# How to Integrate Bolt.new with McAfee

- Tool: Bolt.new
- Difficulty: Intermediate
- Time required: 25 minutes
- Last updated: April 2026

## TL;DR

McAfee does not have a public REST API for independent developers. The 'McAfee function' search query likely refers to security scanning or threat detection features. The practical alternatives for building security features in Bolt.new are: VirusTotal's free API for file and URL scanning, Snyk's API for dependency vulnerability scanning, or Google Safe Browsing API for URL safety checks — all of which have open, well-documented APIs.

## Building Security Features in Bolt.new: Developer-Friendly Alternatives to McAfee

McAfee is a consumer and enterprise security product company — not a developer platform. McAfee's enterprise product line has rebranded to Trellix, and neither McAfee nor Trellix provides a publicly accessible REST API for independent developers to integrate security scanning features into their web applications. There is no developer console, no API key registration, and no publicly documented API endpoints available outside of enterprise partnership agreements.

The 'McAfee function' search query most commonly comes from developers looking to add threat detection, URL safety checking, or file scanning to their apps. These are genuine use cases that several developer-focused security APIs address well. VirusTotal (owned by Google) provides a free API that scans URLs, domains, IP addresses, and file hashes against 70+ antivirus engines and security vendors — including McAfee's engine — and returns aggregated results. Google Safe Browsing is a free API specifically for real-time URL safety checks, widely used in browsers and apps to warn about phishing and malware sites. Snyk provides a vulnerability database API focused on known CVEs in open-source packages across npm, Python, Java, and other ecosystems.

For Bolt.new integrations, all three of these APIs use standard HTTP requests with API key authentication. They work as outbound calls from Next.js API routes in Bolt's WebContainer without any deployment required. Building a security scanner dashboard in Bolt is a practical, well-supported use case with these APIs.

## Before you start

- A VirusTotal account (free) and API key from virustotal.com/gui/my-apikey
- A Google Cloud project with Safe Browsing API enabled and an API key from console.cloud.google.com
- For Snyk: a Snyk account (free tier available) and API token from app.snyk.io/account
- A Next.js project in Bolt.new (prompt 'Create a Next.js app' to get started)

## Step-by-step guide

### 1. Understand McAfee's API limitations and configure security API keys

McAfee and its enterprise successor Trellix are end-product security vendors, not API platforms for developers. McAfee does not publish API documentation for public use, and there is no registration path to obtain API credentials. Some enterprise security platforms (like Trellix's XDR) have internal APIs for their enterprise customers, but these are not accessible to independent web developers and require purchase of enterprise software licenses.

For building security features in Bolt.new apps, three developer-friendly APIs cover the most common use cases. VirusTotal's free API tier allows 500 requests per day and 4 requests per minute — sufficient for most development and moderate production use. The API scans URLs, domains, IP addresses, and file hashes against 70+ security vendors' engines and databases. Get your API key from virustotal.com/gui/my-apikey after creating a free account.

Google Safe Browsing is free for up to 10,000 requests per day per API key and requires a Google Cloud project. Enable it at console.cloud.google.com → APIs & Services → Library → search 'Safe Browsing API'. This API returns threat types (MALWARE, SOCIAL_ENGINEERING, UNWANTED_SOFTWARE, POTENTIALLY_HARMFUL_APPLICATION) for URLs in real time.

Snyk's API is free for open-source projects and provides vulnerability data for npm, PyPI, Maven, NuGet, and other package ecosystems. Get your API token from app.snyk.io/account. The free tier provides 200 test runs per month.

All three APIs use standard Bearer token or API key authentication and return JSON responses, making them straightforward to integrate from Bolt's Next.js API routes.

```
// .env.local
VIRUSTOTAL_API_KEY=your_virustotal_api_key
GOOGLE_SAFE_BROWSING_KEY=your_google_api_key
SNYK_API_TOKEN=your_snyk_api_token
```

**Expected result:** Your .env.local is configured with all three security API keys. Calling /api/security/status confirms which APIs are ready without exposing the actual credential values.

### 2. Build a URL safety checker using VirusTotal and Google Safe Browsing

VirusTotal provides two URL analysis approaches. The first is a URL scan: submit the URL to POST /urls and get back an analysis ID, then poll GET /analyses/{analysisId} for results. This works well for deep analysis but takes 30-60 seconds. The second is a URL lookup: if VirusTotal has previously seen the URL, GET /urls/{base64-encoded-url} returns cached results instantly. For a user-facing URL checker, use the lookup first and fall back to a fresh scan only if no cached result exists.

