Aikido MCP Server: Security Scans for Claude, Cursor and Windsurf

• Scans files on disk for code, secret and infrastructure issues

  Runs Aikido's code, secrets and infrastructure scans on files you name. The server reads the files itself, so the assistant does not need to paste them. It is the preferred scan tool, and each path must be a file inside the folder you give.

  Try: “Scan the files I changed on this branch for security issues.”

  Runs code · aikido_scan_paths

• Scans code that is not saved to a file yet

  Runs the same scans on code passed in as text, such as a snippet you pasted or a change not applied yet. It is meant only for code that is not on disk, and handles up to 50 files per call.

  Try: “Scan this snippet before I save it.”

  Runs code · aikido_full_scan

• Checks dependency files for known vulnerabilities

  Scans manifests and lockfiles such as package.json, package-lock.json, requirements.txt or go.mod, passed as file paths, for open source dependency issues.

  Try: “Check my package.json and lockfile for vulnerable dependencies.”

  Runs code · aikido_oss_dependency_scan

• Lists issues from your Aikido feed

  Fetches security issues from Aikido, with filters for repository, cloud, team, workspace, issue type, severity, labels, branch and SLA status.

  Try: “Show the critical open issues in the payments repo.”

  Network · aikido_issues_list

• Lists the Aikido workspaces you can use

  Returns the workspaces the signed-in user can access, so the assistant can find the exact name before filtering issues.

  Try: “Which Aikido workspaces do I have?”

  Network · aikido_workspaces_list

• Starts the browser sign-in to Aikido

  Returns a sign-in link to open in your browser, or confirms you are already signed in. It can switch accounts or regions.

  Try: “Sign me in to Aikido.”

  Network · aikido_login

• Marks an issue as ignored, with a reason

  Ignores a security issue in your Aikido feed. You give the issue ID and a reason.

  Try: “Ignore issue 12345 because it is a test fixture.”

  Write · aikido_ignore_issue

• Brings an ignored issue back

  Reverses an ignore on an issue, with a reason.

  Try: “Unignore issue 12345.”

  Write · aikido_unignore_issue

• Hides an issue for a set time

  Snoozes an issue for 1 day, 1 week, 1 month, 3 months, 6 months or 1 year.

  Try: “Snooze issue 12345 for a month.”

  Write · aikido_snooze_issue

• Ends a snooze early

  Unsnoozes an issue that was snoozed.

  Try: “Unsnooze issue 12345.”

  Write · aikido_unsnooze_issue

• Changes an issue's severity

  Sets a new severity (critical, high, medium or low) on an issue, with a reason.

  Try: “Lower issue 12345 to low because it is only reachable in tests.”

  Write · aikido_adjust_issue_severity

Watch out for

• It can hide or downgrade security findings

  Ignore, snooze and severity tools change issues in your Aikido account. Check each reason before approving, since teammates will see the change. npmjs.com

• It reads the files you point it at

  Scan tools read the paths you name from your disk, and the server also calls Aikido's API for rules and issue details. Keep files you do not want scanned out of the paths you give it. npmjs.com

• It downloads and runs scanner binaries on your machine

  On first use the package fetches scanner programs from Aikido's S3 bucket and from the GitHub releases of Checkov and opengrep, then runs them on the files you scan. It also bundles a secrets scanner. Allow those downloads only on a machine where that is acceptable. npmjs.com

• Three extra scan tools are off by default

  Setting AIKIDO_MCP_ALL_TOOLS to true adds separate code, secrets and infrastructure scan tools. The default list already has combined scans. npmjs.com

Security advisories