Aribot MCP server

• apply_remediationFree

  Apply a remediation for real (mode=live). Routed through the full governance funnel — patent reachability/kill-chain gates, autonomy policy and the approval flow. If your policy requires approval it returns 'requires_approval' rather than acting.

• code_review_scanFree

  Start (or re-run) a code-security scan for an existing scan/repository in your scope. Returns a poll pointer; results include SAST, secrets, deps, pipeline review and the traceability matrix.

• compliance_scanwrite actionFree

  Run a cloud/platform or compliance scan against an account or diagram in your scope (async). scan_type ∈ platform|compliance|pipeline|sbom. Returns a task id to poll.

• compliance_statusFree

  Company-level compliance posture rollup (pass rate, control compliance, mitigated counts, per-framework coverage). Suitable for a CI gate. Wraps the traceability company rollup.

• discover_shadow_aiFree

  Shadow-AI posture (part of Code Security): unsanctioned / unknown AI-service usage discovered in code — totals, risk score, provider/type breakdown, hardcoded-key count, and top discoveries. Company latest, or one scan with `scan_id`. Reads code_review ShadowAIReport/ShadowAIDiscovery.

• generate_threat_modelwrite actionFree

  Create a threat model from a normalized architecture (ReactFlow nodes + edges). Ingests components via the shared Stage-0 service; the pipeline then auto-generates threats. Returns the diagram id.

• get_api_securityFree

  API security inventory (part of Code Security): discovered API endpoints with authentication status, risk level and risk factors, plus method/risk breakdowns. Company-wide or one scan with `scan_id`. Reads code_review ApiEndpointDiscovery.

• get_billingFree

  Billing status + self-service payment for your company: credit-wallet balance, pay-per-use flag, license tier / annual commitment, per-action prices, purchasable plans, and any approved-but-unpaid plans. Pass `checkout_request_id` to get a hosted Stripe Checkout URL to COMPLETE an approved plan, `topup_amount` (EUR) to get one to TOP UP the wallet, or `request_plan` (starter|pay_per_use|pro|max|enterprise) to REQUEST a plan (files a request for super-admin approval — never grants). Use this to view or RESOLVE a 402 without leaving the connector.

• get_cloud_complianceFree

  Cloud security & compliance posture (Cloud Compliance): per connected cloud account, the latest CIS/NIST cloud-policy scan — compliance %, failing policies/records, status — plus a company rollup. Reads customers.Account.latest_scan -> compliances.ScanResults.

• get_diagram_summaryFree

  The canonical diagram summary every badge/card/header reads: threat counts by severity, risk value, compliance and framework coverage.

• get_framework_coverageFree

  Compliance-framework coverage for a diagram (real, ControlCodeMap-backed), optionally for one framework, plus an optional crossmap relationship graph. Wraps derive_framework_coverage + crossmap_cypher.build_graph.

• get_insightsFree

  Threat/control matrix metrics + framework coverage for a diagram, joined with its latest code-security scan when one exists.

• get_remediationFree

  Compute a remediation plan for a threat/finding WITHOUT applying it (mode=dry_run). Runs the same governed engine as apply_remediation, including the patent gates, and returns the proposed steps.

• get_traceabilityFree

  Return the diagram→threat→finding→control→requirement→remediation traceability matrix for a scan in your scope, with coverage metrics.

• onboard_agentsFree

  Bulk-onboard agent identities to the governed fleet (Agent Governance). Accepts plain ids or {agent_id} descriptors in `agents`, A2A 1.0 Agent Cards in `agent_cards` (name/url/provider/version/protocolVersion), or MCP client descriptors, under an optional `cohort` + shared auto-suspend policy. Idempotent. Requires the agent_governance licence + a manage:agents grant (or a first-party super-admin). Agents also self-onboard on first token/call.

• verify_threats_in_codeFree

  Verify whether threats are mitigated in a scan's uploaded code. With `threat_id`, verifies one threat synchronously and returns the verdict; without it, verifies every diagram threat in the background. Wraps code_review ThreatVerificationService.

• –Code scanremote-only server, no package to scann/a
• Live reliabilityremote reachable in 610ms20/20
• Tool poisoning16 tool descriptions checked15/15
• Auth qualityopen endpoint exposes 2 write-action tools with no auth3/15
• Maintenancelast push 75 days ago12/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Safety score

77/100

higher than 50% of 48,255 servers

Tools

16

the typical server has 7

Tools that change things

13%

typical: 0%. Fewer write tools means less an agent can break

Uptime

100%

of our recent checks; the typical remote server answers 100%

Response time

201 ms

faster than 63% of 30,031 servers

Aribot: common questions

Is Aribot MCP server safe?

Mostly: it is graded B (77/100). Read the Aribot safety report

How do I install Aribot?

It runs remotely at mcp.aribot.ayurak.com. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.

Does Aribot need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Aribot maintained?

The last commit was 114 days ago (2026-07-13). The latest release is v1.0.0.

Is Aribot up?

100% of our last 28 checks got an answer. We check remote servers about four times a day.

How does Aribot compare with other MCP servers?

safety score 77/100 (higher than 50% of 48,255 servers); tools 16 (the typical server has 7); tools that change things 13% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.