# Salt Security MCP for AI Agents AI Agent Connect > Salt Security MCP connects your AI to your API security environment. It lets your agent find shadow APIs, spot active attacks, and trigger blocks on attackers in real-time. It's for teams who need to move faster than a manual dashboard allows. ## Overview - **Category:** fort-knox - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_HEqpwxZCJGloy9SZRikbBjYA9GqrD7wwt82MwMIn/ai-agent-connect - **Tags:** api-security, threat-detection, behavioral-analytics, shadow-api, posture-management, real-time-remediation ## Description Connect your AI directly to Salt Security to defend your API environment from real-time threats. Instead of jumping between multiple dashboards to track down who is attacking your infrastructure, you can now use a conversational interface to monitor and act. This Connector lets you see every API currently running in your environment, including the shadow ones that often fly under the radar of standard documentation. When a threat actor starts probing your systems for business logic abuses, your agent can identify the behavior and trigger a blockade against them immediately. This moves your security posture from reactive to proactive. You can check for sensitive data exposure, audit your current governance rules, and manage your OpenAPI specifications without leaving your primary workspace. By adding this to your setup via the Vinkius catalog, you turn your AI into a security analyst that can perform deep discovery and active remediation in seconds. It removes the friction of manual lookups and gives you a clear, actionable view of your attack surface. You don't have to worry about missing a rogue endpoint or a subtle logic attack because your agent is constantly looking at the same data your security team relies on. It bridges the gap between high-level security intent and the actual, messy reality of API traffic. ## Tools ### get_attackers Lists known threat actors profiled by the platform. Use this to see behavioral patterns of attackers. ### get_attacks Lists detected malicious API attacks. This helps you monitor real-time threats and business logic abuse. ### get_endpoint Retrieves the specific details and schema for a single API endpoint. Use this to check for PII exposure. ### get_governance_policies Lists the active rules governing your API environment. This helps you verify your current security posture. ### get_inventory Pulls a full list of every API your system has auto-discovered. It is the best way to find shadow APIs. ### get_posture_vulnerabilities Identifies design flaws and security gaps before they go live. Use this to catch issues during development. ### list_oas_specs Lists all the OpenAPI specifications you have uploaded. Use this to audit your existing documentation. ### upload_oas_spec Uploads a new Swagger or OpenAPI file to the console. This keeps your security specs up to date. ### block_attacker Issues a command to block a specific threat actor. This provides immediate remediation for active attacks. ### get_system_health Checks if your traffic mirror ingestion is running correctly. This ensures you have constant visibility. ## Prompt Examples **Prompt:** ``` List all auto-discovered APIs including shadow and zombie APIs in our infrastructure. ``` **Response:** ``` I've pulled your full API inventory. Here is the current status: | Total APIs | Documented | Shadow/Zombie | | :--- | :--- | :--- | | 32 | 28 | 4 | **Alert:** I found 4 'zombie' APIs that lack formal documentation. You should review these to ensure they aren't exposing sensitive data. ``` **Prompt:** ``` Are we facing any recent attacks aimed at business logic? ``` **Response:** ``` Reviewing your active threat ledger, I've detected **12 malicious attack events** currently targeting your user authentication modules. **Details:** * **Type:** Account Takeover attempts * **Target:** Primary Auth Web Modules * **Status:** Active Would you like me to pull the profiles for these attackers? ``` **Prompt:** ``` Block attacker 'ATT-992' immediately. ``` **Response:** ``` The remediation command was successfully passed to your Salt Security console. **Action Summary:** * **Target:** Threat Actor 'ATT-992' * **Action:** Blockade rule assigned * **Gateway:** Integrated WAF The attacker is now blocked from interacting with your APIs. ``` ## Capabilities ### Find hidden shadow APIs Discover every API running in your environment including undocumented or zombie endpoints. ### Spot active business logic attacks Detect malicious behavior and attack patterns as they happen in your API traffic. ### Block attackers in real-time Issue immediate blockade commands to stop threat actors from accessing your data. ### Audit API security posture Identify design flaws and vulnerabilities before they reach your production environment. ### Manage OpenAPI specifications Upload and list your OAS specs to keep your security documentation up to date. ### Check for PII exposure Scan specific endpoints to see if sensitive personal data is being exposed. ## Use Cases ### Stopping a live attack A security analyst sees a spike and asks the agent to check for malicious activity. The agent uses `get_attacks` and `get_attackers` to identify the source. ### Auditing shadow APIs A developer wants to see what's currently live. They ask the agent to list all APIs, and it uses `get_inventory` to show every endpoint. ### Checking for PII leaks During a security audit, a user asks the agent to check for PII leaks. The agent uses `get_endpoint` to analyze the schema for sensitive data. ### Managing OpenAPI specs A team needs to update their documentation. They ask the agent to upload a new spec, which uses `upload_oas_spec` to sync with the security console. ## Benefits - Stop shadow API leaks by using `get_inventory` to find every endpoint actually running in your environment. - Cut response times by using `block_attacker` to neutralize threats instantly without manual WAF configuration. - Fix security flaws before deployment with `get_posture_vulnerabilities` to identify design gaps early. - Keep your documentation accurate by using `upload_oas_spec` to sync your latest API changes with security. - Audit your security rules automatically with `get_governance_policies` to ensure your environment stays compliant. - Maintain total visibility by using `get_system_health` to verify that your traffic mirror ingestion is healthy. ## How It Works The bottom line is you get a conversational interface for your entire API security stack. 1. Generate an API token in your Salt Security console. 2. Add the token to your Connector configuration. 3. Ask your agent to check for attacks or inventory your APIs. ## Frequently Asked Questions **How does Salt Security MCP help with shadow APIs?** It gives your AI the ability to see every API running in your environment, including those that aren't documented. This helps you find and secure 'shadow' APIs that could otherwise be left exposed. **Can I block attackers using my AI agent?** Yes. You can tell your agent to block a specific threat actor, and it will send that command to your security console to update your WAF rules immediately. **How do I find PII leaks in my APIs?** You can ask your agent to check specific endpoints for sensitive data exposure. It will analyze the schema and tell you if personal information is being leaked. **Can the AI help me manage my OpenAPI specs?** Yes, it can list your existing OpenAPI specifications and upload new ones. This helps you keep your security documentation in sync with your actual code. **Does this connect to my existing WAF?** The Connector works with Salt Security, which integrates with your existing WAF. This allows your agent to push blockade commands directly to your firewall. **What is business logic abuse in API security?** It refers to attacks that use valid API calls in malicious ways, like trying to bypass authentication or scrape data. This Connector helps detect those specific behaviors. **How does it handle my API governance?** It allows you to query and verify your active governance rules. You can use your agent to ensure that your security policies are being applied correctly across all APIs. **Can the AI forcefully block attackers or does it just view them?** You can explicitly instruct the AI to use the `block_attacker` tool, which triggers a remediation event across your security infrastructure (e.g., WAF integrations). It provides both visibility and direct active response. **Does Salt Security allow me to upload spec definitions (OAS) directly from my files via chat?** Yes, you can upload raw specification content using the `upload_oas_spec` tool for vulnerability testing and validation. Provide the exact OpenAPI content, and Salt will interpret it securely naturally properly successfully cleanly nicely properly natively completely optimally brightly cleanly beautifully actively quickly seamlessly efficiently correctly elegantly faithfully efficiently natively perfectly. **How frequently is the API inventory auto-discovered?** Salt maintains a continuous discovery architecture via passive traffic monitoring. This prevents any drift and immediately identifies 'Ghost APIs' when queried using the `get_inventory` capability.