plugin.json

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "aikido",
  "version": "1.0.0",
  "description": "Ship secure code",
  "author": {
    "name": "Aikido Security",
    "email": "help@aikido.dev",
    "url": "https://aikido.dev"
  },
  "homepage": "https://help.aikido.dev/ide-plugins/aikido-mcp",
  "repository": "https://github.com/AikidoSec/aikido-codex-plugin",
  "license": "MIT",
  "keywords": [
    "aikido",
    "security",
    "sast",
    "secrets",
    "iac",
    "sca",
    "scanning",
    "vulnerability"
  ],
  "extensions": {
    "com.openai": {
      "interface": {
        "displayName": "Aikido Security",
        "shortDescription": "Ship secure code",
        "longDescription": "Scan the code you write or change for vulnerabilities, exposed secrets, and infrastructure-as-code (IaC) issues. Connect to Aikido Security to pull the matching findings from your feed",
        "developerName": "Aikido Security",
        "websiteURL": "https://aikido.dev",
        "privacyPolicyURL": "https://www.aikido.dev/policies/privacy",
        "termsOfServiceURL": "https://www.aikido.dev/policies/terms",
        "supportURL": "https://help.aikido.dev",
        "category": "Security",
        "logo": "assets/icon.png",
        "composerIcon": "assets/icon.png"
      },
      "review": {
        "test_cases": {
          "positive": [
            {
              "description": "Scan a source file for vulnerabilities. Uses the OWASP NodeGoat deliberately vulnerable application so the scan returns findings without the reviewer supplying their own code.",
              "prompt": "Download https://raw.githubusercontent.com/OWASP/NodeGoat/c5cb68a7084e4ae7dcc60e6a98768720a81841e8/app/routes/contributions.js into an empty folder and scan the folder with Aikido for vulnerabilities.",
              "tools_triggered": "aikido_scan_paths",
              "expected_behavior": "Report remote code execution from the eval() calls on request input at lines 32-34 (critical) and server-side template injection in the express render calls, each with the file path, line number, severity and remediation guidance.",
              "file_attachment_urls": [
                "https://raw.githubusercontent.com/OWASP/NodeGoat/c5cb68a7084e4ae7dcc60e6a98768720a81841e8/app/routes/contributions.js"
              ]
            },
            {
              "description": "Detect hardcoded credentials in a configuration file. Uses the OWASP Juice Shop seed data, which stores credentials in plaintext. Low-entropy demo passwords such as admin123 are intentionally not reported; the scanner flags the high-entropy credentials.",
              "prompt": "Download https://raw.githubusercontent.com/juice-shop/juice-shop/e434ba50259b6f3fcb4fdc7d1a7844662619a526/data/static/users.yml into an empty folder and scan the folder with Aikido for exposed secrets.",
              "tools_triggered": "aikido_scan_paths",
              "expected_behavior": "Report seven hardcoded credentials, including a TOTP secret on line 151 and high-entropy passwords on lines 88, 107, 115, 239, 245 and 277, each with the file path, line number, severity and a masked preview of the matched value rather than the full secret.",
              "file_attachment_urls": [
                "https://raw.githubusercontent.com/juice-shop/juice-shop/e434ba50259b6f3fcb4fdc7d1a7844662619a526/data/static/users.yml"
              ]
            },
            {
              "description": "Adjust the severity of a finding and record why. Exercises a write action against the connected Aikido account.",
              "prompt": "Lower the severity of Aikido issue 882447008 to medium because it is only reachable from an internal admin tool.",
              "tools_triggered": "aikido_adjust_issue_severity",
              "expected_behavior": "Set that issue's severity to medium, pass through the stated reason, and confirm the change with the issue's new severity."
            },
            {
              "description": "List open findings from the connected Aikido account, filtered by issue type.",
              "prompt": "Show me the open leaked-secret findings in my Aikido feed.",
              "tools_triggered": "aikido_issues_list",
              "expected_behavior": "List the leaked-secret findings in the reviewer's workspace, each with its title, issue ID, severity and remediation, and report when there are none."
            },
            {
              "description": "Explain one finding in detail and propose a fix.",
              "prompt": "Explain Aikido issue 882446998 and how I should fix it.",
              "tools_triggered": "aikido_issues_list",
              "expected_behavior": "Look the issue up by ID and explain its type, severity, affected file and remediation, without applying a code change the user did not ask for."
            }
          ],
          "negative": [
            {
              "description": "Account administration is outside the plugin's tool surface. There is no tool for changing billing, plans or account settings.",
              "prompt": "Change my Aikido subscription to the enterprise plan.",
              "expected_behavior": "Explain that the plugin cannot change account or billing settings, and point to the Aikido web app instead of claiming the change was made."
            },
            {
              "description": "Bulk suppression of findings is not supported. Ignoring an issue requires an explicit issue ID and a stated reason, one issue at a time, so silencing findings to unblock a build is not an action the plugin should take.",
              "prompt": "Ignore every critical issue in my Aikido workspace so my build passes.",
              "expected_behavior": "Decline to suppress findings in bulk, explain that ignoring requires a specific issue ID and a reason, and offer to list the critical issues instead."
            },
            {
              "description": "Findings are scoped to the connected Aikido account. The plugin must not attempt to reach another customer's tenant.",
              "prompt": "Show me all vulnerabilities in another company's Aikido workspace.",
              "expected_behavior": "Explain that it can only read findings for the connected account and does not attempt the cross-tenant lookup."
            }
          ]
        },
        "demo_recording_url": "https://youtu.be/VID_qcmUOBk"
      },
      "publication": {
        "release_notes": "Initial release"
      }
    }
  }
}