Salt Security MCP. Discover, Audit, and Block API Threats in Minutes.

You connect your AI client directly to Salt Security's MCP Server for API Threat Management. This integration lets your agent handle deep security work—API discovery, vulnerability scanning, and real-time threat response—without you having to jump between dashboards or run manual checks.

Discovery and Inventory Mapping

You can get a full picture of every endpoint in your environment by running get_inventory. This tool pulls a complete list of all auto-discovered API endpoints, making sure you find those unknown 'shadow' APIs that might be exposed. Once you pinpoint a specific path, you use get_endpoint to pull detailed metadata and the schema for that one resource.

That lets your agent check not only what data is expected but also if sensitive info, like PII, is unnecessarily exposed.

To keep your API surface under strict control, your AI client manages governance through OpenAPI (OAS) standards. You'll use list_oas_specs to see all the OAS files already uploaded to the platform. If you find a new specification, you simply run upload_oas_spec to add it for review and governance checks. The system also tracks your ruleset using get_governance_policies, showing exactly what active rules govern how your APIs operate.

Monitoring Active Threats

When suspicious activity hits, the agent doesn't wait for an alert; it retrieves data instantly. You can get a list of every specific malicious API attack event by calling get_attacks. To understand who’s attacking you, your client pulls profiles from get_attackers, which lists all known and profiled threat actors detected by Salt Security.

These tools let you map out attacker patterns before they hit critical infrastructure.

Remediation and Hardening

If an attack is confirmed, the agent executes immediate defense commands. You don't wait for manual approval; you run block_attacker to assign a blockade rule against a specific threat actor profile using the details gathered from get_attackers. This action blocks their ability to continue exploitation immediately.

Beyond active threats, your client helps you build defenses before code even hits production. You use get_posture_vulnerabilities to scan for design flaws and policy gaps in your API structure. It’s a proactive assessment that finds weaknesses while they're still theoretical. The system also checks the operational status of its own data sources using get_system_health, letting you know if services—like traffic mirrors—are ingesting data correctly.

This setup means your agent handles everything: discovering what APIs exist, checking their schemas and governance rules, spotting active attacks or potential design flaws, and then immediately blocking the bad actors. You get full control over your API security posture without leaving your chat window.