Threat modeling, code, API & cloud security, shadow-AI & compliance governance.
Inferred from the transports this listing declares (streamable-http, sse). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read from a real MCP initialize → tools/list handshake against the declared endpoint. No tool was ever invoked — tools/list is the read-only introspection call the protocol defines for this. It reflects what the server advertised at that moment; a hosted endpoint is not pinned to any version and can change without notice.
https://mcp.aribot.ayurak.com/16 tools · 377mshttps://mcp.aribot.ayurak.com/sse16 tools · 309msget_billingBilling status + self-service payment for your company: credit-wallet balance, pay-per-use flag, license tier / annual commitment, per-action prices, purchasable plans, and any approved-but-unpaid plans. Pass `checkout_request_id` to get a hosted Stripe Checkout URL to COMPLETE an approved plan, `t…Billing status + self-service payment for your company: credit-wallet balance, pay-per-use flag, license tier / annual commitment, per-action prices, purchasable plans, and any approved-but-unpaid plans. Pass `checkout_request_id` to get a hosted Stripe Checkout URL to COMPLETE an approved plan, `t…
| Parameter | Type | Description |
|---|---|---|
| checkout_request_id | string | Approved license_request_id to complete payment for (returns a hosted Checkout URL) |
| topup_amount | number | Optional EUR amount to top up the credit wallet (returns a hosted Checkout URL) |
| request_plan | string | Optional plan key to request (pro|max|…) — files a request for super-admin approval; does not grant or charge |
onboard_agentsBulk-onboard agent identities to the governed fleet (Agent Governance). Accepts plain ids or {agent_id} descriptors in `agents`, A2A 1.0 Agent Cards in `agent_cards` (name/url/provider/version/protocolVersion), or MCP client descriptors, under an optional `cohort` + shared auto-suspend policy. Idem…Bulk-onboard agent identities to the governed fleet (Agent Governance). Accepts plain ids or {agent_id} descriptors in `agents`, A2A 1.0 Agent Cards in `agent_cards` (name/url/provider/version/protocolVersion), or MCP client descriptors, under an optional `cohort` + shared auto-suspend policy. Idem…
| Parameter | Type | Description |
|---|---|---|
| agents | array | Agent ids or descriptors ({agent_id, display?, cohort?}) |
| agent_cards | array | A2A 1.0 Agent Cards ({name, url, provider, version, protocolVersion, ...}) |
| cohort | string | Optional shared cohort (provider/model/deployment group) |
| auto_suspend_threshold | number | Optional 0..1 auto-suspend deviation threshold for the cohort policy |
generate_threat_modelCreate a threat model from a normalized architecture (ReactFlow nodes + edges). Ingests components via the shared Stage-0 service; the pipeline then auto-generates threats. Returns the diagram id.Create a threat model from a normalized architecture (ReactFlow nodes + edges). Ingests components via the shared Stage-0 service; the pipeline then auto-generates threats. Returns the diagram id.
| Parameter | Type | Description |
|---|---|---|
| name | string | Threat model name |
| nodes* | array | ReactFlow nodes (each: id, position, data.label) |
| edges | array | ReactFlow edges |
verify_threats_in_codeVerify whether threats are mitigated in a scan's uploaded code. With `threat_id`, verifies one threat synchronously and returns the verdict; without it, verifies every diagram threat in the background. Wraps code_review ThreatVerificationService.Verify whether threats are mitigated in a scan's uploaded code. With `threat_id`, verifies one threat synchronously and returns the verdict; without it, verifies every diagram threat in the background. Wraps code_review ThreatVerificationService.
| Parameter | Type | Description |
|---|---|---|
| scan_id* | string | CodeReviewScan id (uuid) |
| threat_id | string | Optional: a single threat id or code |
| repository_id | string | Optional connected repo to fetch code from |
| code_content | string | Optional inline code context |
| async_ | boolean | — |
get_traceabilityReturn the diagram→threat→finding→control→requirement→remediation traceability matrix for a scan in your scope, with coverage metrics.Return the diagram→threat→finding→control→requirement→remediation traceability matrix for a scan in your scope, with coverage metrics.
| Parameter | Type | Description |
|---|---|---|
| scan_id* | string | Code-review scan id |
get_framework_coverageCompliance-framework coverage for a diagram (real, ControlCodeMap-backed), optionally for one framework, plus an optional crossmap relationship graph. Wraps derive_framework_coverage + crossmap_cypher.build_graph.Compliance-framework coverage for a diagram (real, ControlCodeMap-backed), optionally for one framework, plus an optional crossmap relationship graph. Wraps derive_framework_coverage + crossmap_cypher.build_graph.
| Parameter | Type | Description |
|---|---|---|
| diagram_id* | string | Diagram pk or uuid |
| framework | string | Optional framework filter (e.g. 'NIST-800-53', 'SOC2') |
| include_graph | boolean | Also return the crossmap node/edge graph |
get_remediationCompute a remediation plan for a threat/finding WITHOUT applying it (mode=dry_run). Runs the same governed engine as apply_remediation, including the patent gates, and returns the proposed steps.Compute a remediation plan for a threat/finding WITHOUT applying it (mode=dry_run). Runs the same governed engine as apply_remediation, including the patent gates, and returns the proposed steps.
