Aribot

Official15 toolsLive

by aristiun · HTML

Threat modeling, code/cloud/pipeline scanning, shadow-AI discovery, compliance checks and fixes.

Topics

ai-agentsai-securityappseccloud-securitycode-securitycompliancedevsecopsiso27001linddunmcpmodel-context-protocolnistremediationsecurityshadow-aisoc2stridethreat-modeling

Captured live from the server via tools/list.

get_billing

Billing status + self-service payment for your company: credit-wallet balance, pay-per-use flag, license tier / annual commitment, per-action prices, purchasable plans, and any approved-but-unpaid plans. Pass `checkout_request_id` to get a hosted Stripe Checkout URL to COMPLETE an approved plan, `topup_amount` (EUR) to get one to TOP UP the wallet, or `request_plan` (starter|pay_per_use|pro|max|enterprise) to REQUEST a plan (files a request for super-admin approval — never grants). Use this to view or RESOLVE a 402 without leaving the connector.

Parameters3

checkout_request_id	string	optional	Approved license_request_id to complete payment for (returns a hosted Checkout URL)
topup_amount	number	optional	Optional EUR amount to top up the credit wallet (returns a hosted Checkout URL)
request_plan	string	optional	Optional plan key to request (pro\|max\|…) — files a request for super-admin approval; does not grant or charge

Raw schema

{
  "type": "object",
  "properties": {
    "checkout_request_id": {
      "type": "string",
      "description": "Approved license_request_id to complete payment for (returns a hosted Checkout URL)"
    },
    "topup_amount": {
      "type": "number",
      "description": "Optional EUR amount to top up the credit wallet (returns a hosted Checkout URL)"
    },
    "request_plan": {
      "type": "string",
      "description": "Optional plan key to request (pro|max|…) — files a request for super-admin approval; does not grant or charge"
    }
  },
  "required": [],
  "additionalProperties": false
}

generate_threat_model

Create a threat model from a normalized architecture (ReactFlow nodes + edges). Ingests components via the shared Stage-0 service; the pipeline then auto-generates threats. Returns the diagram id.

Parameters3

name	string	optional	Threat model name
nodes	array	required	ReactFlow nodes (each: id, position, data.label)
edges	array	optional	ReactFlow edges

Raw schema

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Threat model name"
    },
    "nodes": {
      "type": "array",
      "items": {
        "type": "object"
      },
      "description": "ReactFlow nodes (each: id, position, data.label)"
    },
    "edges": {
      "type": "array",
      "items": {
        "type": "object"
      },
      "description": "ReactFlow edges"
    }
  },
  "required": [
    "nodes"
  ],
  "additionalProperties": false
}

verify_threats_in_code

Verify whether threats are mitigated in a scan's uploaded code. With `threat_id`, verifies one threat synchronously and returns the verdict; without it, verifies every diagram threat in the background. Wraps code_review ThreatVerificationService.

Parameters5

scan_id	string	required	CodeReviewScan id (uuid)
threat_id	string	optional	Optional: a single threat id or code
repository_id	string	optional	Optional connected repo to fetch code from
code_content	string	optional	Optional inline code context
async_	boolean	optional

Raw schema

{
  "type": "object",
  "properties": {
    "scan_id": {
      "type": "string",
      "description": "CodeReviewScan id (uuid)"
    },
    "threat_id": {
      "type": "string",
      "description": "Optional: a single threat id or code"
    },
    "repository_id": {
      "type": "string",
      "description": "Optional connected repo to fetch code from"
    },
    "code_content": {
      "type": "string",
      "description": "Optional inline code context"
    },
    "async_": {
      "type": "boolean",
      "default": true
    }
  },
  "required": [
    "scan_id"
  ],
  "additionalProperties": false
}

get_traceability

Return the diagram→threat→finding→control→requirement→remediation traceability matrix for a scan in your scope, with coverage metrics.

Parameters1

scan_id

string

required

Code-review scan id

Raw schema

{
  "type": "object",
  "properties": {
    "scan_id": {
      "type": "string",
      "description": "Code-review scan id"
    }
  },
  "required": [
    "scan_id"
  ],
  "additionalProperties": false
}

get_framework_coverage

Compliance-framework coverage for a diagram (real, ControlCodeMap-backed), optionally for one framework, plus an optional crossmap relationship graph. Wraps derive_framework_coverage + crossmap_cypher.build_graph.

Parameters3

diagram_id	string	required	Diagram pk or uuid
framework	string	optional	Optional framework filter (e.g. 'NIST-800-53', 'SOC2')
include_graph	boolean	optional	Also return the crossmap node/edge graph

Raw schema

{
  "type": "object",
  "properties": {
    "diagram_id": {
      "type": "string",
      "description": "Diagram pk or uuid"
    },
    "framework": {
      "type": "string",
      "description": "Optional framework filter (e.g. 'NIST-800-53', 'SOC2')"
    },
    "include_graph": {
      "type": "boolean",
      "description": "Also return the crossmap node/edge graph",
      "default": false
    }
  },
  "required": [
    "diagram_id"
  ],
  "additionalProperties": false
}

get_remediation

Compute a remediation plan for a threat/finding WITHOUT applying it (mode=dry_run). Runs the same governed engine as apply_remediation, including the patent gates, and returns the proposed steps.

Parameters3

threat_id	string	required	Threat id/code to remediate
rule_id	string	required	Policy/rule id (e.g. AWS_S3_PUBLIC_ACCESS)
resource_context	object	optional	provider/resource_id/region/account_id/metadata

Raw schema

{
  "type": "object",
  "properties": {
    "threat_id": {
      "type": "string",
      "description": "Threat id/code to remediate"
    },
    "rule_id": {
      "type": "string",
      "description": "Policy/rule id (e.g. AWS_S3_PUBLIC_ACCESS)"
    },
    "resource_context": {
      "type": "object",
      "description": "provider/resource_id/region/account_id/metadata"
    }
  },
  "required": [
    "threat_id",
    "rule_id"
  ],
  "additionalProperties": false
}

compliance_status

Company-level compliance posture rollup (pass rate, control compliance, mitigated counts, per-framework coverage). Suitable for a CI gate. Wraps the traceability company rollup.

Parameters2

scan_id	string	optional	Optional anchor scan; latest is used if omitted
diagram_id	string	optional	Optional diagram to add framework coverage for

Raw schema

{
  "type": "object",
  "properties": {
    "scan_id": {
      "type": "string",
      "description": "Optional anchor scan; latest is used if omitted"
    },
    "diagram_id": {
      "type": "string",
      "description": "Optional diagram to add framework coverage for"
    }
  },
  "required": [],
  "additionalProperties": false
}

discover_shadow_ai

Shadow-AI posture (part of Code Security): unsanctioned / unknown AI-service usage discovered in code — totals, risk score, provider/type breakdown, hardcoded-key count, and top discoveries. Company latest, or one scan with `scan_id`. Reads code_review ShadowAIReport/ShadowAIDiscovery.

Parameters2

scan_id	string	optional	Optional CodeReviewScan id; company-wide latest if omitted
limit	integer	optional	Max discoveries to return

Raw schema

{
  "type": "object",
  "properties": {
    "scan_id": {
      "type": "string",
      "description": "Optional CodeReviewScan id; company-wide latest if omitted"
    },
    "limit": {
      "type": "integer",
      "description": "Max discoveries to return",
      "default": 15
    }
  },
  "required": [],
  "additionalProperties": false
}

get_api_security

API security inventory (part of Code Security): discovered API endpoints with authentication status, risk level and risk factors, plus method/risk breakdowns. Company-wide or one scan with `scan_id`. Reads code_review ApiEndpointDiscovery.

Parameters2

scan_id	string	optional	Optional CodeReviewScan id; company-wide if omitted
limit	integer	optional	Max endpoints to return

Raw schema

{
  "type": "object",
  "properties": {
    "scan_id": {
      "type": "string",
      "description": "Optional CodeReviewScan id; company-wide if omitted"
    },
    "limit": {
      "type": "integer",
      "description": "Max endpoints to return",
      "default": 20
    }
  },
  "required": [],
  "additionalProperties": false
}

get_cloud_compliance

Cloud security & compliance posture (Cloud Compliance): per connected cloud account, the latest CIS/NIST cloud-policy scan — compliance %, failing policies/records, status — plus a company rollup. Reads customers.Account.latest_scan -> compliances.ScanResults.

Parameters1

account_id

string

optional

Optional single cloud Account id; all company accounts if omitted

Raw schema

{
  "type": "object",
  "properties": {
    "account_id": {
      "type": "string",
      "description": "Optional single cloud Account id; all company accounts if omitted"
    }
  },
  "required": [],
  "additionalProperties": false
}

code_review_scan

Start (or re-run) a code-security scan for an existing scan/repository in your scope. Returns a poll pointer; results include SAST, secrets, deps, pipeline review and the traceability matrix.

Parameters1

scan_id

string

required

Id of an existing code-review scan to (re)run

Raw schema

{
  "type": "object",
  "properties": {
    "scan_id": {
      "type": "string",
      "description": "Id of an existing code-review scan to (re)run"
    }
  },
  "required": [
    "scan_id"
  ],
  "additionalProperties": false
}

compliance_scan

Run a cloud/platform or compliance scan against an account or diagram in your scope (async). scan_type ∈ platform|compliance|pipeline|sbom. Returns a task id to poll.

Parameters7

scan_type	string	required	platform \| compliance \| pipeline \| sbom
account_id	string	optional	Cloud account id (account-scoped scans)
diagram_id	string	optional	Diagram id/uuid (diagram-scoped scans)
frameworks	array	optional	Optional standard/framework ids to scope the scan
severity_filter	array	optional	Optional severity levels to include
simulation_mode	boolean	optional	Dry-run the scan without side effects
source	string	optional	Scan source (default: hybrid)

Raw schema

{
  "type": "object",
  "properties": {
    "scan_type": {
      "type": "string",
      "enum": [
        "platform",
        "compliance",
        "pipeline",
        "sbom",
        "diagram",
        "account"
      ],
      "description": "platform | compliance | pipeline | sbom"
    },
    "account_id": {
      "type": "string",
      "description": "Cloud account id (account-scoped scans)"
    },
    "diagram_id": {
      "type": "string",
      "description": "Diagram id/uuid (diagram-scoped scans)"
    },
    "frameworks": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Optional standard/framework ids to scope the scan"
    },
    "severity_filter": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Optional severity levels to include"
    },
    "simulation_mode": {
      "type": "boolean",
      "description": "Dry-run the scan without side effects"
    },
    "source": {
      "type": "string",
      "description": "Scan source (default: hybrid)"
    }
  },
  "required": [
    "scan_type"
  ],
  "additionalProperties": false
}

apply_remediation

Apply a remediation for real (mode=live). Routed through the full governance funnel — patent reachability/kill-chain gates, autonomy policy and the approval flow. If your policy requires approval it returns 'requires_approval' rather than acting.

Parameters3

threat_id	string	required	Threat id/code to remediate
rule_id	string	required	Policy/rule id (e.g. AWS_S3_PUBLIC_ACCESS)
resource_context	object	optional	provider/resource_id/region/account_id/metadata

Raw schema

{
  "type": "object",
  "properties": {
    "threat_id": {
      "type": "string",
      "description": "Threat id/code to remediate"
    },
    "rule_id": {
      "type": "string",
      "description": "Policy/rule id (e.g. AWS_S3_PUBLIC_ACCESS)"
    },
    "resource_context": {
      "type": "object",
      "description": "provider/resource_id/region/account_id/metadata"
    }
  },
  "required": [
    "threat_id",
    "rule_id"
  ],
  "additionalProperties": false
}

get_diagram_summary

The canonical diagram summary every badge/card/header reads: threat counts by severity, risk value, compliance and framework coverage.

Parameters1

diagram_id

string

required

Diagram id/uuid

Raw schema

{
  "type": "object",
  "properties": {
    "diagram_id": {
      "type": "string",
      "description": "Diagram id/uuid"
    }
  },
  "required": [
    "diagram_id"
  ],
  "additionalProperties": false
}

get_insights

Threat/control matrix metrics + framework coverage for a diagram, joined with its latest code-security scan when one exists.

