enterprise scanners and the free tier lowers the try barrier. The honest limit: the segment is price-sensitive and may treat security as optional until something breaks, so retention depends on making the weekly report feel indispensable rather than nagging.

Conclusion

Forge is a smart bet on an underserved audience: developers who won't buy enterprise scanners but might pay five bucks a month to stop shipping obvious holes. The agent integration is the kind of wedge that gets more valuable as AI-assisted coding spreads. To convert that promise into trust, the team should close its own header gaps, publish a security page or pen-test summary, and put real product screenshots on the landing page. If it does, Forge has a credible shot at being the default security net for the vibe-coding era.

Suggestions for improvement

Add CSP, Referrer-Policy and Permissions-Policy to forge.magery.ai — a security scanner shouldn't fail its own probe.
Publish a security/trust page with pen-test results or a bug bounty to back the 'we find your gaps' pitch.
Replace stock feature cards with real product screenshots and a sample report on the landing page.
Fix the 'links do not have a discernible name' audit and add a short WCAG/accessibility statement.

How we score

Alternatives comparison

Named competitors, point by point. Nobody paid to appear here or to be left out.

	Magery Forge	Intruder	Detectify
Pricing entry point	Free tier (1 domain, weekly checks); Pro $5/month for 3 domains + subdomains	Paid plans, quote-based; no free tier advertised	Paid plans, quote-based; trial available on request
Target audience	Indie devs, solo founders, 'vibecoders' without a security team	SMBs and teams with some security capacity	Security teams and dev teams at growing companies
AI agent / API integration	API + MCP for Cursor, Copilot, Claude, OpenClaw	API available; no MCP/agent-native integration advertised	API available; no MCP/agent-native integration advertised
Plain-English remediation	Every finding ships as a plain-English risk plus concrete fix steps	Remediation guidance included, more technical in tone	Remediation advice with crowd-sourced vulnerability context
Automated weekly monitoring	Weekly automatic check with email report on every plan	Continuous scanning and monitoring	Continuous scanning with asset monitoring