mcp server

aribot

Threat modeling, code/cloud/pipeline scanning, shadow-AI discovery, compliance checks and fixes.

Description as published by the maintainer. Source

• version 1.0.0
• active
• security

active — Most recent push to the repository was 2026-07-13. Dashed tags are derived by ZBS Index from the published description, not stated by the maintainer.

What this server can do

16 functions, named and described by the server itself. Parameter names are shown because they say more about what a function does than its name usually does.

apply_remediation(rule_id, threat_id, resource_context)

Apply a remediation for real (mode=live). Routed through the full governance funnel — patent reachability/kill-chain gates, autonomy policy and the approval flow. If your policy requires approval it returns 'requires_approval' rather than acting. Required: threat_id, rule_id.

code_review_scan(scan_id)

Start (or re-run) a code-security scan for an existing scan/repository in your scope. Returns a poll pointer; results include SAST, secrets, deps, pipeline review and the traceability matrix. Required: scan_id.

compliance_scan(source, scan_type, account_id, diagram_id, frameworks, severity_filter, simulation_mode)

Run a cloud/platform or compliance scan against an account or diagram in your scope (async). scan_type ∈ platform|compliance|pipeline|sbom. Returns a task id to poll. Required: scan_type.

compliance_status(scan_id, diagram_id)

Company-level compliance posture rollup (pass rate, control compliance, mitigated counts, per-framework coverage). Suitable for a CI gate. Wraps the traceability company rollup.

discover_shadow_ai(limit, scan_id)

Shadow-AI posture (part of Code Security): unsanctioned / unknown AI-service usage discovered in code — totals, risk score, provider/type breakdown, hardcoded-key count, and top discoveries. Company latest, or one scan with `scan_id`. Reads code_review ShadowAIReport/ShadowAIDiscovery.

generate_threat_model(name, edges, nodes)

Create a threat model from a normalized architecture (ReactFlow nodes + edges). Ingests components via the shared Stage-0 service; the pipeline then auto-generates threats. Returns the diagram id. Required: nodes.

get_api_security(limit, scan_id)

API security inventory (part of Code Security): discovered API endpoints with authentication status, risk level and risk factors, plus method/risk breakdowns. Company-wide or one scan with `scan_id`. Reads code_review ApiEndpointDiscovery.

get_billing(request_plan, topup_amount, checkout_request_id)

Billing status + self-service payment for your company: credit-wallet balance, pay-per-use flag, license tier / annual commitment, per-action prices, purchasable plans, and any approved-but-unpaid plans. Pass `checkout_request_id` to get a hosted Stripe Checkout URL to COMPLETE an approved plan, `topup_amount` (EUR) to get one to TOP UP the wallet, or `request_plan` (starter|pay_per_use|pro|max|enterprise) to REQUEST a plan (files a request for super-admin approval — never grants). Use this to view or RESOLVE a 402 without leaving the connector.

get_cloud_compliance(account_id)

Cloud security & compliance posture (Cloud Compliance): per connected cloud account, the latest CIS/NIST cloud-policy scan — compliance %, failing policies/records, status — plus a company rollup. Reads customers.Account.latest_scan -> compliances.ScanResults.

get_diagram_summary(diagram_id)

The canonical diagram summary every badge/card/header reads: threat counts by severity, risk value, compliance and framework coverage. Required: diagram_id.

get_framework_coverage(framework, diagram_id, include_graph)

Compliance-framework coverage for a diagram (real, ControlCodeMap-backed), optionally for one framework, plus an optional crossmap relationship graph. Wraps derive_framework_coverage + crossmap_cypher.build_graph. Required: diagram_id.

get_insights(diagram_id)

Threat/control matrix metrics + framework coverage for a diagram, joined with its latest code-security scan when one exists. Required: diagram_id.

get_remediation(rule_id, threat_id, resource_context)

Compute a remediation plan for a threat/finding WITHOUT applying it (mode=dry_run). Runs the same governed engine as apply_remediation, including the patent gates, and returns the proposed steps. Required: threat_id, rule_id.