Parameters1

diagram_id

string

required

Diagram id/uuid

Raw schema

{
  "type": "object",
  "properties": {
    "diagram_id": {
      "type": "string",
      "description": "Diagram id/uuid"
    }
  },
  "required": [
    "diagram_id"
  ],
  "additionalProperties": false
}

README.md4 KBView on GitHub

Aribot

Aribot — MCP server for security work

Aribot MCP

Live page: https://aristiun.github.io/aribot-mcp/ · Product: https://aribot.ayurak.com · Registry: io.github.aristiun/aribot

Aribot is a security tool from Ayurak / Aristiun, available as a remote Model Context Protocol (MCP) server. Connect it to any MCP client — ChatGPT, Gemini, Claude, or your own — and run real security work from the assistant you already use, without switching tools.

This repository is a public manifest for the hosted server. It contains no product code — only the connection details. The server requires OAuth, so listing its address exposes nothing without an authorized login.

Unified threat modeling — one model, not five tools

Aribot builds one threat model per system and layers every discipline onto it — security (STRIDE + LINDDUN), cloud posture (AWS · Azure · GCP), compliance (NIST · ISO 27001 · SOC 2), and the economics of each risk (value at risk, cost to fix, dollars saved once healed) — all kept traceable end to end:

Threat → Requirement → Control → Framework → Code → Fix

Ask for any link in that chain, in either direction, with evidence behind every finding and every fix.

What you can do with it

Threat modeling

Turn a diagram or a written description of a system into a full threat model
STRIDE and LINDDUN coverage, generated per component and per data flow
Threats mapped to the security controls, requirements, and compliance frameworks that address them
A traceability view from each threat → finding → control → requirement → remediation
Re-model as the design changes; link related diagrams and reuse component threat libraries

Scanning

Code security — static analysis of a connected repository
Pipeline security — CI/CD configuration and supply-chain checks
Cloud & compliance — posture checks across AWS, Azure, and GCP accounts
SBOM — generate a software bill of materials
Shadow AI & API discovery — find where AI/LLM use and API endpoints have spread across your estate

Compliance

Coverage and control status against NIST, ISO 27001, SOC 2, and other frameworks
See which controls a threat model or scan already satisfies, and where the gaps are

Vendors

Assess a third party's posture and fold it into your own risk view

Remediation

Get a fix for a finding — as code, cloud configuration, or infrastructure-as-code
Keep it advisory, or apply it (e.g. open a pull request or push a cloud change) under approval

Connect

Point any MCP client at the server and complete the OAuth prompt:

code

https://mcp.aribot.ayurak.com/mcp


Transport	Streamable HTTP
Auth	OAuth 2.1 (Authorization Code + PKCE; Dynamic Client Registration)
Homepage	https://aribot.ayurak.com

OAuth is discovered automatically at https://mcp.aribot.ayurak.com/.well-known/oauth-authorization-server.

Example (Claude Code):

code

claude mcp add --transport http aribot https://mcp.aribot.ayurak.com/mcp

Access controls

Each call is checked against your company's licence, the OAuth scopes you granted (read:findings, read:threatmodel, read:insights, run:scan, run:codereview, write:threatmodel, run:remediation), your team's roles, and your tenant boundary. Usage is metered, and every action is logged. So you can run security work from an assistant without losing track of who can do what, or which company's data is which.

Tools

generate_threat_model · verify_threats_in_code · get_traceability · get_framework_coverage · compliance_status · discover_shadow_ai · get_api_security · get_cloud_compliance · get_remediation · get_billing

See the full tool list and pricing at https://ayurak.com/pricing.

Install

Tools (15)

get_billinggenerate_threat_modelverify_threats_in_codeget_traceabilityget_framework_coverageget_remediationcompliance_statusdiscover_shadow_ai

Remote endpoint

Streamable HTTP

Hosted server - connect over the network, no local install.

url

https://mcp.aribot.ayurak.com/mcp

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "aribot": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.aribot.ayurak.com/mcp"
      ]
    }
  }
}

Desktop config is stdio-only; this bridges via mcp-remote. Native remote: Settings > Connectors.