The VirusTotal URL identifier is the base64 URL-safe encoding (no padding) of the URL. In JavaScript: btoa(url).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '').

Google Safe Browsing uses a different model: you send a POST request to the Lookup API with a list of URLs and it returns which (if any) match known threat entries in Google's database. The response is immediate (no polling). The lookupThreatLists endpoint: POST https://safebrowsing.googleapis.com/v4/threatMatches:find?key={apiKey} with a JSON body specifying client info, threat types to check, and the URLs.

Combining both APIs in a single endpoint gives you comprehensive URL safety data: VirusTotal provides coverage from 70+ security vendors (including McAfee, Kaspersky, Avast), while Google Safe Browsing specifically covers phishing and malware sites Google has indexed. Together they catch a higher percentage of threats than either alone.

These outbound API calls work perfectly in Bolt's WebContainer during development — no deployment needed to test URL scanning.

```
// app/api/security/check-url/route.ts
import { NextRequest, NextResponse } from 'next/server';

const VT_API = 'https://www.virustotal.com/api/v3';
const SB_API = 'https://safebrowsing.googleapis.com/v4';

const VT_KEY = process.env.VIRUSTOTAL_API_KEY ?? '';
const SB_KEY = process.env.GOOGLE_SAFE_BROWSING_KEY ?? '';

function urlToVtId(url: string): string {
  return btoa(url).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
}

export async function POST(request: NextRequest) {
  const { url } = await request.json();

  if (!url || typeof url !== 'string') {
    return NextResponse.json({ error: 'url is required' }, { status: 400 });
  }

  const [vtResult, sbResult] = await Promise.allSettled([
    // VirusTotal URL lookup
    fetch(`${VT_API}/urls/${urlToVtId(url)}`, {
      headers: { 'x-apikey': VT_KEY },
    }).then((r) => r.json()),

    // Google Safe Browsing
    fetch(`${SB_API}/threatMatches:find?key=${SB_KEY}`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        client: { clientId: 'bolt-security-scanner', clientVersion: '1.0' },
        threatInfo: {
          threatTypes: ['MALWARE', 'SOCIAL_ENGINEERING', 'UNWANTED_SOFTWARE'],
          platformTypes: ['ANY_PLATFORM'],
          threatEntryTypes: ['URL'],
          threatEntries: [{ url }],
        },
      }),
    }).then((r) => r.json()),
  ]);

  const vtData = vtResult.status === 'fulfilled' ? vtResult.value : null;
  const sbData = sbResult.status === 'fulfilled' ? sbResult.value : null;

  const vtStats = vtData?.data?.attributes?.last_analysis_stats ?? null;
  const sbThreats: string[] = sbData?.matches?.map((m: { threatType: string }) => m.threatType) ?? [];

  const malicious = vtStats?.malicious ?? 0;
  const suspicious = vtStats?.suspicious ?? 0;
  const total = vtStats ? Object.values(vtStats).reduce((a: number, b) => a + (b as number), 0) : 0;

  const overallStatus =
    sbThreats.length > 0 || malicious >= 3
      ? 'dangerous'
      : malicious > 0 || suspicious >= 3
      ? 'suspicious'
      : 'safe';

  return NextResponse.json({
    url,
    virusTotal: { malicious, suspicious, clean: total - malicious - suspicious, total },
    safeBrowsing: { safe: sbThreats.length === 0, threats: sbThreats },
    overallStatus,
  });
}
```

**Expected result:** Submitting a URL to /api/security/check-url returns combined threat data from VirusTotal and Google Safe Browsing, with an overall safety status of safe, suspicious, or dangerous.

### 3. Build a dependency vulnerability scanner with Snyk

Snyk's vulnerability database covers millions of known CVEs across multiple package ecosystems. For npm packages, you can query the Snyk REST API to get vulnerability data for specific package versions. This is valuable for developer tools, security dashboards, and automated checks that run as part of a build or review process.

Snyk's API endpoint for package vulnerability data: GET https://api.snyk.io/rest/orgs/{orgId}/packages/npm/{packageName}/{version}/issues returns vulnerabilities for a specific npm package and version. You need your organization ID (found in Snyk account settings) and your API token (from app.snyk.io/account).

Each vulnerability in the response includes: id (CVE identifier), title, severity (critical/high/medium/low), description, introduced through (affected versions), fixed in (versions that fix the issue), and a CVSS score. Use the fixed_in field to show users which version to upgrade to.

For parsing a package.json to get multiple packages at once, iterate through dependencies and devDependencies, strip the version prefix characters (^, ~), and make a separate API call for each package. For 20-30 packages, this is manageable — but run them in parallel with Promise.allSettled to stay within Snyk's rate limits while keeping the total request time reasonable.

This outbound API call works fine in Bolt's WebContainer during development. You can test your dependency scanner against real package data without deploying.

```
// app/api/security/scan-packages/route.ts
import { NextRequest, NextResponse } from 'next/server';

const SNYK_API = 'https://api.snyk.io/rest';
const SNYK_TOKEN = process.env.SNYK_API_TOKEN ?? '';
const SNYK_ORG_ID = process.env.SNYK_ORG_ID ?? '';

type PackageInput = { name: string; version: string };

async function getPackageVulnerabilities(pkg: PackageInput) {
  // Clean version string (remove ^, ~, >=, etc.)
  const cleanVersion = pkg.version.replace(/^[^0-9]*/, '');

  const url = `${SNYK_API}/orgs/${SNYK_ORG_ID}/packages/npm%2F${encodeURIComponent(pkg.name)}%40${cleanVersion}/issues?version=2024-10-15`;

  const res = await fetch(url, {
    headers: {
      Authorization: `token ${SNYK_TOKEN}`,
      'Content-Type': 'application/json',
    },
  });

  if (res.status === 404) return { ...pkg, vulnerabilities: [], error: 'Package not found' };
  if (!res.ok) return { ...pkg, vulnerabilities: [], error: `Snyk API error ${res.status}` };

  const data = await res.json();
  const issues = data.data ?? [];

  const vulnerabilities = issues.map((issue: {
    attributes: { title: string; severity: string; effective_severity_level: string; coordinates?: Array<{ remedies?: Array<{ details?: { upgrade_package?: string } }> }> };
    id: string;
  }) => ({
    id: issue.id,
    title: issue.attributes.title,
    severity: issue.attributes.effective_severity_level ?? issue.attributes.severity,
    fixedIn: issue.attributes.coordinates?.[0]?.remedies?.[0]?.details?.upgrade_package ?? 'No fix available',
  }));

  const counts = vulnerabilities.reduce(
    (acc: Record<string, number>, v: { severity: string }) => {
      acc[v.severity] = (acc[v.severity] ?? 0) + 1;
      return acc;
    },
    { critical: 0, high: 0, medium: 0, low: 0 }
  );

  return { ...pkg, cleanVersion, vulnerabilities, totalCount: counts };
}

export async function POST(request: NextRequest) {
  const { packages } = await request.json();

  if (!Array.isArray(packages) || packages.length === 0) {
    return NextResponse.json({ error: 'packages array is required' }, { status: 400 });
  }

  const results = await Promise.allSettled(
    packages.slice(0, 20).map(getPackageVulnerabilities) // Limit to 20 packages
  );

  const scanResults = results.map((r) =>
    r.status === 'fulfilled' ? r.value : { error: 'Scan failed' }
  );

  return NextResponse.json({ results: scanResults });
}
```

**Expected result:** Submitting a list of npm packages returns vulnerability data from Snyk with severity counts per package. The results table shows packages color-coded by their highest vulnerability severity.

### 4. Deploy the security scanner and build a combined dashboard

A security scanner dashboard combining VirusTotal URL checking, Google Safe Browsing, and Snyk dependency scanning gives users a comprehensive view of their app's security posture in one place. Deploying to Netlify or Vercel is the natural next step once you are satisfied with the development build.

Click the Publish button in Bolt to deploy to Netlify. After deployment, add your security API keys as environment variables in Netlify's Site Settings → Environment Variables: VIRUSTOTAL_API_KEY, GOOGLE_SAFE_BROWSING_KEY, SNYK_API_TOKEN, SNYK_ORG_ID. Never expose these keys with NEXT_PUBLIC_ prefix — security API credentials must remain server-side.

For the combined security dashboard, build a page with tabs for each scanner: URL Safety (using VirusTotal + Safe Browsing), Dependency Check (using Snyk), and ideally a Summary tab showing recent scan history stored in Supabase. The summary table would show the last 50 URL scans with their safety status, useful for auditing what links have been submitted through your app.

Note that VirusTotal's free API rate limits (4 requests per minute) can become a constraint in production. Implement client-side rate limiting by disabling the scan button for 15 seconds after each request. For higher volume needs, VirusTotal's premium plans provide higher rate limits. Similarly, Google Safe Browsing's free tier allows 10,000 requests per day — more than sufficient for most Bolt app use cases.

