Protect a Lovable app without leaving the build flow.
Connect Guarita once, ask Lovable to protect the current app, approve the target, and publish. Guarita verifies the public proof in the background and, when your plan has an available app slot and the target is eligible, starts the first scan.
Connect Guarita as a chat connector
Custom MCP connections are personal to the Lovable builder and are not bundled into the published app. Lovable supports custom remote MCP servers on every plan, although a workspace admin can disable them.
- 01
Open Connectors
In Lovable, open Connectors, select the plus button, then choose MCP server.
- 02
Add Guarita
Name it “Guarita” and paste
https://api.guarita.dev/mcpas the Server URL. - 03
Keep OAuth
OAuth is the default. Select Add & authorize; never create or paste a personal API token.
- 04
Approve access
Sign in to Guarita, review the permissions, and return automatically to Lovable.
This page can open Lovable's Connectors catalog, but Lovable does not currently document an install link that pre-fills Guarita. Until Guarita has a catalog card or is listed in your workspace registry, the Server URL must be pasted once.
Ask, confirm, publish
“Protect this app with Guarita.”
Lovable identifies or asks for the stable published URL, asks you to confirm that you control the app and authorize the scan, then adds the persistent verification file.
- Proof preparedLovable adds a harmless public verification file to the project.
- You approve publicationLovable uses its native publish flow and asks for approval when required.
- Guarita checksOnce the stable URL is known, background checks continue even if the browser is closed.
- First scan startsAfter control is proven, an eligible target with an available plan slot is queued automatically.
Lovable does not expose a documented publish webhook to a custom MCP server. Its agent can still publish through the native tool and pass the resulting stable URL to Guarita in the same chat turn. If the turn is interrupted, ask it to resume; there is no separate “verify” button in Guarita.
Use a stable, publicly reachable URL
Published app
Use the production lovable.app URL or a public custom domain.
Workspace-only site
External verification cannot reach a site restricted to workspace members.
Temporary preview
A shared preview expires and should not become the protected production target.
OAuth access is not ownership proof
Credentials stay server-side
OAuth tokens are revocable and never returned to the browser, exposed in the project, or copied into Lovable source code. The published verification value is scoped to one onboarding and remains in place for periodic control checks — it is not an API credential.
Every target is authorized separately
Connecting the MCP identifies your Guarita account. It does not prove control of an arbitrary URL. Lovable asks for explicit authorization and Guarita waits for the proof to appear at that exact hostname before enabling deeper tests.
Understand progress and recover safely
| Status | Meaning | Next action |
|---|---|---|
| Awaiting publication | The proof was prepared but is not public yet. | Publish the current Lovable version. |
| Confirming / restoring proof | Guarita is checking the exact public URL, including periodic proof revalidation. | Wait, or restore and publish the verification file if prompted; no Guarita tab must stay open. |
| Verified / first scan | Ownership is proven and the scan is queued or running. | Ask Lovable for status or open Guarita Apps. |
| Private target | The scanner received an authentication or workspace-only response. | Publish publicly or use a public custom domain. |
| Plan limit | No app slot is currently available in your Guarita plan. | Upgrade the plan, then ask Lovable to start the protection again. |
| Content mismatch | A previously valid proof changed or disappeared. | Restore the same verification file and publish again. |
| Expired | The initial proof was not found before its challenge expired. | Start a new onboarding in Lovable to receive a fresh challenge. |
Disconnect without losing verified apps
In Guarita, open Settings → Integrations and revoke the Lovable OAuth grant. Then remove the chat connector in Lovable Connectors if you no longer want it listed there.
Revocation blocks new MCP calls immediately. Apps already verified through the public file and their scan reports remain subject to Guarita’s normal retention and account controls; removing the published proof makes the standing verification expire.