# Aikido Security MCP > Aikido Security lets you take full control of your security posture from any AI client. It connects directly to your security stack to check vulnerabilities across cloud assets (AWS, GCP, Azure), code repositories, and containers. You can monitor compliance status for standards like ISO 27001 and SOC2, list all open issues by severity, or export full reports instantly. ## Overview - **Category:** fort-knox - **Price:** Free - **Tags:** code-security, vulnerability-management, sast, cloud-security, compliance-monitoring, security-dashboard ## Description Instead of opening ten different dashboards just to see if your company is secure, you talk to your AI agent. This MCP connects directly to Aikido Security, giving your agent the ability to act as a dedicated security analyst for your whole stack. You can ask it things like, 'What's our compliance status for ISO 27001?' or 'List all public S3 buckets in AWS.' The tool reads your cloud infrastructure assets, checks container images for known flaws, and tracks every open vulnerability—whether it's a leaked secret or a misconfigured database. Once the data is gathered, you can ask your agent to group these issues by type, helping you prioritize exactly what needs fixing first. All this deep visibility is managed through Vinkius, making sure that regardless of which AI client you use, all your security data is in one place for natural conversation and action. ## Tools ### export_all_issues Pulls a full report of all security issues found in your organization's environment, perfect for audits or deep analysis. ### get_iso_compliance Provides a detailed overview showing which controls are passing and which need attention for ISO 27001 compliance. ### get_issue_group Gathers deep information about specific issue groups, helping you understand related vulnerabilities across multiple systems. ### get_soc2_compliance Checks your organization's readiness for SOC2 audit preparation by reporting on required trust service criteria. ### get_workspace Verifies the overall setup of your security workspace and reports any configuration errors. ### list_apps Lists every web application protected by the Aikido firewall, verifying their protection status against common attacks. ### list_cloud_assets Shows a list of all cloud infrastructure assets monitored by Aikido, letting you identify misconfigurations or vulnerabilities in your attack surface. ### list_code_repositories Retrieves a list of every connected code repository from services like GitHub and GitLab that is currently being scanned for flaws. ### list_connected_clouds Shows all cloud accounts linked to Aikido, verifying which environments are actively monitored for security issues. ### list_containers Lists every container image and registry scanned by Aikido, helping you monitor base images or dependencies for known vulnerabilities. ### list_custom_rules Shows all custom rules you've defined, allowing you to audit your organization-specific security checks. ### list_open_issues Gathers a comprehensive list of all open vulnerabilities across code, cloud, and containers, which is the core function for triage. ### list_teams Lists organizational teams within Aikido used to manage security responsibilities and assign issues. ### list_users Provides a roster of all users in the organization, detailing their roles and access levels for auditing purposes. ### list_virtual_machines Lists every virtual machine monitored by Aikido, allowing you to check its specific attack surface. ### list_webhooks Shows all configured webhooks for services like Slack or Jira, helping you verify that security alerts are sending correctly. ## Prompt Examples **Prompt:** ``` Show me all critical and high severity open security issues, grouped by type. ``` **Response:** ``` I've retrieved your open issues. You currently have 23 open issue groups: 4 CRITICAL (including 2 actively exploited CVEs in log4j), 12 HIGH (mostly outdated dependencies and exposed secrets), 5 MEDIUM, and 2 LOW. Top priority: CVE-2024-1234 affecting 3 repositories — patch available. Would you like the full details of any specific issue group? ``` **Prompt:** ``` What's our current ISO 27001 compliance status? ``` **Response:** ``` Your ISO 27001 compliance overview shows 89% of controls passing (142/160). Areas needing attention: A.8.25 (Secure Development Lifecycle) — 3 failing checks, A.8.28 (Secure Coding) — 2 failing checks. All other control categories are passing. You're well-positioned for your next audit. Would you like the full breakdown by control category? ``` **Prompt:** ``` List all our connected cloud accounts and any misconfigurations found in the last 7 days. ``` **Response:** ``` You have 3 connected cloud accounts: AWS (production), GCP (staging), Azure (dev). In the last 7 days, Aikido found 5 new cloud misconfigurations: 2 public S3 buckets in production AWS, 1 over-permissive IAM role in GCP, and 2 unencrypted RDS instances in AWS staging. All are classified as HIGH priority. Would you like the details of any specific misconfiguration? ``` ## Capabilities ### Assess compliance standards Gets an overview showing whether specific controls meet ISO 27001 or SOC2 requirements. ### Scan cloud infrastructure assets Lists all monitored cloud resources and identifies any misconfigurations or vulnerabilities across AWS, GCP, and Azure. ### Inventory code and containers Shows every connected Git repository and container image that is currently being scanned for flaws. ### Triage open security issues Retrieves a full, prioritized list of all vulnerabilities found across your entire technical environment. ### Audit web applications Verifies which external web apps are protected by the Aikido firewall against common attacks like XSS or SQL injection. ## Use Cases ### Pre-audit checklist preparation A compliance officer needs proof that the company meets ISO 27001 standards before an external review. They ask their agent to run `get_iso_compliance` and then follow up by running `export_all_issues`, gathering both compliance evidence and a full vulnerability report in one go. ### Finding forgotten misconfigurations A DevOps team is deploying a new service to GCP. They ask their agent to run `list_connected_clouds` first, then immediately follow up with `list_cloud_assets` to ensure no publicly exposed storage buckets or unencrypted databases slipped through. ### Vulnerability deep dive A security engineer sees a general alert about 'CVE-2024-1234' in `list_open_issues`. They then use `get_issue_group` to understand exactly which components across different repositories are affected and what the remediation path should be. ### Preparing for a security review An engineering manager needs an executive summary of risk. They ask their agent to compile data from `list_code_repositories` (to see development coverage) and then execute `export_all_issues`, providing one clean file for the VP. ## Benefits - Instantly triage open issues: Use `list_open_issues` to get a prioritized, filtered view of all critical vulnerabilities without opening the Aikido dashboard. You see exactly what needs fixing first. - Verify your entire cloud attack surface: Run `list_cloud_assets` to discover any misconfigurations in AWS or GCP, letting you secure infrastructure before it's exploited. - Automate compliance reporting: Call `get_iso_compliance` or `get_soc2_compliance` to get an immediate status report. This is perfect for preparing evidence ahead of a major audit. - Track all connected assets: Run `list_code_repositories` and `list_containers` together to gain one clear picture of every piece of code and image that needs security review. - Audit user access easily: Use `list_users` or `list_teams` to verify who has what permissions. This is critical for internal governance checks. ## How It Works The bottom line is that you don't have to navigate multiple dashboards; your AI agent handles all the backend querying for you. 1. Subscribe to this MCP and provide your Aikido API token via your AI client's settings. 2. Tell your agent what you need—for example, 'What are our high-priority open issues?' 3. The MCP executes the request, pulling vulnerability data, compliance status, or asset lists directly into your conversation. ## Frequently Asked Questions **How do I find all vulnerabilities using Aikido Security MCP?** You use `list_open_issues`. This tool pulls a comprehensive list of every vulnerability found, covering cloud misconfigs, code flaws, and container issues, letting you prioritize remediation efforts immediately. **Can I check if my AWS assets are secure using Aikido Security MCP?** Yes. Use `list_cloud_assets` to get a full inventory of your monitored cloud infrastructure. This reveals potential misconfigurations or security gaps in your public cloud environment. **Does Aikido Security MCP help with compliance audits?** Absolutely. You can run `get_iso_compliance` and `get_soc2_compliance` to generate official overviews of your readiness for both major standards, saving you manual evidence gathering. **How do I see which Git repos are monitored?** Run `list_code_repositories`. This tool provides a clear list of all connected code repositories from services like GitHub and GitLab that are actively being scanned for issues. **What if I need to export my findings?** Use the `export_all_issues` function. It pulls every security finding into a bulk report, which is perfect for sharing with stakeholders or adding to an official audit trail.