Since these are outbound API calls, no webhook configuration is needed. The security scanner dashboard works entirely as a request-response application without needing incoming events from external services. However, Bolt's WebContainer cannot receive inbound connections from any external service, which would be relevant if you were using a push-based security monitoring service rather than on-demand APIs.

```
// app/api/security/status/route.ts
// Health check for security API configuration
import { NextResponse } from 'next/server';

export async function GET() {
  return NextResponse.json({
    apis: {
      virusTotal: Boolean(process.env.VIRUSTOTAL_API_KEY),
      googleSafeBrowsing: Boolean(process.env.GOOGLE_SAFE_BROWSING_KEY),
      snyk: Boolean(process.env.SNYK_API_TOKEN) && Boolean(process.env.SNYK_ORG_ID),
    },
    rateLimits: {
      virusTotal: '500 requests/day, 4/minute (free tier)',
      googleSafeBrowsing: '10,000 requests/day (free)',
      snyk: '200 test runs/month (free tier)',
    },
  });
}
```

**Expected result:** The security dashboard is deployed and accessible at a public URL. URL scanning and dependency checking work against live data from VirusTotal, Google Safe Browsing, and Snyk. The status endpoint confirms all API keys are configured.

## Best practices

- Be transparent with users when results come from third-party security APIs — display 'Powered by VirusTotal' and 'Safe Browsing by Google' attribution as these services require attribution in their terms of service.
- Cache security scan results in Supabase for 24-48 hours to avoid re-scanning the same URL repeatedly — URL threat assessments do not change minute-to-minute and caching saves your daily API quota.
- Implement client-side rate limiting in your UI — disable the scan button for 15 seconds after each submission to prevent rapid successive requests from exhausting VirusTotal's 4-per-minute free tier limit.
- Never use security scan results as the sole gatekeeping mechanism for user actions — a clean VirusTotal result does not guarantee safety, and a flagged result may be a false positive. Display results as advisory information, not hard blocks.
- Store all security scan results in your database with timestamps for audit purposes — knowing which URLs were checked, when, and by whom is valuable for security incident investigation.
- For production apps processing many URL submissions, consider upgrading to VirusTotal's premium API tier (1,000+ requests per minute) rather than implementing complex rate limiting logic around the free tier constraints.
- Always handle API failures gracefully — if VirusTotal or Google Safe Browsing returns an error, show 'Security scan unavailable' rather than crashing or blocking the user flow.

## Use cases

### URL safety scanner for user-submitted links

Add a safety check to any feature where users submit URLs — contact forms, link aggregators, or content submission tools. Before processing the URL, check it against VirusTotal and Google Safe Browsing to detect phishing, malware, or spam URLs, and warn users or block submission of dangerous links.

Prompt example:

```
Build a URL safety checker component. When a user enters a URL and clicks 'Check Safety', call /api/security/check-url which checks the URL against both VirusTotal API and Google Safe Browsing API. Show a safety result card: green 'Safe' if both pass, yellow 'Suspicious' if only one flags it, red 'Dangerous' if both flag it. Show the number of VirusTotal engines that flagged the URL.
```

### npm package vulnerability dashboard

Build a developer tool that accepts a package.json file or a list of npm package names and versions, checks them all against Snyk's vulnerability database, and returns a prioritized list of vulnerabilities with severity ratings and remediation advice — helping developers keep their dependencies secure.

Prompt example:

```
Build a dependency security scanner page. Accept a list of npm packages (name@version format, one per line) in a textarea. Call /api/security/scan-packages which queries the Snyk vulnerability API for each package. Display results as a table: package name, version, vulnerability count (critical/high/medium/low counts colored by severity), and a 'View details' link to the Snyk advisory page.
```

### File hash reputation checker

For apps that handle file uploads, add a pre-upload reputation check: compute the SHA-256 hash of the file on the client side and submit it to VirusTotal before uploading. VirusTotal returns reputation data from its database instantly for known files, catching known malware without uploading the actual file.

Prompt example:

```
Build a file security pre-check feature. Create a React component that accepts a file input. Before upload, compute the SHA-256 hash of the file using the Web Crypto API (runs in browser, no upload needed). Call /api/security/check-hash with the hash, which queries the VirusTotal API for the file's reputation. Show the scan result: 'Clean (0/72 detections)', 'Suspicious (3/72)', or 'Malicious (45/72)' before allowing the actual file upload to proceed.
```

## Troubleshooting

### VirusTotal URL lookup returns 404 for URLs that should be in the database

Cause: VirusTotal may not have previously analyzed the specific URL you are checking. The URL lookup endpoint only returns data for URLs that have been submitted for analysis before. New or obscure URLs will return 404.