get_traceability(scan_id)

Return the diagram→threat→finding→control→requirement→remediation traceability matrix for a scan in your scope, with coverage metrics. Required: scan_id.

onboard_agents(agents, cohort, agent_cards, auto_suspend_threshold)

Bulk-onboard agent identities to the governed fleet (Agent Governance). Accepts plain ids or {agent_id} descriptors in `agents`, A2A 1.0 Agent Cards in `agent_cards` (name/url/provider/version/protocolVersion), or MCP client descriptors, under an optional `cohort` + shared auto-suspend policy. Idempotent. Requires the agent_governance licence + a manage:agents grant (or a first-party super-admin). Agents also self-onboard on first token/call.

verify_threats_in_code(async_, scan_id, threat_id, code_content, repository_id)

Verify whether threats are mitigated in a scan's uploaded code. With `threat_id`, verifies one threat synchronously and returns the verdict; without it, verifies every diagram threat in the background. Wraps code_review ThreatVerificationService. Required: scan_id.

Last successful function declaration observed on 2026-08-13. Source: https://mcp.aribot.ayurak.com/mcp. We list what the server declared; we do not call any of these functions.

Endpoint status observed on 2026-08-13. Source: https://mcp.aribot.ayurak.com/mcp.

Signals

These are separate measurements of different things. They are deliberately not combined into one score, because a popularity number that mixes website traffic with saves and stars cannot be checked or acted on.

Where to get it

• Repository — https://github.com/aristiun/aribot-mcp
• Website — https://aribot.ayurak.com
• Remote endpoint (streamable-http) — https://mcp.aribot.ayurak.com/mcp

Related, by what their authors tagged them

• Niro — last commit 2026-07-28, shares devsecops, remediation, security
  AI pentester for PRs — finds exploitable bugs and hands your developer agent the fix.
• cloud-audit — last commit 2026-07-21, shares cloud-security, devsecops, security
  AWS security scanner with attack chain detection, IAM privilege escalation, and fixes
• Draugr — last commit 2026-08-06, shares appsec, devsecops, security
  Security scanning for AI agents: SAST, SCA, secrets, IaC, DAST, ranked by real risk.
• Apiiro Guardian Agent — last commit 2026-06-22, shares appsec, security
  Apiiro Application Security Posture Management (ASPM) tools for AI coding assistants.
• io.github.egoughnour/code-firewall-mcp — last commit 2026-01-19, shares code-security, security
  Structural similarity-based code filter. Stops malicious code pattern reaching execution tools.
• io.github.hellosg/coderegistry — shares code-security
  Enterprise code intelligence for M&A, security audits, and tech debt. Hosted server with 200k free.
• app.scfcontrolsplatform/mcp-server-scf — last commit 2026-07-27, shares nist, security
  MCP server for the SCF Controls Platform — 83 tools for controls, evidence, risk, and TPRM.
• io.github.cyanheads/nist-nvd-mcp-server — last commit 2026-07-31, shares nist, security
  Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE.
• TheArtOfService Compliance Intelligence — last commit 2026-03-07, shares nist
  Query 692+ compliance frameworks, 13,700+ controls, and 280K+ cross-framework mappings.
• com.medplum/mcp — last commit 2026-08-06, shares soc2
  Securely access and manage FHIR healthcare data stored in Medplum.

These share tags the maintainers applied themselves, such as devsecops, remediation, security, cloud-security. Common tags like "mcp" or "ai" are ignored for this: agreeing with six hundred other projects is not a similarity.

This is not a recommendation and not a test result. It is a map of what the authors said their work is about.

How the author describes it

Topics the maintainer set on GitHub: ai-agents, ai-security, appsec, cloud-security, code-security, compliance, devsecops, iso27001, linddun, mcp, model-context-protocol, nist, remediation, security, shadow-ai, soc2, stride, threat-modeling.