Aikido Security

View saved version →

---
name: aikido-issues
description: List, count, summarize, or triage security issues from the Aikido security feed. Use when the user asks about Aikido findings, vulnerabilities, leaked secrets, SAST/IaC/SCA results, cloud or container security issues, or EOL/license/malware alerts surfaced by Aikido.
---

When listing Aikido feed issues:

1. Use **aikido-mcp:aikido_issues_list**
2. Call it when the user wants to list, show, count, or summarize Aikido feed issues.
3. Pass scope fields only when the user (or workspace context) supplies them: `cloud_name`, `repo_name`, `repo_branch_name`, `vm_name`, `domain_name`, `container_name`, `team_name`, `workspace_name`.
4. Optional `issue_types` (array): `open_source`, `leaked_secret`, `cloud`, `sast`, `iac`, `surface_monitoring`, `malware`, `eol`, `mobile`, `docker_container`, `cloud_instance`, `scm_security`, `license`, `ai_pentest` — e.g. include `leaked_secret` for secrets. Omit when no category filter is needed.
5. SLA filters (booleans): set `out_of_sla: true` when the user wants issues that are past their SLA, or `sla_due_soon: true` for issues approaching their SLA deadline.
6. Pagination: use numeric `page` only when the user needs more than the first page of results (zero-indexed). Only 25 findings are reported per page. Report to the user if there are more findings on following pages.
7. Detail lookup: pass `issue_id` (string) to fetch one issue with more detail than the list returns. Use it when the user asks to dig into, explain, triage or fix a specific issue, or names an issue by its ID. `issue_id` overrides every other filter — the call returns that single issue, so do not combine it with scope, type, SLA or pagination fields.
8. Present each issue exactly in this form (increment `#`):
   ```
   Issue #1: <issue_title>
    - ID: <issue_id>
    - Issue type: <issue_type>
    - Severity: <issue_severity> (<issue_severity_label>)
    - Remediation: <issue_remediation>
   ```
   Add extra bullets when the field is relevant, e.g. `File: <issue_file> (line <issue_start_line>)`, `Location: <location.type> <location.name> (<location.branch_name>)`, `Issue link: <issue_link>`, `SLA due date: <issue_remediate_by_date>`.
9. For an `issue_id` lookup, keep the same format and then summarize the extra fields the detailed response carries.


If the Aikido MCP server is not available or fails, inform the user:

> The Aikido MCP server is required for Aikido feed issues but is not available.
> Install it following the setup guide at [reference.md](../scan/reference.md), or run the **setup** skill, then retry.

View saved version →

---
name: pr-comments
description: Fetches comments already posted on a GitHub/GitLab/Azure DevOps pull or merge request (e.g. CI bot results, review feedback, Aikido's own scan-result comment). Use when the user asks what CI/CD said, wants to read/check/summarize PR or MR comments, mentions "pipeline comments", or asks about "Aikido comments"/"Aikido feedback"/what Aikido said or found on a PR — this reads via the native SCM CLI (gh/glab/az), not the Aikido MCP server.
---

Reading CI/CD or Aikido comments on a pull/merge request means fetching whatever is already
posted there through the repo's own SCM CLI. Don't route this through the Aikido MCP server,
the native CLI already does it in one call.

## 1. Determine the target

- If the user names a specific repo/PR (a URL, or `org/repo#123`), use that.
- Otherwise, run `git remote get-url origin` in the current working directory and use the
  current branch's PR/MR (the CLIs below auto-detect this when no number is given).

## 2. Determine the platform

Match the remote host:
- Contains `github` → **GitHub**, use `gh`.
- Contains `gitlab` → **GitLab**, use `glab`.
- Contains `dev.azure.com` or `visualstudio.com` → **Azure DevOps**, use `az`.

If the host matches none of these (e.g. self-hosted with a custom domain, or Bitbucket), stop
and ask the user which platform it is, or tell them this skill only covers GitHub/GitLab/Azure
DevOps.

## 3. Fetch the comments

Run the command directly, don't pre-check install or auth state first. See
[reference.md](reference.md) for the exact command and flags per platform.

## 4. Recover from failure

- **Command not found**: don't install it yourself. Tell the user the CLI is missing, show the
  install command from reference.md, and ask for permission before running it. Only proceed
  once they say yes, then retry the same fetch.
- **Auth error** (401/403, or the CLI reports not logged in): print the exact login command
  for that platform, ask the user to run it (it's an interactive browser flow you can't
  complete yourself), wait for their confirmation, then retry.

