How to Integrate Bolt.new with McAfee

McAfee and its enterprise successor Trellix are end-product security vendors, not API platforms for developers. McAfee does not publish API documentation for public use, and there is no registration path to obtain API credentials. Some enterprise security platforms (like Trellix's XDR) have internal APIs for their enterprise customers, but these are not accessible to independent web developers and require purchase of enterprise software licenses. For building security features in Bolt.new apps, three developer-friendly APIs cover the most common use cases. VirusTotal's free API tier allows 500 requests per day and 4 requests per minute — sufficient for most development and moderate production use. The API scans URLs, domains, IP addresses, and file hashes against 70+ security vendors' engines and databases. Get your API key from virustotal.com/gui/my-apikey after creating a free account. Google Safe Browsing is free for up to 10,000 requests per day per API key and requires a Google Cloud project. Enable it at console.cloud.google.com → APIs & Services → Library → search 'Safe Browsing API'. This API returns threat types (MALWARE, SOCIAL_ENGINEERING, UNWANTED_SOFTWARE, POTENTIALLY_HARMFUL_APPLICATION) for URLs in real time. Snyk's API is free for open-source projects and provides vulnerability data for npm, PyPI, Maven, NuGet, and other package ecosystems. Get your API token from app.snyk.io/account. The free tier provides 200 test runs per month. All three APIs use standard Bearer token or API key authentication and return JSON responses, making them straightforward to integrate from Bolt's Next.js API routes.

1// .env.local
2VIRUSTOTAL_API_KEY=your_virustotal_api_key
3GOOGLE_SAFE_BROWSING_KEY=your_google_api_key
4SNYK_API_TOKEN=your_snyk_api_token

VirusTotal provides two URL analysis approaches. The first is a URL scan: submit the URL to POST /urls and get back an analysis ID, then poll GET /analyses/{analysisId} for results. This works well for deep analysis but takes 30-60 seconds. The second is a URL lookup: if VirusTotal has previously seen the URL, GET /urls/{base64-encoded-url} returns cached results instantly. For a user-facing URL checker, use the lookup first and fall back to a fresh scan only if no cached result exists. The VirusTotal URL identifier is the base64 URL-safe encoding (no padding) of the URL. In JavaScript: btoa(url).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, ''). Google Safe Browsing uses a different model: you send a POST request to the Lookup API with a list of URLs and it returns which (if any) match known threat entries in Google's database. The response is immediate (no polling). The lookupThreatLists endpoint: POST https://safebrowsing.googleapis.com/v4/threatMatches:find?key={apiKey} with a JSON body specifying client info, threat types to check, and the URLs. Combining both APIs in a single endpoint gives you comprehensive URL safety data: VirusTotal provides coverage from 70+ security vendors (including McAfee, Kaspersky, Avast), while Google Safe Browsing specifically covers phishing and malware sites Google has indexed. Together they catch a higher percentage of threats than either alone. These outbound API calls work perfectly in Bolt's WebContainer during development — no deployment needed to test URL scanning.