Solution: Handle the 404 response gracefully by returning an 'Unknown — never scanned' status rather than an error. Optionally, submit the URL for a fresh scan using POST /urls and return a 'Scan initiated' status with the analysis ID. Users can check back or you can poll for results.

```
if (res.status === 404) {
  return NextResponse.json({
    url,
    status: 'unknown',
    message: 'URL not in VirusTotal database. No prior scan data available.',
    virusTotal: null,
  });
}
```

### Google Safe Browsing API returns 400 Bad Request

Cause: The request body format is incorrect, the API key is missing from the query parameter (it must be in the URL, not a header), or the threatTypes or platformTypes values are not valid enum strings.

Solution: Verify the API key is passed as a query parameter in the URL (?key=YOUR_KEY), not as a header. Check that threatTypes values are exactly: MALWARE, SOCIAL_ENGINEERING, UNWANTED_SOFTWARE, POTENTIALLY_HARMFUL_APPLICATION (case-sensitive). Ensure the threatEntries array is not empty.

```
// Correct: API key as URL query parameter
const url = `https://safebrowsing.googleapis.com/v4/threatMatches:find?key=${SB_KEY}`;

// Wrong: API key as header (causes 400)
headers: { 'X-API-Key': SB_KEY }
```

### Snyk API returns 401 Unauthorized even with what seems like a correct token

Cause: Snyk uses 'token {apiToken}' format (not 'Bearer {apiToken}') for authorization. The organization ID may also be incorrect or missing from the URL path.

Solution: Verify the Authorization header uses 'token' prefix (not 'Bearer'): Authorization: `token ${SNYK_TOKEN}`. Find your organization ID in Snyk's account settings page — it is a UUID like '12345678-abcd-1234-abcd-123456789012'. Double-check SNYK_ORG_ID is set correctly in your .env.local.

```
// Correct Snyk auth header format:
headers: { Authorization: `token ${process.env.SNYK_API_TOKEN}` }

// Wrong — Snyk does not use Bearer:
headers: { Authorization: `Bearer ${process.env.SNYK_API_TOKEN}` }
```

## Frequently asked questions

### Does McAfee have a public API I can use in Bolt.new?

No. McAfee (consumer) and Trellix (enterprise, the rebranded McAfee enterprise division) do not provide public REST APIs for independent developers. There is no developer console, no public API documentation, and no API key registration available. For security scanning features in Bolt.new, use VirusTotal, Google Safe Browsing, or Snyk instead — all have open, well-documented APIs with free tiers.

### What is the 'McAfee function' that people search for?

The search query likely refers to building security scanning or threat detection functions in an app, using McAfee as a generic reference to antivirus/security functionality. The practical implementation uses developer-friendly APIs: VirusTotal for URL and file hash scanning against 70+ antivirus engines (including McAfee's engine), Google Safe Browsing for phishing detection, or Snyk for dependency vulnerability scanning.

### Can I use VirusTotal to get the same data McAfee would provide?

VirusTotal aggregates results from over 70 security vendors, including McAfee's own antivirus engine. When you submit a URL or file hash to VirusTotal, McAfee's scanner is one of the engines that checks it. You will see a row labeled 'McAfee' in the results. So VirusTotal effectively gives you McAfee's threat assessment plus 70 other engines' assessments, in a single API call.

### Can I test the VirusTotal integration in Bolt's preview before deploying?

Yes. VirusTotal, Google Safe Browsing, and Snyk API calls are all outbound HTTP requests that work perfectly in Bolt's WebContainer preview. You can build and test your complete security scanner during development without deploying. The only time you need a deployed URL is for webhook-based integrations, which none of these three APIs require for their core scanning functionality.

### How do I handle VirusTotal's rate limits in a production Bolt app?

VirusTotal's free API allows 4 requests per minute and 500 per day. Implement rate limiting in your Next.js API route using an in-memory counter or a Redis/Supabase-backed counter. Disable the scan button in the UI for 15 seconds after each submission. Cache scan results for 24 hours using the URL as the cache key. If you exceed the free tier limits frequently, upgrade to VirusTotal's premium plan at virustotal.com/gui/premium.

---

Source: https://www.rapidevelopers.com/bolt-ai-integrations/mcafee
© RapidDev — https://www.rapidevelopers.com/bolt-ai-integrations/mcafee