| Parameter | Type | Description |
|---|---|---|
| threat_id* | string | Threat id/code to remediate |
| rule_id* | string | Policy/rule id (e.g. AWS_S3_PUBLIC_ACCESS) |
| resource_context | object | provider/resource_id/region/account_id/metadata |
compliance_statusCompany-level compliance posture rollup (pass rate, control compliance, mitigated counts, per-framework coverage). Suitable for a CI gate. Wraps the traceability company rollup.Company-level compliance posture rollup (pass rate, control compliance, mitigated counts, per-framework coverage). Suitable for a CI gate. Wraps the traceability company rollup.
| Parameter | Type | Description |
|---|---|---|
| scan_id | string | Optional anchor scan; latest is used if omitted |
| diagram_id | string | Optional diagram to add framework coverage for |
discover_shadow_aiShadow-AI posture (part of Code Security): unsanctioned / unknown AI-service usage discovered in code — totals, risk score, provider/type breakdown, hardcoded-key count, and top discoveries. Company latest, or one scan with `scan_id`. Reads code_review ShadowAIReport/ShadowAIDiscovery.Shadow-AI posture (part of Code Security): unsanctioned / unknown AI-service usage discovered in code — totals, risk score, provider/type breakdown, hardcoded-key count, and top discoveries. Company latest, or one scan with `scan_id`. Reads code_review ShadowAIReport/ShadowAIDiscovery.
| Parameter | Type | Description |
|---|---|---|
| scan_id | string | Optional CodeReviewScan id; company-wide latest if omitted |
| limit | integer | Max discoveries to return |
get_api_securityAPI security inventory (part of Code Security): discovered API endpoints with authentication status, risk level and risk factors, plus method/risk breakdowns. Company-wide or one scan with `scan_id`. Reads code_review ApiEndpointDiscovery.API security inventory (part of Code Security): discovered API endpoints with authentication status, risk level and risk factors, plus method/risk breakdowns. Company-wide or one scan with `scan_id`. Reads code_review ApiEndpointDiscovery.
| Parameter | Type | Description |
|---|---|---|
| scan_id | string | Optional CodeReviewScan id; company-wide if omitted |
| limit | integer | Max endpoints to return |
get_cloud_complianceCloud security & compliance posture (Cloud Compliance): per connected cloud account, the latest CIS/NIST cloud-policy scan — compliance %, failing policies/records, status — plus a company rollup. Reads customers.Account.latest_scan -> compliances.ScanResults.Cloud security & compliance posture (Cloud Compliance): per connected cloud account, the latest CIS/NIST cloud-policy scan — compliance %, failing policies/records, status — plus a company rollup. Reads customers.Account.latest_scan -> compliances.ScanResults.
| Parameter | Type | Description |
|---|---|---|
| account_id | string | Optional single cloud Account id; all company accounts if omitted |
code_review_scanStart (or re-run) a code-security scan for an existing scan/repository in your scope. Returns a poll pointer; results include SAST, secrets, deps, pipeline review and the traceability matrix.Start (or re-run) a code-security scan for an existing scan/repository in your scope. Returns a poll pointer; results include SAST, secrets, deps, pipeline review and the traceability matrix.
| Parameter | Type | Description |
|---|---|---|
| scan_id* | string | Id of an existing code-review scan to (re)run |
compliance_scanRun a cloud/platform or compliance scan against an account or diagram in your scope (async). scan_type ∈ platform|compliance|pipeline|sbom. Returns a task id to poll.Run a cloud/platform or compliance scan against an account or diagram in your scope (async). scan_type ∈ platform|compliance|pipeline|sbom. Returns a task id to poll.
| Parameter | Type | Description |
|---|---|---|
| scan_type* | string | platform | compliance | pipeline | sbom |
| account_id | string | Cloud account id (account-scoped scans) |
| diagram_id | string | Diagram id/uuid (diagram-scoped scans) |
| frameworks | array | Optional standard/framework ids to scope the scan |
| severity_filter | array | Optional severity levels to include |
| simulation_mode | boolean | Dry-run the scan without side effects |
| source | string | Scan source (default: hybrid) |
apply_remediationApply a remediation for real (mode=live). Routed through the full governance funnel — patent reachability/kill-chain gates, autonomy policy and the approval flow. If your policy requires approval it returns 'requires_approval' rather than acting.Apply a remediation for real (mode=live). Routed through the full governance funnel — patent reachability/kill-chain gates, autonomy policy and the approval flow. If your policy requires approval it returns 'requires_approval' rather than acting.
| Parameter | Type | Description |
|---|---|---|
| threat_id* | string | Threat id/code to remediate |
| rule_id* | string | Policy/rule id (e.g. AWS_S3_PUBLIC_ACCESS) |
| resource_context | object | provider/resource_id/region/account_id/metadata |
get_diagram_summaryThe canonical diagram summary every badge/card/header reads: threat counts by severity, risk value, compliance and framework coverage.The canonical diagram summary every badge/card/header reads: threat counts by severity, risk value, compliance and framework coverage.
| Parameter | Type | Description |
|---|---|---|
| diagram_id* | string | Diagram id/uuid |
get_insightsThreat/control matrix metrics + framework coverage for a diagram, joined with its latest code-security scan when one exists.Threat/control matrix metrics + framework coverage for a diagram, joined with its latest code-security scan when one exists.
| Parameter | Type | Description |
|---|---|---|
| diagram_id* | string | Diagram id/uuid |
16 of 16 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
Threat modeling, code, API & cloud security, shadow-AI & compliance governance.
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
This entry publishes no npm package, so Forge has no dependency tree for it. That is a gap in coverage — not a statement that it has no dependencies.