1// app/api/security/check-url/route.ts
2import { NextRequest, NextResponse } from 'next/server';
3
4const VT_API = 'https://www.virustotal.com/api/v3';
5const SB_API = 'https://safebrowsing.googleapis.com/v4';
6
7const VT_KEY = process.env.VIRUSTOTAL_API_KEY ?? '';
8const SB_KEY = process.env.GOOGLE_SAFE_BROWSING_KEY ?? '';
9
10function urlToVtId(url: string): string {
11  return btoa(url).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
12}
13
14export async function POST(request: NextRequest) {
15  const { url } = await request.json();
16
17  if (!url || typeof url !== 'string') {
18    return NextResponse.json({ error: 'url is required' }, { status: 400 });
19  }
20
21  const [vtResult, sbResult] = await Promise.allSettled([
22    // VirusTotal URL lookup
23    fetch(`${VT_API}/urls/${urlToVtId(url)}`, {
24      headers: { 'x-apikey': VT_KEY },
25    }).then((r) => r.json()),
26
27    // Google Safe Browsing
28    fetch(`${SB_API}/threatMatches:find?key=${SB_KEY}`, {
29      method: 'POST',
30      headers: { 'Content-Type': 'application/json' },
31      body: JSON.stringify({
32        client: { clientId: 'bolt-security-scanner', clientVersion: '1.0' },
33        threatInfo: {
34          threatTypes: ['MALWARE', 'SOCIAL_ENGINEERING', 'UNWANTED_SOFTWARE'],
35          platformTypes: ['ANY_PLATFORM'],
36          threatEntryTypes: ['URL'],
37          threatEntries: [{ url }],
38        },
39      }),
40    }).then((r) => r.json()),
41  ]);
42
43  const vtData = vtResult.status === 'fulfilled' ? vtResult.value : null;
44  const sbData = sbResult.status === 'fulfilled' ? sbResult.value : null;
45
46  const vtStats = vtData?.data?.attributes?.last_analysis_stats ?? null;
47  const sbThreats: string[] = sbData?.matches?.map((m: { threatType: string }) => m.threatType) ?? [];
48
49  const malicious = vtStats?.malicious ?? 0;
50  const suspicious = vtStats?.suspicious ?? 0;
51  const total = vtStats ? Object.values(vtStats).reduce((a: number, b) => a + (b as number), 0) : 0;
52
53  const overallStatus =
54    sbThreats.length > 0 || malicious >= 3
55      ? 'dangerous'
56      : malicious > 0 || suspicious >= 3
57      ? 'suspicious'
58      : 'safe';
59
60  return NextResponse.json({
61    url,
62    virusTotal: { malicious, suspicious, clean: total - malicious - suspicious, total },
63    safeBrowsing: { safe: sbThreats.length === 0, threats: sbThreats },
64    overallStatus,
65  });
66}

Snyk's vulnerability database covers millions of known CVEs across multiple package ecosystems. For npm packages, you can query the Snyk REST API to get vulnerability data for specific package versions. This is valuable for developer tools, security dashboards, and automated checks that run as part of a build or review process. Snyk's API endpoint for package vulnerability data: GET https://api.snyk.io/rest/orgs/{orgId}/packages/npm/{packageName}/{version}/issues returns vulnerabilities for a specific npm package and version. You need your organization ID (found in Snyk account settings) and your API token (from app.snyk.io/account). Each vulnerability in the response includes: id (CVE identifier), title, severity (critical/high/medium/low), description, introduced through (affected versions), fixed in (versions that fix the issue), and a CVSS score. Use the fixed_in field to show users which version to upgrade to. For parsing a package.json to get multiple packages at once, iterate through dependencies and devDependencies, strip the version prefix characters (^, ~), and make a separate API call for each package. For 20-30 packages, this is manageable — but run them in parallel with Promise.allSettled to stay within Snyk's rate limits while keeping the total request time reasonable. This outbound API call works fine in Bolt's WebContainer during development. You can test your dependency scanner against real package data without deploying.

