@aikidosec/mcp

Tool to ignore a security issue from Aikido feed. WHEN TO CALL THIS TOOL - The user wants to ignore a security issue from the Aikido feed. - The user provides the issue ID and the reason for ignoring the issue.

Starts the Aikido sign-in flow. Returns a sign-in URL for the user to open in their browser, OR confirms the user is already signed in. WHEN TO CALL THIS TOOL - The user explicitly asks to sign in, log in, authenticate, or connect to Aikido. - The user asks to switch Aikido accounts or re-authenticate. Pass `force_reauth: true` so the sign-in flow starts even if a token is already cached. - An earlier Aikido tool returned "ACTION REQUIRED — Aikido sign-in" and the user now wants to complete that sign-in. - The user pastes a token they copied from the Aikido sign-in modal (a fallback for when browser couldn't deliver the token automatically). Pass the value verbatim as the `token` argument. NEVER fabricate the `token` value. Only pass it when the user supplies an explicit string they copied from the Aikido UI. REGION - By default, omit `region`. Sign-in automatically redirects the user to their Aikido account's region, so they no longer have to choose one. - Only pass `region` (EU / US / ME / AU) when the user explicitly names a region, or when the automatic redirect sent them to the wrong one. To switch the region of an already signed-in user, pass `force_reauth: true` as well. RESPONSE - If a `token` was passed: a short confirmation that the token was stored, or an error if it didn't look like a valid Aikido token. - If already signed in and `force_reauth` is not set: a short confirmation message. Continue with whatever the user actually wanted. - If sign-in is needed (or `force_reauth` was set): a single sign-in URL plus instructions. The URL contains a one-time `state` token and `redirect_uri` that MUST be passed through verbatim — do not strip query parameters when showing it to the user.

Runs an Aikido SAST and Secrets scan locally on provided code files returns the findings in JSON format. Files should be provided as paths relative to the root of the workspace or repository (Unix-style paths). If this is not possible, just the filename should be given. There is a limit of 50 files that can be scanned in a single request. If you need to scan more files, you can do multiple requests. If a repository name is provided, it will be used to identify the repository in the Aikido platform. Only pass a repository name if the files are actually coming from a repository - do not provide a repository name for standalone files or files from a local workspace that is not part of a repository. Use this tool when you need to: - scan code files for SAST vulnerabilities - scan code files for Secrets vulnerabilities

Tool to fetch security issues from Aikido feed. WHEN TO CALL THIS TOOL - The user asks to list, show, count, or summarize Aikido security issues from the aikido feed. - The user can scope the issues to a specific cloud name, repo name, vm name, domain name, container name, team name or workspace name. - The user can scope the issues of a repository to a specific branch name - The user can scope the issues to repositories or images carrying one or more labels. - The user can scope the issues to be out of SLA or SLA is due soon. The value of those parameters is a boolean. - You are about to triage or fix security issues and need the current issue set. OUTPUT FORMATTING Use this exact format for every issue (increment #). Issue #1: <issue_title> - ID: <issue_id> - Issue type: <issue_type> - Severity: <issue_severity> (<issue_severity_label>) - Remediation: <issue_remediation> Add extra response fields as additional bullets when relevant, e.g.: - File: <issue_file> (line <issue_start_line>) - Location: <location.type> <location.name> (<location.branch_name>) - Issue link: <issue_link> - SLA due date: <issue_remediate_by_date>