diff --git a/README.md b/README.md
index 5420f4be..23fea66d 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@
 
 ---
 
-**Cora** is a fast, native CLI that uses any LLM to review your code — in your terminal, CI/CD, or git hooks. Bring your own key, pick any model, review in seconds.
+**Cora** is a fast, native CLI that uses any LLM to review your code — in your terminal, CI/CD, git hooks, or directly inside AI coding agents. Bring your own key, pick any model, review in seconds.
 
 ## Why Cora?
 
@@ -22,7 +22,13 @@
 - ⚡ **Native Rust** — fast binary, no runtime dependencies, cross-platform
 - 🪝 **Pre-commit hooks** — catch issues before they reach CI
 - 📋 **SARIF output** — upload to GitHub Code Scanning
-- 🛡️ **Deterministic rules + secrets scanner** — regex-based pre-scan that always catches known patterns and leaked credentials
+- 🛡️ **Deterministic scanners** — 11 security patterns + 12 secret detection patterns that run without LLM
+- 🧠 **Language-specific analysis** — tailored review guidance for Dart/Flutter, Svelte, TypeScript, Go, Rust, Python
+- 🚧 **Quality gate** — configurable pass/fail thresholds for CI enforcement
+- 📐 **Quality profiles** — strict, balanced, or lax presets for different project needs
+- 📏 **Custom rule engine** — write your own regex rules in `.cora.yaml`
+- ✂️ **Auto-chunking** — splits large PRs into reviewable chunks automatically
+- 🔌 **MCP server** — expose rules and config to AI agents (Claude Code, Cursor, Copilot, Windsurf)
 - 💾 **Diff-hash caching** — skip repeat reviews automatically
 - 🔧 **Configurable** — per-project `.cora.yaml`, global `~/.cora/config.yaml`, or env vars
 
@@ -131,6 +137,7 @@ Works on **all CI platforms** — [Gitea, GitLab, Bitbucket →](https://codecor
 | `cora auth login` | Save API key |
 | `cora config show` | Show resolved config |
 | `cora providers` | List available LLM providers |
+| `cora mcp` | Start MCP server for AI coding agents |
 | `cora hook install` | Install pre-commit hook |
 
 See **[CLI Reference →](https://codecora.dev/cli-reference.html)** for all flags and examples.
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index d8b23921..61b49771 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -46,6 +46,7 @@ Complete command reference for the cora CLI.
 | `cora providers` | List detected AI providers |
 | `cora upload-sarif` `<file>` | Upload SARIF to GitHub Code Scanning |
 | `cora completion` `<shell>` | Generate shell completions (bash/zsh/fish) |
+| `cora mcp` | Start MCP server for AI coding agents (Claude Code, Cursor, Windsurf) |
 
 ## Quick Examples
 
diff --git a/docs/configuration.md b/docs/configuration.md
index 835d670e..fd636b03 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -234,3 +234,127 @@ cora runs a deterministic secrets scan before the AI review. 12 built-in pattern
 | And more (Groq, xAI, Slack, Stripe, Google) | Varies |
 