1// app/api/security/scan-packages/route.ts
2import { NextRequest, NextResponse } from 'next/server';
3
4const SNYK_API = 'https://api.snyk.io/rest';
5const SNYK_TOKEN = process.env.SNYK_API_TOKEN ?? '';
6const SNYK_ORG_ID = process.env.SNYK_ORG_ID ?? '';
7
8type PackageInput = { name: string; version: string };
9
10async function getPackageVulnerabilities(pkg: PackageInput) {
11  // Clean version string (remove ^, ~, >=, etc.)
12  const cleanVersion = pkg.version.replace(/^[^0-9]*/, '');
13
14  const url = `${SNYK_API}/orgs/${SNYK_ORG_ID}/packages/npm%2F${encodeURIComponent(pkg.name)}%40${cleanVersion}/issues?version=2024-10-15`;
15
16  const res = await fetch(url, {
17    headers: {
18      Authorization: `token ${SNYK_TOKEN}`,
19      'Content-Type': 'application/json',
20    },
21  });
22
23  if (res.status === 404) return { ...pkg, vulnerabilities: [], error: 'Package not found' };
24  if (!res.ok) return { ...pkg, vulnerabilities: [], error: `Snyk API error ${res.status}` };
25
26  const data = await res.json();
27  const issues = data.data ?? [];
28
29  const vulnerabilities = issues.map((issue: {
30    attributes: { title: string; severity: string; effective_severity_level: string; coordinates?: Array<{ remedies?: Array<{ details?: { upgrade_package?: string } }> }> };
31    id: string;
32  }) => ({
33    id: issue.id,
34    title: issue.attributes.title,
35    severity: issue.attributes.effective_severity_level ?? issue.attributes.severity,
36    fixedIn: issue.attributes.coordinates?.[0]?.remedies?.[0]?.details?.upgrade_package ?? 'No fix available',
37  }));
38
39  const counts = vulnerabilities.reduce(
40    (acc: Record<string, number>, v: { severity: string }) => {
41      acc[v.severity] = (acc[v.severity] ?? 0) + 1;
42      return acc;
43    },
44    { critical: 0, high: 0, medium: 0, low: 0 }
45  );
46
47  return { ...pkg, cleanVersion, vulnerabilities, totalCount: counts };
48}
49
50export async function POST(request: NextRequest) {
51  const { packages } = await request.json();
52
53  if (!Array.isArray(packages) || packages.length === 0) {
54    return NextResponse.json({ error: 'packages array is required' }, { status: 400 });
55  }
56
57  const results = await Promise.allSettled(
58    packages.slice(0, 20).map(getPackageVulnerabilities) // Limit to 20 packages
59  );
60
61  const scanResults = results.map((r) =>
62    r.status === 'fulfilled' ? r.value : { error: 'Scan failed' }
63  );
64
65  return NextResponse.json({ results: scanResults });
66}

A security scanner dashboard combining VirusTotal URL checking, Google Safe Browsing, and Snyk dependency scanning gives users a comprehensive view of their app's security posture in one place. Deploying to Netlify or Vercel is the natural next step once you are satisfied with the development build. Click the Publish button in Bolt to deploy to Netlify. After deployment, add your security API keys as environment variables in Netlify's Site Settings → Environment Variables: VIRUSTOTAL_API_KEY, GOOGLE_SAFE_BROWSING_KEY, SNYK_API_TOKEN, SNYK_ORG_ID. Never expose these keys with NEXT_PUBLIC_ prefix — security API credentials must remain server-side. For the combined security dashboard, build a page with tabs for each scanner: URL Safety (using VirusTotal + Safe Browsing), Dependency Check (using Snyk), and ideally a Summary tab showing recent scan history stored in Supabase. The summary table would show the last 50 URL scans with their safety status, useful for auditing what links have been submitted through your app. Note that VirusTotal's free API rate limits (4 requests per minute) can become a constraint in production. Implement client-side rate limiting by disabling the scan button for 15 seconds after each request. For higher volume needs, VirusTotal's premium plans provide higher rate limits. Similarly, Google Safe Browsing's free tier allows 10,000 requests per day — more than sufficient for most Bolt app use cases. Since these are outbound API calls, no webhook configuration is needed. The security scanner dashboard works entirely as a request-response application without needing incoming events from external services. However, Bolt's WebContainer cannot receive inbound connections from any external service, which would be relevant if you were using a push-based security monitoring service rather than on-demand APIs.

1// app/api/security/status/route.ts
2// Health check for security API configuration
3import { NextResponse } from 'next/server';
4
5export async function GET() {
6  return NextResponse.json({
7    apis: {
8      virusTotal: Boolean(process.env.VIRUSTOTAL_API_KEY),
9      googleSafeBrowsing: Boolean(process.env.GOOGLE_SAFE_BROWSING_KEY),
10      snyk: Boolean(process.env.SNYK_API_TOKEN) && Boolean(process.env.SNYK_ORG_ID),
11    },
12    rateLimits: {
13      virusTotal: '500 requests/day, 4/minute (free tier)',
14      googleSafeBrowsing: '10,000 requests/day (free)',
15      snyk: '200 test runs/month (free tier)',
16    },
17  });
18}