RAD Security MCP Server

A Model Context Protocol (MCP) server for RAD Security, providing AI-powered security insights for Kubernetes and cloud environments.

Installation

Related MCP server: awsome_kali_MCPServers

Usage

Prerequisites

• Node.js 20.x or higher

Environment Variables

The following environment variables are required to use the MCP server with Rad Security:

Optional environment variables:

Optional: Filter Toolkits

You can control which toolkits are exposed by the MCP server using these environment variables:

• INCLUDE_TOOLKITS: Comma-separated list of toolkits to include (only these will be enabled)

• EXCLUDE_TOOLKITS: Comma-separated list of toolkits to exclude (all except these will be enabled)

Available toolkits:

• containers - Container inventory operations

• clusters - Kubernetes cluster operations

• identities - Identity management operations

• audit - Audit log operations

• cloud_inventory - Cloud resource inventory

• images - Container image operations

• kubeobject - Kubernetes resource operations

• misconfigs - Misconfiguration detection

• runtime - Runtime analysis operations

• runtime_network - Network traffic analysis

• threats - Threat vector operations

• findings - Security findings operations

• cves - CVE database operations

• inbox - Inbox item operations

• workflows - Workflow execution operations

• knowledge_base - Knowledge base search operations

• radql - Query interface for rad data platform

Examples:

Note: If INCLUDE_TOOLKITS is set, EXCLUDE_TOOLKITS is ignored.

Operations Without Authentication

You can also use few operations without authentication:

• List CVEs

• Get details of a specific CVE

• Get latest 30 CVEs

• List Kubernetes resource misconfiguration policies

In cursor IDE

It's quite problematic to set ENV variables in cursor IDE.

So, you can use the following start.sh script to start the server.

Please set the ENV variables in the start.sh script first!

In Claude Desktop

You can use the following config to start the server in Claude Desktop.

To filter toolkits, add INCLUDE_TOOLKITS or EXCLUDE_TOOLKITS to the env:

As a Docker Container - with Streamable HTTP

With toolkit filters:

As a Docker Container - with SSE (deprecated)

Note: The SSE transport is now deprecated in favor of Streamable HTTP. It's still supported for backward compatibility, but it's recommended to use Streamable HTTP instead.

Features

• Account Inventory

  • List clusters and their details*

• Containers Inventory

  • List containers and their details*

• Security Findings

  • List and analyze security findings*

• Runtime Security

  • Get process trees of running containers*

  • Get runtime baselines of running containers*

  • Analyze process behavior of running containers*

• Network Security

  • Monitor HTTP requests*

  • Track network connections*

  • Analyze network patterns*

• Identity and Access

  • List identities*

  • Get identity details*

• Audit

  • List who shelled into a pod*

• Cloud Security

  • List and monitor cloud resources*

  • Get resource details and compliance status*

• Images

  • Get SBOMs*

  • List images and their vulnerabilities*

  • Get top vulnerable images*

• Kubernetes Objects

  • Get details of a specific Kubernetes resource*

  • List Kubernetes resources*

  • List Kubernetes resource misconfiguration policies*

• Threat Vector

  • List threat vectors*

  • Get details of a specific threat vector*

• CVEs

  • List CVEs

  • Get details of a specific CVE

  • Get latest 30 CVEs

• RadQL (Advanced Querying)

  • List available data types for querying (containers, findings, kubernetes_resources, etc.)*

  • Get schema/metadata for specific data types*

  • List possible values for filter fields*

  • Execute RadQL queries with filtering, searching, and aggregations*

  • Build queries programmatically from structured conditions*

  • Execute multiple queries in parallel*

* - requires authentication and account in Rad Security.

Development

License

MIT License - see the LICENSE file for details