# com.ayurak/aribot-mcp (remote · mcp.aribot.ayurak.com)

Threat modeling, code, API & cloud security, shadow-AI & compliance governance.

- Trust score: 77/100 (medium)
- Change this week: +10
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `mcp.aribot.ayurak.com`: 77/100 (this document), [markdown](https://verifymcp.io/servers/com-ayurak-aribot-mcp/mcp.md), [page](https://verifymcp.io/servers/com-ayurak-aribot-mcp/mcp)
- remote · `mcp.aribot.ayurak.com`: 26/100, [markdown](https://verifymcp.io/servers/com-ayurak-aribot-mcp/mcp-2.md), [page](https://verifymcp.io/servers/com-ayurak-aribot-mcp/mcp-2)

## Channel facts

- Endpoint: `https://mcp.aribot.ayurak.com/`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 97/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC is configured correctly; the domain's records validate against the full chain to the root.
  - The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 64/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1648 tokens (~103/item across 16 items; 16 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 99/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 98% of tool parameters carry a description.
- **Capabilities**: 20/100
  - Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http com-ayurak-aribot-mcp https://mcp.aribot.ayurak.com/
```

### Codex

```toml
[mcp_servers.com-ayurak-aribot-mcp]
url = "https://mcp.aribot.ayurak.com/"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-ayurak-aribot-mcp": {
      "type": "remote",
      "url": "https://mcp.aribot.ayurak.com/",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-ayurak-aribot-mcp --url https://mcp.aribot.ayurak.com/ --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-ayurak-aribot-mcp:
    url: "https://mcp.aribot.ayurak.com/"
```

### Other

```json
{
  "mcpServers": {
    "com-ayurak-aribot-mcp": {
      "type": "http",
      "url": "https://mcp.aribot.ayurak.com/"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 77, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-01 (score 76, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 75, +6)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 69, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 69, +1)

- [functional regression] Schema quality: 1447 → 1648
- [functional] New tool “onboard_agents”

### 2026-07-28 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 67, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 67)

First indexed and scored.

## MCP tools (16)

### `get_billing` (~214 tokens)

Billing status + self-service payment for your company: credit-wallet balance, pay-per-use flag, license tier / annual commitment, per-action prices, purchasable plans, and any approved-but-unpaid plans. Pass `checkout_request_id` to get a hosted Stripe Checkout URL to COMPLETE an approved plan, `topup_amount` (EUR) to get one to TOP UP the wallet, or `request_plan` (starter|pay_per_use|pro|max|enterprise) to REQUEST a plan (files a request for super-admin approval — never grants). Use this to view or RESOLVE a 402 without leaving the connector.

Input parameters:

- `checkout_request_id` (string): Approved license_request_id to complete payment for (returns a hosted Checkout URL)
- `request_plan` (string): Optional plan key to request (pro|max|…) — files a request for super-admin approval; does not grant or charge
- `topup_amount` (number): Optional EUR amount to top up the credit wallet (returns a hosted Checkout URL)

### `onboard_agents` (~201 tokens)

Bulk-onboard agent identities to the governed fleet (Agent Governance). Accepts plain ids or {agent_id} descriptors in `agents`, A2A 1.0 Agent Cards in `agent_cards` (name/url/provider/version/protocolVersion), or MCP client descriptors, under an optional `cohort` + shared auto-suspend policy. Idempotent. Requires the agent_governance licence + a manage:agents grant (or a first-party super-admin). Agents also self-onboard on first token/call.

Input parameters:

- `agent_cards` (array): A2A 1.0 Agent Cards ({name, url, provider, version, protocolVersion, ...})
- `agents` (array): Agent ids or descriptors ({agent_id, display?, cohort?})
- `auto_suspend_threshold` (number): Optional 0..1 auto-suspend deviation threshold for the cohort policy
- `cohort` (string): Optional shared cohort (provider/model/deployment group)

### `generate_threat_model` (~89 tokens)

Generate Threat Model

Create a threat model from a normalized architecture (ReactFlow nodes + edges). Ingests components via the shared Stage-0 service; the pipeline then auto-generates threats. Returns the diagram id.

Input parameters:

- `edges` (array): ReactFlow edges
- `name` (string): Threat model name
- `nodes` (array, required): ReactFlow nodes (each: id, position, data.label)

### `verify_threats_in_code` (~125 tokens)

Verify Threats in Code

Verify whether threats are mitigated in a scan's uploaded code. With `threat_id`, verifies one threat synchronously and returns the verdict; without it, verifies every diagram threat in the background. Wraps code_review ThreatVerificationService.

Input parameters:

- `async_` (boolean)
- `code_content` (string): Optional inline code context
- `repository_id` (string): Optional connected repo to fetch code from
- `scan_id` (string, required): CodeReviewScan id (uuid)
- `threat_id` (string): Optional: a single threat id or code

### `get_traceability` (~51 tokens)

Get Traceability Matrix

Return the diagram→threat→finding→control→requirement→remediation traceability matrix for a scan in your scope, with coverage metrics.

Input parameters:

- `scan_id` (string, required): Code-review scan id

### `get_framework_coverage` (~106 tokens)

Get Framework Coverage

Compliance-framework coverage for a diagram (real, ControlCodeMap-backed), optionally for one framework, plus an optional crossmap relationship graph. Wraps derive_framework_coverage + crossmap_cypher.build_graph.

