RAD Security MCP server

List threat vectors

Get detailed information about a specific identity in a Kubernetes cluster

Get available facets for filtering cloud resources from a provider

Get values for a specific facet from a cloud provider

List cloud resources associated with a specific compliance control

Get detailed information about a specific Kubernetes resource misconfiguration

List all compliance control summaries for the account

Get manifest misconfigurations for a Kubernetes resource

Search CVEs by vendor and optionally product. Source: cve-search.org

Get the latest/newest 30 CVEs including CAPEC, CWE and CPE expansions. Source: cve-search.org

Get detailed information about a specific workflow run

List vulnerabilities in a container image with optional filtering by severity

Query a CSV document from the knowledge base using natural language. IMPORTANT: This tool ONLY works with CSV documents. Use list_knowledge_base_documents with filters='file_type:csv' to find CSV document IDs (search_knowledge_base results also contain document IDs). Results are returned as a markdown table

List workflow runs with optional filtering by workflow ID

Get detailed information about a specific inbox item

List dashboards for the account

List external integrations configured for the tenant (e.g., Slack, AWS CloudTrail, Okta). Returns integration details including capabilities, configuration, mcp support and sync status.

Get the SBOM of a container image

Mark an inbox item as a false positive with a reason

List available misconfiguration policies used by RAD Security to detect Kubernetes resource misconfigurations

List HTTP requests insights with optional filtering by method, path, source and destination workloads, and PII detection

Get list of identities for a specific Kubernetes cluster

List network connections with optional filtering

List network connection sources with optional filtering by source and destination workloads

Get a list of all vendors in the CVE database. Source: cve-search.org

Get runtime baselines for multiple containers

Get the latest manifest of a Kubernetes resource

List all workflows

List all compliance frameworks available for cloud resources (e.g., CIS, SOC2, PCI-DSS)

Get detailed information about a specific compliance control

List controls associated with a specific requirement within a compliance framework

Get detailed information about a specific cloud resource

Get a list of all products associated with a vendor in the CVE database. Source: cve-search.org

Get details for a specific CVE ID. Source: cve-search.org

List active CVE dispositions (ignored / false positive) for this account, with reason and author.

Get process trees for multiple containers

Get detailed information about a specific Kubernetes cluster managed by RAD Security

Get detailed information about a specific workflow by ID. It contains the workflow definition, default arguments, and schema how to run the workflow

List cloud resources for a specific provider with optional filtering

Update the status of a security finding

List all available RadQL data types (discovery). ALWAYS call this FIRST before using other RadQL tools to discover what data is available to query. Returns data types like 'containers', 'kubernetes_resources', 'inbox_items', 'cloud_resources', 'cloud_benchmarks', 'cloud_benchmark_summaries', etc. with descriptions.

Get the FULL text content of a knowledge base document (extracted text for PDF/DOCX, the raw file for markdown/plaintext/CSV). Use this to read or analyze a whole document rather than the excerpts search_knowledge_base returns. Find document IDs via list_knowledge_base_documents or search_knowledge_base results

Helper tool to build RadQL queries programmatically from structured conditions. Useful when you need to construct complex filter or stats queries from structured inputs.

Execute multiple RadQL queries in parallel for efficiency. Useful for fetching related data from different data types simultaneously (e.g., container details + vulnerabilities + network connections).

List workflow schedules with optional filtering by workflow ID

List widget templates with optional filtering by visualization type and category

Update an existing dashboard. Omitted fields are left unchanged, so a small edit (a title, one row) does not require resending the whole dashboard.

Search your organization's knowledge base to find relevant uploaded documents, procedures, reports, and other content using natural language queries

Get detailed information about a specific widget template

Create a dashboard for the account. Build `rows` from the widget templates (list_widget_templates / get_widget_template) so the visualization and query shapes are valid.

Ignore a CVE for this account so it no longer appears in vulnerability reporting. Use for confirmed false positives, accepted risks, or won't-fix decisions. Do NOT use for remediated CVEs — those drop off automatically on the next scan.

Get k8s audit logs with information about users who shelled into a pod

List security findings with optional filtering by types, severities, sources, and status

Update an existing automation with new YAML. Only automations created via create_custom_workflow can be updated. Returns the updated automation without echoing the definition back.

Add a cron-based schedule to an automation so it runs automatically at the specified times.

Get detailed information about a specific dashboard

Get schema/metadata for a specific RadQL data type. Shows available fields, data types, which fields can be filtered/searched, and provides query examples. Call this AFTER radql_list_data_types to understand how to query a specific data type.

Get detailed information about a specific dashboard template

List dashboard templates with optional filtering by category

Run a workflow with optional argument overrides

List containers secured by RAD Security with optional filtering by image name, image digest, namespace, cluster_id, or free text search

List container images with optional filtering by page, page size, sort, and search query

Create a new automation (a Windmill workflow) from a YAML definition. Pass the YAML document itself as a string, not a file path. It is validated server-side before deployment; on failure nothing is deployed and the errors are returned. Returns the new automation WITHOUT echoing the definition back — use `id` from the result when referring to it, and `get_workflow` if you need to read the definition.

List all collections in your organization's knowledge base. Collections are used to organize and categorize documents

List documents in your organization's knowledge base with optional filtering by collections, file type, or status

Get the most vulnerable images from your account

Execute RadQL queries for security investigations. Supports: list (filter/search), get_by_id (single item), stats (aggregations). WORKFLOW: radql_list_data_types -> radql_get_type_metadata -> radql_query COMMON FIELDS BY DATA TYPE: containers: name, image_name, image_repo, owner_kind, cluster_id, created_at Example: image_name:*nginx* AND owner_kind:Pod finding_groups: type, source_kind, source_name, rule_title, severity, event_timestamp Types: k8s_misconfiguration, k8s_audit_logs_anomaly Example: type:k8s_misconfiguration AND severity:critical inbox_items: severity (High|Medium|Low), type, title, archived, false_positive, created_at Example: severity:High AND archived:false kubernetes_resources: kind, name, namespace, cluster_id, owner_kind, created_at Example: kind:Deployment AND namespace:production CLOUD RESOURCES & COMPLIANCE (use these RadQL data types instead of dedicated cloud tools): cloud_resources: cloud_provider, cloud_account_id, resource_type, resource_name, resource_id, resource_json, last_seen_at Example: cloud_provider:aws AND resource_type:aws_iam_policy cloud_benchmark_summaries: cloud_provider, cloud_account_id, benchmark_id, title, description, fail_count, pass_count, total_count, last_seen_at Example: cloud_provider:aws AND fail_count>0 cloud_benchmarks: cloud_provider, cloud_account_id, benchmark_id, control_id, control_title, severity, status, reason, resource_id, last_seen_at Example: status:fail AND benchmark_id:*cis* CRITICAL QUOTING RULES: MUST quote when value contains: - Dates/timestamps: created_at>"2024-01-01" (NOT created_at>2024-01-01) - Hyphens: cluster_id:"abc-123-def", name:"kube-system" - UUIDs: id:"550e8400-e29b-41d4-a716-446655440000" - Spaces: title:"my alert" - Special chars: :, =, <, >, !, (, ) - Wildcards with hyphens: name:"kube-*" OK to leave unquoted: - Simple strings: status:active, kind:Pod - Numbers: count:123 - Booleans: archived:true - Simple wildcards: name:nginx* For complete schema: call radql_get_type_metadata with target data_type

List all requirements for a specific compliance framework

Get detailed information about a container secured by RAD Security

Get LLM analysis of a container's process tree

Get a time-limited download URL for the ORIGINAL document file (any format, including PDF/DOCX binaries). Use when you need the original file itself — e.g. to fetch it into a sandbox for structural parsing (tables, layout), or when get_knowledge_base_document_content reports no text available. For reading text, prefer get_knowledge_base_document_content

List Kubernetes clusters managed by RAD Security

List Kubernetes resources with optional filtering by namespace, resource types, and cluster

List inbox items with optional filtering by any field. Multiple filters can be combined eg. 'search:cve-2024-12345 and severity:high'

List possible values for a filter field (e.g., namespace list, cluster list, severity values). Useful for building dynamic filters when you need to know available enum-like values. Call this when constructing filters that need specific values.

Remove an account-wide CVE disposition, restoring the CVE to vulnerability reporting.