An astronaut overseeing a futuristic data hub
Download PDFMarkdown Version

Connect Lacework Cloud Security Cnapp to ChatGPT and Claude

Set it up once and it works in ChatGPT, Claude, Cursor, and any other client you love. It all runs safely in the background, so you can relax and focus on what really matters. Control your cloud security posture through natural conversation.

Ask AI about this Connector

Developed, maintained, and hosted by Vinkius.

MCP VERIFIED · PRODUCTION READY · VINKIUS GUARANTEED

Waiting for input…

Works with modern AI clients that support MCP, including ChatGPT, Claude, Cursor, and more.

ChatGPTClaudeCursorPerplexityGeminiMicrosoft CopilotRaycastMeta AI

Your AI does the work. We keep it safe and sound.

No other AI tool gives you this. Your workflow runs in the client you already love, your account stays protected, and you decide what the agent can and cannot do. It is the whole reason to make the switch.

Each Connector lives inside our infrastructure, the same place where your workflow runs. The three things below are already part of it, working quietly in the background so you never have to think about them. Nothing to add, nothing to set up, nothing to worry about.

A futuristic MCP client docking bay
V8 Isolate01

Each Connector runs inside its own sealed environment.

Each Connector runs inside its own sealed V8 runtime — no access to your files, your system, or other servers. A Connector never sees past its own request.

Kill Switch02

One switch stops every agent. Instantly.

One action deactivates every Connector, revokes every token, and ends every session at once. AI Governance keeps the record.

FinOps per User03

Spending limits that pause instead of surprise.

Every user keeps their own connections and credentials, isolated from everyone else. Anything that would cross your spending limit is held for your approval, not billed.

Three controls, built into the layer your AI connects through.

Curated set · 10 capabilities

We ship only the actions that matter.

Capability set01 / 03

01-04

4 capabilities in this set.

Part of 10 available through Lacework.

  1. 01

    List host vulnerabilities

    This capability identifies active, high-impact CVEs running on your EC2 or GCE instances. It lists known vulnerabilities currently executing on your cloud hosts.

  2. 02

    Search alerts

    This capability fetches security events like anomalous Kubernetes executions or AWS IAM brute-force attempts. It searches Lacework alerts based on your specific time filters.

  3. 03

    List lql queries

    This capability provides access to all available Lacework Query Language (LQL) structures. It helps your agent map user-defined compliance checks to underlying datasets.

  4. 04

    List security policies

    This capability lists the global security policies enforced by Lacework. Use it to check if specific engineer actions violate your organizational structural norms.

Capability set02 / 03

05-07

3 capabilities in this set.

Part of 10 available through Lacework.

  1. 05

    Search cve exposure

    This capability scans your entire cloud infrastructure to find specific CVE exposures. It identifies exactly which machines are currently vulnerable to a designated CVE.

  2. 06

    Execute query

    This capability runs on-demand LQL threat hunting queries. It produces data matrices for tracking API key abuse, anomalous logins, or Kubernetes process trees.

  3. 07

    List container vulnerabilities

    This capability examines container registries like ECR or DockerHub for vulnerabilities. It finds critical CVEs at the filesystem level before they reach your CI/CD pipeline.

Capability set03 / 03

08-10

3 capabilities in this set.

Part of 10 available through Lacework.

  1. 08

    Get alert

    This capability retrieves deep contextual metadata for a specific security alert. It provides details on AWS accounts, container image SHAs, and correlated IP anomalies.

  2. 09

    List resource groups

    This capability lists the logical resource groups used to manage your Lacework architecture. It helps your agent distinguish between production and staging environments for policy evaluation.

  3. 10

    Search cloud inventory

    This capability queries the real-time Lacework cloud control-plane. Use it to find running instances, active networking perimeters, or unrestricted S3 buckets.

Real work

What teams actually run

01

Zero-Day Response

Quickly find every machine in your environment vulnerable to a newly released CVE.

02

Container Security

Check ECR or DockerHub images for critical vulnerabilities before they are deployed.

03

Cloud Asset Auditing

Identify misconfigured S3 buckets or exposed network perimeters using simple queries.

04

Anomalous Behavior Detection

Investigate suspicious Kubernetes executions or IAM brute-force attempts via your agent.

Automate a task

Put Lacework to work on one thing.

