Github Copilot

The Aikido MCP Plugin connects Aikido’s security engine to AI coding tools. It automatically scans AI generated code for vulnerabilities and hardcoded secrets as soon as it is created.

AI assistants can review their own output, but that review is not perfect. Aikido adds a reliable and consistent security layer that checks every generated snippet with proven scanning rules.

Why use Aikido MCP

• Deterministic, independent security checks on every AI generated snippet before it is committed
• Immediate detection and remediation of vulnerabilities and hardcoded secrets in AI assisted workflows
• Real time feedback, making AI driven development safer by default

Available Tools

• aikido_full_scan: Scans local code files for vulnerabilities (SAST) and hardcoded secrets.
• aikido_issues_list: Fetches security issues from your Aikido feed.

  • Filter by scope: repo_name, cloud_name, vm_name, domain_name, container_name, workspace_name or team_name
  • Optionally narrow a repo scope to a single branch with repo_branch_name
  • Pick one or more issue types: sast, leaked_secret, iac, open_source, cloud, cloud_instance, docker_container, malware, eol, mobile, surface_monitoring, scm_security, license, ai_pentest, ai_code_analysis
  • Filter by labels to only return issues on repositories or container images carrying any of the given labels
  • Filter by severity to only return issues of a certain severity or above a given threshold
  • Page through results with page (zero-based)
  • Returns each issue with title, type, severity, and remediation steps
  • Filter on SLA by choosing the following filters: out_of_sla or sla_due_soon
• aikido_ignore_issue: Ignores a security issue in the feed. Requires issue_id and a reason.
• aikido_login: Starts the Aikido sign-in flow; returns sign-in URL or confirms you're already signed in.

  • Sign-in redirects you to your account's region automatically. Only set region (eu, us, me, au) if you land in the wrong one
  • Use force_reauth to switch accounts or sign in again

Not all MCP tools are enabled by default. Admins can enable them on the permissions page for everyone

Installation

IDE

The Aikido VSCode IDE plugin uses Expansion Packs to provide additional features. The Aikido MCP for Github Copilot is one of these Expansion Packs, making installation simple and fast without a separate setup process. See the linked page below for instructions on how to enable it.

VS Code IDE

Integration with Copilot IDE plugins

1

Add the MCP configuration in your IDE settings

Go to Github Copilot plugin settings and open the mcp.json file. Add the Aikido server:

{
  "servers": {
    "aikido": {
      "command": "npx",
      "args": ["-y", "@aikidosec/mcp@latest"]
    }
  }
}

2

Authenticate

On first use, ask Copilot to run aikido_login. It will return a browser link. Follow it to log in to Aikido. Your token is stored securely once login is complete.

3

Add custom prompt instructions

Add an instruction to your AGENTS.md file or custom instructions to tell agent to use the new tooling.

Scan any new or modified code with `aikido_full_scan` before finalizing changes. This security check is required.

For CI/CD or headless setups where browser login is not possible, see Token Authentication.

Integration with Copilot Cloud Agents

GitHub Copilot coding agent can call tools from MCP servers while it runs. Follow the steps below to set up Aikido MCP for your repository. Configuration is done per repository.

Copilot Cloud Agents run in a headless environment and require a token because browser-based login is not available. You will need an Aikido Personal Access Token. See Token Authentication for how to create one.

If you already use Aikido MCP in VS Code, you can reuse that configuration and only add the token in your repository settings.

Set-up Instructions

For the full GitHub flow (where to paste JSON, how validation works, and how Copilot environments expose secrets), check out GitHub’s guide.

1

Add the MCP configuration in your repo settings

In your GitHub repository, go to Settings → Copilot → Coding agent and paste an MCP JSON config.

Example configuration for Aikido MCP (local/stdio via npx):

Copilot Cloud Agent

{
  "mcpServers": {
    "aikido": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@aikidosec/mcp@latest"],
      "tools": ["aikido_full_scan", "aikido_sast_scan", "aikido_secrets_scan"],
      "env": {
        "AIKIDO_API_KEY": "COPILOT_MCP_AIKIDO_API_KEY"
      }
    }
  }
}

2

Add the token to your Copilot environment

Github Copilot only exposes secrets/variables to MCP config if their names start with COPILOT_MCP_

Create a secret like:

COPILOT_MCP_AIKIDO_API_KEY = your Aikido token

3

Add custom prompt instructions

To ensure GitHub Copilot uses the MCP server, configure repository instructions as described in the GitHub guide.

Add an instruction such as:

Scan any new or modified code with `aikido_full_scan` before finalizing changes. This security check is required.

4

Validate

You can now verify your configuration by asking Copilot to security scan one of your files.

Scanning code

• "Use Aikido to scan this file for security issues"
• "Run an Aikido scan on my staged changes to check for secrets before I commit"
• "Scan the files I just edited with Aikido and link them to the payments-api repo"

Reviewing issues by repo

• "Show me all critical Aikido issues in payments-api"
• "List any leaked secrets in frontend-web from Aikido"
• "What open source vulnerabilities does Aikido see in api-gateway?"
• "Show SAST and IaC issues in infra-core from Aikido"

Reviewing issues by cloud, VM, or container

• "List all Aikido cloud issues in prod-aws"
• "Show malware findings on web-server-01 from Aikido"
• "What end-of-life software is running in the nginx-proxy container per Aikido?"
• "Show me surface monitoring issues for example.com in Aikido"

Combined workflows

• "Use Aikido to scan my current changes, then show existing critical issues in the same repo"
• "Check this PR with Aikido and compare against open SAST issues in the repo"