Aribot

io.github.aristiunPublished by GitHub account aristiunv1.0.0Updated Oct 24, 2026

Threat modeling, code/cloud/pipeline scanning, shadow-AI discovery, compliance checks and fixes.

VerifiedStreamable HTTPWeb executableCloud & InfrastructureDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Aribot is a hosted security MCP server that lets an assistant build threat models, scan code, pipelines and cloud accounts, check compliance and propose fixes.

What you can do
Generate and re-model threat models from a system diagram or description, with STRIDE and LINDDUN coverage and traceability from threat to requirement, control and fix, plus verification of threats against code and framework coverage checks for NIST, ISO 27001 and SOC 2, and compliance status reporting, including assessment of third-party vendors. Run code, CI/CD pipeline, cloud posture and SBOM scans, and discover shadow AI use and API endpoints across an estate. Retrieve remediation as code, cloud configuration or infrastructure-as-code, and view billing and usage information.
When to use it
Useful when security work should happen inside an existing assistant: turning a design into a threat model, checking a repository, pipeline or AWS, Azure or GCP account, tracking compliance gaps, or getting a proposed fix for a finding without switching tools.
Requirements
A remote streamable HTTP endpoint with OAuth 2.1 login (Authorization Code with PKCE and dynamic client registration); no local package or environment variables. Access is checked against a company licence, granted OAuth scopes and team roles, so an authorized account and tenant are needed.
Before you install
OAuth scopes include write and run permissions such as run:scan, run:codereview, write:threatmodel and run:remediation; remediation can be applied, for example opening a pull request or pushing a cloud change, under approval. Usage is metered and every action is logged, and scans send repository, pipeline and cloud account data to the hosted service.

Installation

In SourceWeft

  1. Open Aribot in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.aristiun%2Faribot/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "aribot": {
      "type": "http",
      "url": "https://mcp.aribot.ayurak.com/mcp"
    }
  }
}

README

[Aribot]

Aribot — MCP server for security work

[Aribot MCP]

Live page: https://aristiun.github.io/aribot-mcp/ · Product: https://aribot.ayurak.com · Registry: io.github.aristiun/aribot

Aribot is a security tool from Ayurak / Aristiun, available as a remote Model Context Protocol (MCP) server. Connect it to any MCP client — ChatGPT, Gemini, Claude, or your own — and run real security work from the assistant you already use, without switching tools.

This repository is a public manifest for the hosted server. It contains no product code — only the connection details. The server requires OAuth, so listing its address exposes nothing without an authorized login.

Unified threat modeling — one model, not five tools

Aribot builds one threat model per system and layers every discipline onto it — security (STRIDE + LINDDUN), cloud posture (AWS · Azure · GCP), compliance (NIST · ISO 27001 · SOC 2), and the economics of each risk (value at risk, cost to fix, dollars saved once healed) — all kept traceable end to end:

Threat → Requirement → Control → Framework → Code → Fix

Ask for any link in that chain, in either direction, with evidence behind every finding and every fix.

What you can do with it

Threat modeling

  • Turn a diagram or a written description of a system into a full threat model
  • STRIDE and LINDDUN coverage, generated per component and per data flow
  • Threats mapped to the security controls, requirements, and compliance frameworks that address them
  • A traceability view from each threat → finding → control → requirement → remediation
  • Re-model as the design changes; link related diagrams and reuse component threat libraries

Scanning

  • Code security — static analysis of a connected repository
  • Pipeline security — CI/CD configuration and supply-chain checks
  • Cloud & compliance — posture checks across AWS, Azure, and GCP accounts
  • SBOM — generate a software bill of materials
  • Shadow AI & API discovery — find where AI/LLM use and API endpoints have spread across your estate

Compliance

  • Coverage and control status against NIST, ISO 27001, SOC 2, and other frameworks
  • See which controls a threat model or scan already satisfies, and where the gaps are

Vendors

  • Assess a third party's posture and fold it into your own risk view

Remediation

  • Get a fix for a finding — as code, cloud configuration, or infrastructure-as-code
  • Keep it advisory, or apply it (e.g. open a pull request or push a cloud change) under approval

Connect

Point any MCP client at the server and complete the OAuth prompt:

https://mcp.aribot.ayurak.com/mcp
TransportStreamable HTTP
AuthOAuth 2.1 (Authorization Code + PKCE; Dynamic Client Registration)
Homepagehttps://aribot.ayurak.com

OAuth is discovered automatically at https://mcp.aribot.ayurak.com/.well-known/oauth-authorization-server.

Example (Claude Code):

claude mcp add --transport http aribot https://mcp.aribot.ayurak.com/mcp

Access controls

Each call is checked against your company's licence, the OAuth scopes you granted (read:findings, read:threatmodel, read:insights, run:scan, run:codereview, write:threatmodel, run:remediation), your team's roles, and your tenant boundary. Usage is metered, and every action is logged. So you can run security work from an assistant without losing track of who can do what, or which company's data is which.

Tools

generate_threat_model · verify_threats_in_code · get_traceability · get_framework_coverage · compliance_status · discover_shadow_ai · get_api_security · get_cloud_compliance · get_remediation · get_billing

See the full tool list and pricing at https://ayurak.com/pricing.

© Ayurak / Aristiun. "Aribot" and "Ayurak" are trademarks of their owner. This manifest is provided for MCP discovery under the MIT License (see LICENSE).

Source: README.md at commit 429a244

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts