How to Use the Lacework (Cloud Security & CNAPP) MCP in Windsurf

Q: How does Windsurf's Cascade use the Lacework (Cloud Security & CNAPP) server to investigate a new CVE?

You tell Cascade the CVE ID. It uses searchcveexposure to find all affected machines, then can automatically run listhostvulnerabilities on each one to check for other issues and file tickets.

Q: Can Cascade check for misconfigurations in my AWS environment?

Absolutely. It uses searchcloudinventory to find assets like S3 buckets or security groups, and listsecuritypolicies to check if they violate your defined rules.

Let Windsurf's Cascade autonomously hunt for cloud threats and audit your infra with the Lacework MCP Server.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Lacework (Cloud Security & CNAPP) MCP to Windsurf

Create your Vinkius account to connect Lacework (Cloud Security & CNAPP) to Windsurf and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Lacework (Cloud Security & CNAPP) with Windsurf

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Find and Triage Threats Automatically

Set a goal like "Investigate high-severity alerts from the last hour." Cascade takes it from there. It runs `search_alerts` to get the initial list, then for each critical alert, it automatically calls `get_alert` to pull the full context—offending IPs, container SHAs, and the exact behavior that triggered it. You don't have to prompt each step. Cascade chains the tools together, presenting a final report of what it found. This means you go from a vague suspicion to a detailed incident report without writing a single line of code or manually clicking through a dashboard.

Let Windsurf Expose Your Attack Surface

Ask Cascade to "Find all machines exposed to CVE-2026-0001." It will use `search_cve_exposure` to instantly identify every vulnerable node across your entire cloud footprint. It won't just give you a list of instance IDs. Cascade can then dig deeper on its own. For each affected host, it can run `list_host_vulnerabilities` to see what other CVEs are present or `search_cloud_inventory` to understand the machine's role and network exposure. You get the full picture of the blast radius, not just a single data point.

Audit Your Cloud Setup with This MCP Server

Need to know if your production environment is configured correctly? Give Cascade a goal: "Verify no production resource groups allow public SSH access." It starts by getting your asset groups with `list_resource_groups` to define "production." Then, it inspects your security rules using `list_security_policies` and cross-references them against your inventory from `search_cloud_inventory`. If it finds a violation, like port 22 open to the world, it flags it immediately. It’s a continuous, automated audit running right in your IDE.

Setup guide

Set up Lacework (Cloud Security & CNAPP) MCP in Windsurf

Prerequisites

Windsurf IDE installed (macOS, Windows, or Linux)
Active Vinkius subscription with a valid endpoint token

1

Open MCP configuration

Click the Cascade assistant icon in the sidebar, then click the hammer icon (🔨) at the top of the panel. Select "Configure" to open ~/.codeium/windsurf/mcp_config.json.
2

Add the Lacework (Cloud Security & CNAPP) MCP

Paste the JSON snippet shown on the right into the mcpServers object. Replace [YOUR_TOKEN_HERE] with your endpoint token from cloud.vinkius.com.
3

Refresh MCPs

Go back to the hammer icon (🔨) in Cascade and click "Refresh". Windsurf will detect the new server. No full restart is needed — the connection is hot-reloaded.
4

Verify in Cascade

Start a new Cascade conversation and ask something like "Show my Lacework (Cloud Security & CNAPP) payment history." If connected, Cascade will call the Lacework (Cloud Security & CNAPP) tools directly. You will see a green dot next to the server name in the MCP panel.

mcp_config.json

{
  "mcpServers": {
    "lacework-cloud-security-cnapp-mcp": {
      "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    }
  }
}

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Lacework. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Lacework (Cloud Security & CNAPP) now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Lacework (Cloud Security & CNAPP) MCP in Windsurf

You tell Cascade the CVE ID. It uses `search_cve_exposure` to find all affected machines, then can automatically run `list_host_vulnerabilities` on each one to check for other issues and file tickets.

Yes. Ask Cascade to "Summarize all critical alerts from the past week involving Kubernetes." It will use `search_alerts` with the right filters and format a clean summary for you.

The key is autonomous chaining. Other clients make you run one command at a time. With this MCP server, Windsurf's Cascade can take a high-level goal and execute a multi-step investigation across several Lacework tools without you prompting each action.

Absolutely. It uses `search_cloud_inventory` to find assets like S3 buckets or security groups, and `list_security_policies` to check if they violate your defined rules.

The server queries your Lacework instance for security data. This includes alert details, vulnerability reports for hosts and containers, and cloud asset inventory metadata. Vinkius ensures the connection is secure, but the server itself is ephemeral and doesn't store your data.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript