Skip to content
Aikido Security MCP Server

Aikido Security MCP Server

by Aikido Security
Released
v1.0.23
AGPL-3.0
Docs npm
Developer Tools

Summary

Runs Aikido's code and secrets scan as a tool inside your coding agent, returning machine-readable findings the agent can triage, fix or ignore in place.

Features

  • Aikido code and secrets scan exposed as an agent tool with machine-readable findings
  • Browser sign-in per Aikido region (EU/US/ME) with no token needed up front
  • AIKIDO_API_KEY personal access token for CI, containers and WSL
  • Documented configs for Cursor, Windsurf, VS Code, Claude Code, Codex CLI, Gemini CLI, JetBrains AI, Copilot, Mistral Vibe and OpenCode
  • Requires Node.js 18.19.0+ and an Aikido account

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

  1. Open your agent's MCP configuration file.
  2. Merge the snippet below into it.
  3. Restart the agent — the "Aikido Security MCP Server" tools will be available.
{
  "mcpServers": {
    "aikido-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@aikidosec/mcp"
      ]
    }
  }
}

Description

Aikido is an application-security platform aimed at engineering teams rather than security departments, and this MCP server puts one specific piece of it — the code and secrets scan — directly inside the agent that is writing the code. Instead of finding out in CI that the commit leaked a key, the agent scans, gets structured findings back, and fixes them before the commit exists.

The server is deliberately small. It exposes Aikido's scan as a tool and returns machine-readable findings, each of which the agent can triage, fix or ignore. That narrowness is the design: it adds a handful of tools to the agent's context rather than an entire security platform's API surface.

Authentication has two modes and does not require a decision up front. With nothing configured, the first tool call returns one-time sign-in links — one per Aikido region (EU, US, ME) — and you click the one matching your account; the token is then cached in the OS keychain. For CI, containers, WSL or anywhere a browser and keychain are not available, mint a Personal Access Token under Settings → Integrations → IDE → MCP and pass it as AIKIDO_API_KEY, which takes precedence over the cached browser token.

Installation is npx -y @aikidosec/mcp and the docs carry per-client configuration for Cursor, Windsurf, VS Code, Claude Code (including a bundled internal plugin), OpenAI Codex CLI, Gemini CLI, JetBrains AI / Junie, GitHub Copilot, Mistral Vibe and OpenCode, alongside pages on MCP permissions and troubleshooting. Requires Node.js 18.19.0 or newer and an Aikido account. Published under AGPL.

Related MCP Servers

MCP: Semgrep MCP

by Semgrep

Semgrep's official MCP server — scan code for security vulnerabilities, write and test custom rules, and pull findings from Semgrep Cloud, from inside an agent session.

Developer Tools

MCP: CVE MCP Server

by mukul975

Vulnerability triage for AI agents: 28 security tools across 24 free intelligence sources — NVD, EPSS, CISA KEV, MITRE ATT&CK, Shodan and VirusTotal — behind a single triage_cve call.

Developer Tools

MCP: Snyk MCP Server

by Snyk

Snyk's official MCP server, shipped inside the Snyk CLI: scan code, dependencies, containers and IaC for vulnerabilities, generate SBOMs and monitor projects from your agent.

Developer Tools
Browse all MCP servers →