Jetbrains AI / Junie MCP

The Aikido MCP Plugin connects Aikido’s security engine to AI coding tools. It automatically scans AI generated code for vulnerabilities and hardcoded secrets as soon as it is created.

AI assistants can review their own output, but that review is not perfect. Aikido adds a reliable and consistent security layer that checks every generated snippet with proven scanning rules.

Why use Aikido MCP

• Deterministic, independent security checks on every AI generated snippet before it is committed
• Immediate detection and remediation of vulnerabilities and hardcoded secrets in AI assisted workflows
• Real time feedback, making AI driven development safer by default

Installation

1

Add Aikido MCP server to your Jetbrains IDE config

In your IDE go to Settings | Tools | AI Assistant | Model Context Protocol (MCP).

Check out Jetbrains documentation for more information

On the Model Context Protocol (MCP) settings page, click Add to add a new MCP server configuration.

In the New MCP Server dialog, select how you want to connect to the MCP server and provide a JSON configuration:

{
  "mcpServers": {
    "aikido": {
      "command": "npx -y @aikidosec/mcp@latest",
      "args": [],
      "environment": {}
    }
  }
}

2

Authenticate

On first use, ask the AI assistant to run aikido_login. It will return a browser link, follow it to log in to Aikido. Your token is stored securely once login is complete.

3

Adapt your agent instructions to use the Aikido MCP by adding the following skill or instructions.

---
name: aikido-security
description: Enforce mandatory security scanning for all code changes
license: MIT
compatibility: opencode
metadata:
  audience: developers
  security: aikido
---

## Purpose

Ensure that all first-party code is scanned for security issues whenever code is written or changed.

## Rules

- Always run **aikido_full_scan** on all newly written, generated, added, or modified first-party code.
- Always provide the complete file contents to the scanner.
- If any security issues are reported, apply the fixes using the remediation guidance from Aikido.
- Run **aikido_full_scan** again after fixes to confirm that no issues remain and no new ones were introduced.
- Repeat the fix and rescan cycle until the scan passes with zero issues.
- If the Aikido MCP server is not installed or not running, inform the user to install it using the official setup guide at  
  https://help.aikido.dev/ide-plugins/aikido-mcp

4

Finished

Aikido MCP is now available in Jetbrains IDE

For CI/CD or headless setups where browser login is not possible, see Token Authentication.

Scanning code

• "Use Aikido to scan this file for security issues"
• "Run an Aikido scan on my staged changes to check for secrets before I commit"
• "Scan the files I just edited with Aikido and link them to the payments-api repo"

Reviewing issues by repo

• "Show me all critical Aikido issues in payments-api"
• "List any leaked secrets in frontend-web from Aikido"
• "What open source vulnerabilities does Aikido see in api-gateway?"
• "Show SAST and IaC issues in infra-core from Aikido"

Reviewing issues by cloud, VM, or container

• "List all Aikido cloud issues in prod-aws"
• "Show malware findings on web-server-01 from Aikido"
• "What end-of-life software is running in the nginx-proxy container per Aikido?"
• "Show me surface monitoring issues for example.com in Aikido"

Combined workflows

• "Use Aikido to scan my current changes, then show existing critical issues in the same repo"
• "Check this PR with Aikido and compare against open SAST issues in the repo"