Input parameters:

- `diagram_id` (string, required): Diagram pk or uuid
- `framework` (string): Optional framework filter (e.g. 'NIST-800-53', 'SOC2')
- `include_graph` (boolean): Also return the crossmap node/edge graph

### `get_remediation` (~100 tokens)

Get Remediation Guidance

Compute a remediation plan for a threat/finding WITHOUT applying it (mode=dry_run). Runs the same governed engine as apply_remediation, including the patent gates, and returns the proposed steps.

Input parameters:

- `resource_context` (object): provider/resource_id/region/account_id/metadata
- `rule_id` (string, required): Policy/rule id (e.g. AWS_S3_PUBLIC_ACCESS)
- `threat_id` (string, required): Threat id/code to remediate

### `compliance_status` (~76 tokens)

Get Compliance Status

Company-level compliance posture rollup (pass rate, control compliance, mitigated counts, per-framework coverage). Suitable for a CI gate. Wraps the traceability company rollup.

Input parameters:

- `diagram_id` (string): Optional diagram to add framework coverage for
- `scan_id` (string): Optional anchor scan; latest is used if omitted

### `discover_shadow_ai` (~104 tokens)

Shadow-AI posture (part of Code Security): unsanctioned / unknown AI-service usage discovered in code — totals, risk score, provider/type breakdown, hardcoded-key count, and top discoveries. Company latest, or one scan with `scan_id`. Reads code_review ShadowAIReport/ShadowAIDiscovery.

Input parameters:

- `limit` (integer): Max discoveries to return
- `scan_id` (string): Optional CodeReviewScan id; company-wide latest if omitted

### `get_api_security` (~84 tokens)

API security inventory (part of Code Security): discovered API endpoints with authentication status, risk level and risk factors, plus method/risk breakdowns. Company-wide or one scan with `scan_id`. Reads code_review ApiEndpointDiscovery.

Input parameters:

- `limit` (integer): Max endpoints to return
- `scan_id` (string): Optional CodeReviewScan id; company-wide if omitted

### `get_cloud_compliance` (~78 tokens)

Cloud security & compliance posture (Cloud Compliance): per connected cloud account, the latest CIS/NIST cloud-policy scan — compliance %, failing policies/records, status — plus a company rollup. Reads customers.Account.latest_scan -> compliances.ScanResults.

Input parameters:

- `account_id` (string): Optional single cloud Account id; all company accounts if omitted

### `code_review_scan` (~71 tokens)

Run a code security scan

Start (or re-run) a code-security scan for an existing scan/repository in your scope. Returns a poll pointer; results include SAST, secrets, deps, pipeline review and the traceability matrix.

Input parameters:

- `scan_id` (string, required): Id of an existing code-review scan to (re)run

### `compliance_scan` (~152 tokens)

Run a platform / compliance scan

Run a cloud/platform or compliance scan against an account or diagram in your scope (async). scan_type ∈ platform|compliance|pipeline|sbom. Returns a task id to poll.

Input parameters:

- `account_id` (string): Cloud account id (account-scoped scans)
- `diagram_id` (string): Diagram id/uuid (diagram-scoped scans)
- `frameworks` (array): Optional standard/framework ids to scope the scan
- `scan_type` (string, required): platform | compliance | pipeline | sbom
- `severity_filter` (array): Optional severity levels to include
- `simulation_mode` (boolean): Dry-run the scan without side effects
- `source` (string): Scan source (default: hybrid)

### `apply_remediation` (~109 tokens)

Apply a remediation (governed)

Apply a remediation for real (mode=live). Routed through the full governance funnel — patent reachability/kill-chain gates, autonomy policy and the approval flow. If your policy requires approval it returns 'requires_approval' rather than acting.

Input parameters:

- `resource_context` (object): provider/resource_id/region/account_id/metadata
- `rule_id` (string, required): Policy/rule id (e.g. AWS_S3_PUBLIC_ACCESS)
- `threat_id` (string, required): Threat id/code to remediate

### `get_diagram_summary` (~45 tokens)

Get a diagram summary

The canonical diagram summary every badge/card/header reads: threat counts by severity, risk value, compliance and framework coverage.

Input parameters:

- `diagram_id` (string, required): Diagram id/uuid

### `get_insights` (~43 tokens)

Get diagram insights

Threat/control matrix metrics + framework coverage for a diagram, joined with its latest code-security scan when one exists.

Input parameters:

- `diagram_id` (string, required): Diagram id/uuid

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-ayurak-aribot-mcp/mcp#diagnostics

## Score history

- 2026-08-03: 77
- 2026-08-02: 76
- 2026-08-01: 76
- 2026-07-31: 75
- 2026-07-30: 69
- 2026-07-29: 69
- 2026-07-28: 68
- 2026-07-27: 67
- 2026-07-26: 67

## Links

- Remote endpoint: https://mcp.aribot.ayurak.com/
- Website: https://api.aribot.ayurak.com/aribot/claude-connector
- Changelog RSS feed: https://verifymcp.io/servers/com-ayurak-aribot-mcp/mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-ayurak-aribot-mcp/mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/com-ayurak-aribot-mcp/mcp