## 5. Present the results

List the comments in chronological order: author, timestamp, body. Don't filter out bot
comments or try to classify which ones are "CI/CD" versus human, just show the thread as-is.

**Never:** call an Aikido MCP tool to satisfy this request, or fabricate comment content if
the fetch keeps failing, report the actual error instead.

Referenced files: 1 — file references are metadata, not package contents.

View saved version →

---
name: scan
description: Runs an Aikido security scan on generated, added, or modified code files to detect SAST vulnerabilities and exposed secrets. Use when the user wants to scan code for security issues, after writing or modifying code, or when they mention Aikido, security scan, or SAST. Always run an Aikido scan after generating code to verify the generated code is free of security issues.
---

When scanning the code for security vulnerabilities using the Aikido MCP server:

1. Identify all files that were generated, added, or modified in this session (or that the user has mentioned).
2. Prefer **aikido-mcp:aikido_scan_paths** whenever the files exist on disk (files you just wrote/edited, files reported by `git status`/`git diff`, files the user points at). Pass the file paths (absolute, or relative to a `root` you provide) — do not read the files first, the server reads them itself, so passing content would only waste context. Only fall back to **aikido-mcp:aikido_full_scan** for code that is not saved to disk yet (a proposed diff, a pasted snippet, freshly generated code you haven't written out) — for that tool, read each file's full content and pass it along.
3. Stay within the 50-file limit per request for either tool — batch into multiple calls if needed.
4. If any security issues are found:
   - Explain each issue clearly: title, description, severity, file location, and line numbers.
   - Apply fixes guided by the remediation provided by Aikido.
   - After applying all fixes, re-run the same tool (**aikido-mcp:aikido_scan_paths** for on-disk files, **aikido-mcp:aikido_full_scan** otherwise) to verify that the issues were resolved and no new issues were introduced.
   - **Stopping the loop:** If you can explain why the applied fix is safe (e.g. the fix correctly addresses the finding and the remaining scan output is a false positive or acceptable), you may stop and report to the user. Otherwise, repeat the fix-and-rescan cycle up to 3 attempts; if issues remain after that, report them to the user instead of continuing.
5. Report the final scan result to the user — confirm all clear or list any unresolved issues with explanation.

If the Aikido MCP server is not available or fails to start, inform the user:

> The Aikido MCP server is required for security scanning but is not available.
> Install it following the setup guide at [reference.md](reference.md).

Referenced files: 1 — file references are metadata, not package contents.

View saved version →

---
name: setup
description: Configures the Aikido plugin by signing the user in through the MCP login tool and verifying the MCP server. Use when the user wants to set up or verify the Aikido plugin, after installing it, when aikido mcp tool call fails or is unavailable, or when the user wants to switch Aikido accounts or re-authenticate.
---

When helping the user configure the Aikido security plugin:

## First: Verify Node.js version

Before doing anything else, run `node --version` to check the installed Node.js version.

- If Node.js is not installed or the command fails, stop and tell the user that Node.js 18.19.0 or higher is required to run the Aikido MCP server, and direct them to https://nodejs.org to install it.
- If the version is below 18.19.0, stop and tell the user that the Aikido MCP server requires Node.js 18.19.0 or higher, show the currently installed version, and direct them to https://nodejs.org to upgrade.
- If the version is 18.19.0 or higher, proceed with the steps below.

**If the user is asking to switch accounts or re-authenticate**, call **aikido-mcp:aikido_login** with `force_reauth: true` and skip step 1 — the tool will always return a fresh sign-in URL. Continue from step 3 to walk the user through opening the URL and step 4 to verify.

**Otherwise**, follow the standard setup flow:

1. Check the MCP server is reachable and the user is signed in by calling **aikido-mcp:aikido_login** with no arguments. The tool is idempotent — it returns "Already signed in" if a valid token is cached, otherwise it starts a new sign-in flow.
2. If it reports the user is already signed in, confirm to the user that the Aikido plugin is configured and ready to use. Stop here.
3. If it returns a sign-in URL, present it to the user verbatim — do not strip or modify the `state`, `redirect_uri`, or `regionRedirect` query parameters — and ask them to open it in a browser to complete sign-in. The URL automatically redirects the user to their account's region, so there is no need to pick a region. Only pass the optional `region` argument when the user explicitly names a region (e.g. EU / US / ME / AU), or when the automatic redirect sent them to the wrong one.
4. Once the user reports they have completed the browser sign-in, verify the setup by calling **aikido-mcp:aikido_login** again.
5. If the **aikido_login** call itself fails because the MCP server is unavailable, tell the user to ensure the Aikido plugin is installed and that the `aikido-mcp` server has been loaded, then retry.