 Secrets are automatically **masked** in output (e.g. `AKIA****CDEF`). Test/spec/fixture files are auto-skipped.
+
+## Static Security Scanner
+
+cora runs a static security scan on added lines before the AI review. 11 built-in patterns detect common vulnerabilities:
+
+| Pattern | Category | Severity |
+|---------|----------|----------|
+| MD5 used for password hashing | Weak crypto | Major |
+| SHA-1 used for password hashing | Weak crypto | Major |
+| Weak hash algorithm (MD5/SHA1) | Weak crypto | Minor |
+| Hardcoded password or secret | Hardcoded secret | Critical |
+| SQL injection via string concatenation | Injection | Critical |
+| eval() with dynamic input | Injection | Critical |
+| Command injection via exec/system | Injection | Critical |
+| Hardcoded role or permission check | Auth | Major |
+| Debug mode enabled | Config | Major |
+| CORS wildcard allows all origins | Config | Major |
+| SSL certificate verification disabled | Crypto | Critical |
+
+Test files are automatically skipped. Findings are injected into the LLM prompt as additional context.
+
+## Language-Specific Analyzers
+
+cora detects the languages in your diff and injects tailored review guidance:
+
+| Language | Guidance |
+|----------|----------|
+| **Dart / Flutter** | Widget lifecycle, state management, async patterns, null safety |
+| **Svelte / TypeScript** | Reactivity, store patterns, SSR considerations, type safety |
+| **Go** | Error handling, concurrency, goroutine leaks, interface design |
+| **Rust** | Ownership, lifetimes, error handling, unsafe usage, idioms |
+| **Python** | Type hints, async patterns, security (pickle/eval), common pitfalls |
+
+No configuration needed — language context is auto-detected from file extensions in the diff.
+
+## Quality Profiles
+
+cora includes built-in quality profiles for different review strictness:
+
+| Profile | Description |
+|---------|------------|
+| `strict` | All categories enabled, low tolerance for issues |
+| `balanced` | *(default)* Security + bugs + performance, moderate thresholds |
+| `lax` | Only critical issues, high tolerance |
+
+Set in `.cora.yaml`:
+
+```yaml
+profile: strict
+```
+
+## Custom Rule Engine
+
+Write your own regex-based rules in `.cora.yaml`:
+
+```yaml
+rules:
+  - id: no-unwrap
+    pattern: "\\.unwrap\\(\\)"
+    severity: warning
+    message: "Avoid unwrap() in production code — use proper error handling"
+    languages: ["rust"]
+    exclude: ["tests/**"]
+
+  - id: no-console-log
+    pattern: "console\\.log\\("
+    severity: minor
+    message: "Remove console.log before merging"
+    languages: ["typescript", "javascript"]
+```
+
+Rules run during the deterministic pre-scan phase (no LLM needed).
+
+## MCP Server
+
+cora includes a built-in MCP (Model Context Protocol) server that exposes rules and config to AI coding agents like Claude Code, Cursor, Copilot, and Windsurf.
+
+### Start the server
+
+```bash
+cora mcp
+```
+
+### Available tools
+
+| Tool | Description |
+|------|-------------|
+| `cora.list_rules` | List all rules, security patterns, and secret patterns |
+| `cora.check_snippet` | Check a code snippet against deterministic scanners (no LLM) |
+| `cora.get_quality_gate` | Get quality gate config and thresholds |
+| `cora.get_config` | Get effective project config (no secrets exposed) |
+| `cora.list_profiles` | List all quality profiles |
+
+### Configure in Claude Code
+
+Add to your project's `.claude/settings.json`:
+
+```json
+{
+  "mcpServers": {
+    "cora": {
+      "command": "cora",
+      "args": ["mcp"]
+    }
+  }
+}
+```
+
+### Configure in Cursor
+
+Add to `.cursor/mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "cora": {
+      "command": "cora",
+      "args": ["mcp"]
+    }
+  }
+}
+```
+
+The MCP server communicates via JSON-RPC 2.0 over stdio — no HTTP server needed.
diff --git a/docs/usage.md b/docs/usage.md
index 19989979..50867721 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -130,9 +130,20 @@ cora uses standard exit codes for scripting and CI integration:
 |------|---------|-------------|
 | `0` | No issues found | Pass |
 | `1` | Issues found | Fail (warning/error) |
-| `2` | Review blocked | Fail (auth/config error) |
+| `2` | Quality gate failed or review blocked | Fail (threshold exceeded) |
 | `3` | Authentication error | Fail (missing API key) |
 
+## MCP Server
+
+cora includes a built-in MCP server for AI coding agent integration.
+
+```bash
+# Start MCP server (JSON-RPC 2.0 over stdio)
+cora mcp
+```
+
+See [Configuration → MCP Server](./configuration#mcp-server) for setup guides for Claude Code, Cursor, and other agents.
+
 ## Tips
 
 - Use `cora review` with no flags for the fastest pre-commit feedback