Step-by-step automations your AI runs through this Connector: the workflow, the prompts to start with, and the exact capabilities behind each move.

One connector, every AI

Lacework works with the most popular AI clients.

These are the most popular clients, each with a step-by-step guide: one link, set up once, with governance and visibility built in. And because everything runs on the MCP standard, the same connection also works in any other compatible client — nothing to rebuild.

ClaudeClaudeChatGPTChatGPTGeminiGeminiPerplexityPerplexityGrokGrokMicrosoft CopilotMicrosoft CopilotCursorCursorVS CodeVS CodeWindsurfWindsurfJetBrainsJetBrainsClineClineLangChainLangChainVercel AI SDKVercel AI SDKLovableLovableZ.aiZ.aiRaycastRaycastQwen CodeQwen CodeKimi CodeKimi CodeLe ChatLe Chat

Building your own app? The connector is yours to use.

You don't need a client to put Lacework to work: the same hosted connection plugs into your own applications and agent code, with the same governance on every request. Build with it, chat with it — one connection for both.

Observed, not estimated

948ms average. Fast in production.

Lacework is checked daily against the live service.

Daily averagePeak 1213ms
Oct 3Today
Fastest day
745ms
Slowest day
1213ms
14-day trend
Slowing+32%

Connect your client

One URL. Every client.

Activate the Connector, copy your link, and paste it into the client you already use. 10 capabilities arrive ready to run.

Preview access · not provider authentication

The vk_preview_* token belongs to Vinkius preview infrastructure. It lets Claude discover and display the capabilities of Lacework, so you can see the experience inside your AI.

It does not authenticate your account with Lacework. Actions requiring credentials or live account data may not run until you activate the Connector and authorize the service.

Lacework Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_xT38bIhhFhzvvpfxyO01Dv9Iop7sXt66wD8neHzv/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Lacework capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "lacework-cloud-security-cnapp-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_xT38bIhhFhzvvpfxyO01Dv9Iop7sXt66wD8neHzv/mcp"
    }
  }
}
  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Step-by-step instructions for each client are in the guide. How to connect

Guided setup for Claude? Set up Lacework in Claude and other AIs

See all the AI clients this connector works with ↑

Who it's for

Built for the work Lacework owners hand off.

This MCP is built for security and operations teams who need to move faster than a web dashboard allows.

  • 01

    Security Analysts

    They use the agent to hunt for threats and investigate polygraph alerts via natural language.

  • 02

    DevOps and SREs

    They monitor container and host vulnerabilities to keep the CI/CD pipeline secure.

  • 03

    Compliance Officers

    They audit security policies and unrestricted assets to maintain organizational posture.

FAQ

Questions Lacework owners ask.

  • 01

    How do I connect my Lacework account?

    You subscribe to the MCP on Vinkius and enter your Lacework Account, Key ID, and Secret. Once connected, it is ready to use in your AI client.

  • 02

    Which AI clients can I use with this MCP?

    You can use this MCP with any compatible client, including Claude, Cursor, and Windsurf.

  • 03

    Can I run custom queries?

    Yes, you can use the execute_query capability to run bespoke LQL (Lacework Query Language) requests for specific threat hunting needs.

  • 04

    Does this support container security?

    Yes, the MCP includes capabilities to list vulnerabilities in container registries like ECR and DockerHub.

  • 05

    Can I audit my S3 buckets?

    Yes, you can use the search_cloud_inventory capability to find unrestricted S3 buckets and other cloud assets.

  • 06

    Can I search for specific CVE exposure across my whole cloud environment?

    Yes. Use the search_cve_exposure capability and provide the official CVE ID (e.g. CVE-2023-1234). Your agent will filter the entire cloud footprint to determine exactly which specific nodes or machines are currently vulnerable.

  • 07

    How do I investigate the behavioral telemetry of a specific security alert?

    The get_alert capability extracts precisely what baseline behavior was deviated from for a specific Alert ID. Your agent will return detailed contextual metadata, including offending container SHAs and correlated IP anomalies.

  • 08

    Can my agent run custom threat hunting queries using LQL?

    Absolutely. Use the execute_query capability to run specialized Lacework Query Language (LQL) blocks. This allows your agent to perform complex mathematical analysis on cloud telemetry to identify deep security patterns.

Explore

More in Fort Knox

Suggestions

Connect Lacework to Claude, Cursor, ChatGPT & more