Akadenia Security has an MCP server, so an AI agent can answer questions about your security in plain language ("what's the worst open finding on our API?", "which lookalike domains were registered this month?") and, if you allow it, act on them.
The agent signs in as you. It sees only your organizations, can do only what your role allows, and never deletes anything.
The server
https://mcp.security.akadenia.com/mcp
Add it to your AI tool, then sign in with your Akadenia Security account when it asks. The MCP page in your organization's menu shows the same steps, with what to paste for each tool. The first time, you're asked to allow the tool to view your data.
Set it up
Claude
In Claude (web, desktop or mobile): Settings → Connectors → Add custom connector, then paste the server URL.
Claude Code
claude mcp add --transport http akadenia-security https://mcp.security.akadenia.com/mcp
Then run /mcp in Claude Code and sign in.
ChatGPT
Settings → Apps → Advanced settings: turn on developer mode, then create an app with the server URL and OAuth sign-in.
VS Code
Add to .vscode/mcp.json (or your user MCP settings):
{
"servers": {
"akadenia-security": { "type": "http", "url": "https://mcp.security.akadenia.com/mcp" }
}
}
Cursor and other tools
Add the server URL to the tool's MCP settings (for Cursor, ~/.cursor/mcp.json). A tool that asks for an OAuth client ID can use the one shown on the MCP page (in your organization's menu) or your Account page, with no secret.
What an agent can read
| Tool | What it gives |
|---|---|
list_organizations |
Your organizations and your role in each |
list_targets |
An organization's targets, verified or not, with their security scores |
get_target |
One target in full, with its security scores |
list_schedules |
Scan schedules |
search_findings |
Current findings, worst first, filtered by target, severity, OWASP category, scanner or text |
get_finding |
One finding: what the scan saw, how to fix it, OWASP and NIST mapping, CVEs, its history and its tickets |
list_tickets |
A target's tickets in GitHub or Linear, and whether each is open |
list_integrations |
The ticket tools connected, where tickets go and which findings get one |
list_webhooks |
Webhooks and Slack alerts, with their events and filters (never their secrets) |
list_webhook_deliveries |
A webhook's or ticket tool's latest deliveries and errors |
list_scan_runs |
A target's recent scans and what changed |
get_scan |
One scan's status and results, and a verify fix's outcome |
get_target_report |
One section of a target's report |
If you're in several organizations, the agent asks which one, or you can name it.
What an agent can change
These need your consent to changes. The first time an agent tries one, your tool asks you to sign in again and allow it; a tool that can't ask needs to be reconnected.
| Tool | What it does |
|---|---|
scan_now |
Runs a scanner on a target now (counts toward your plan's Scan now) |
verify_fix |
Reruns only the check behind one finding (not counted as Scan now); get_scan gives the outcome |
set_finding_aside |
Sets a finding aside as accepted risk or false positive, with your reason |
reopen_finding |
Reopens a finding that was set aside |
add_schedule |
Schedules a scanner on a target |
update_schedule |
Changes a schedule's time, or pauses it |
add_target |
Adds a target you've confirmed you may test, and gives its number and the DNS record to verify it |
verify_target |
Checks a target's verification now |
create_ticket |
Opens a ticket for a finding in GitHub or Linear, or gives the one it has |
update_integration |
Changes which findings get tickets, or where a target's tickets go (a repo or team per target) |
add_webhook |
Adds a webhook; its signing secret is shown once |
update_webhook |
Changes a webhook's events or filters, or switches it back on |
test_webhook |
Sends a webhook a test event |
Connecting GitHub or Linear, and removing anything, stay in the dashboard.
Security
- Your account, your role: the agent acts as you, and what your role can't do, it can't either.
- Its own sign-in: the agent's access is for the MCP server only; it can't use your dashboard session, and the dashboard can't use its.
- Two-factor authentication: if your account requires it, the agent's sign-in asks for your code too.
- Every call is logged: with who, what and when, for your organization's audit trail.
- Limits: each call costs points: reading one thing 1, a list 1 plus 1 per 25 results, a change 2, a target's whole report or an action (a scan, a fix or verification check, a ticket, a webhook test) 10. Each person has a bucket of points per organization, which refills every second; its size depends on the organization's plan (Free: 60 points, 1 back a second; Pay-as-you-go and Team: 120 and 2; Business: 300 and 5; Enterprise: 600 and 10). A call that doesn't name the organization also costs 1 point, from your own Free-sized bucket, to look up which one you're in. Every result says what the call cost and how many points are left. When the bucket is empty, the agent is told how many seconds to wait. See Rate limits.
To disconnect a tool, remove the server from it.