Scans a repository or a snippet for vulnerabilities and returns a minimal fix for the lines that are wrong.
LABSCO SUMMARY
A security tool that returns a rewritten file invites an agent to overwrite work it did not read. Returning a minimal replacement for the vulnerable lines keeps the diff reviewable and the blast radius small. The stateless design is the other honest detail: credentials ride on every call rather than being held server-side, which means an agent's access ends the moment you stop passing the key.
AquilaX's static analysis behind an MCP endpoint, with 12 tools: organisations and groups, scans, findings, and an AI fix tool that rewrites the vulnerable lines.
An API key in the X-AX-Key header, with organisation and group headers recommended. There is no OAuth path for MCP. Every tool takes the key as an argument as well, so the server holds no session.
Paste a URL with a key — add the endpoint to your client
USE CASES
Start the scan, poll status while it runs, then read the report rather than blocking on a long call.
Scan the snippet in hand and get structured findings without pushing anything.
Pass the vulnerable lines and the CWE, and apply the minimal replacement it returns.
Pull the pre-aggregated summary for the org and group — project count, scans, findings.
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
list_organizationsLists the organizations the authenticated user belongs to (names and IDs). Use this when the user explicitly wants to see, browse, or choose among their organizations, or wants to work with a DIFFERENT organization than the one configured for this session. Do NOT call this just to obtain the organization ID for start_scan, get_scan_status, scan_code, or list_vulnerabilities — those tools resolve the configured organization automatically from the session.
list_groupsLists the groups within an organization (names and IDs). Use this when the user explicitly wants to see, browse, or choose among their groups, or wants to work with a DIFFERENT group than the one configured for this session. Do NOT call this just to obtain the group ID for start_scan, get_scan_status, scan_code, or list_vulnerabilities — those tools resolve the configured group automatically from the session.
start_scanTriggers a full security scan on a Git repository using the Aquilax static analysis engine. The scan runs asynchronously in the background — use get_scan_status with the returned scanId to poll for progress. Use this tool when the user wants to scan or audit an entire repository or project. For scanning a specific code snippet or file, use scan_code instead.
get_scan_statusReturns the current status and progress of a repository scan previously started with start_scan. Status values are PROCESSING, COMPLETED, or FAILED. Poll this tool periodically after calling start_scan until the status is no longer PROCESSING.
scan_codeScans a code snippet or file content for security vulnerabilities using Aquilax static analysis. Returns structured findings with severity rating (CRITICAL/HIGH/MEDIUM/LOW), affected line numbers, CWE identifiers, vulnerability description, and remediation recommendation. Waits synchronously for analysis to complete (up to 5 minutes). Provide the filename parameter when possible to improve language detection accuracy. Use this tool when the user wants to check a specific file or code snippet for security issues. For scanning an entire repository, use start_scan instead.
list_vulnerabilitiesReturns all security vulnerability findings stored in Aquilax for an organization and group. Each finding includes severity (CRITICAL/HIGH/MEDIUM/LOW), verification status, affected file path, line numbers, scanner name, CWE identifiers, and remediation recommendation. Supports optional filtering by scan ID, severity, status, file path, Git repository URL, and branch.
fix_vulnerabilityGenerates a secure, minimal replacement for a known vulnerable code snippet using Aquilax AI. Returns only the fixed lines of code — preserving the original indentation and style — along with the vulnerability type and detected language. Provide the vulnerability description and CWE from scan_code or list_vulnerabilities findings for best results. Optionally supply the full file content to give the model broader context for an accurate fix. Use this tool after identifying a vulnerability with scan_code or list_vulnerabilities, not as a standalone security review.
get_security_summaryReturns a compact, pre-aggregated security posture summary for the configured organization and group: project count, scans run, lines/files scanned, total vulnerabilities broken down by status (True Positive / False Positive / Unverified / Not Exploitable), true/false-positive rates, a severity breakdown (Critical/High/Medium/Low), and a per-scanner breakdown — for both the current state and 30 days ago.
get_scan_reportReturns a compact report for a SINGLE scan: repository and commit metadata, lines/files scanned, execution stats, a short "about the codebase" summary when available, and the scan's findings aggregated by severity, scanner, status, and CWE (False Positive and Not Exploitable findings excluded). This is the report tool for ONE scan: when the user asks for a report AND provides or references a specific scan (e.g. "report for scan <id>", "give me the report for this scan", "summarize scan <id>", "what did scan <id> find"), call this with that scanId. Requires the scanId.
get_account_contextReturns the authenticated user's workspace context as a ready-to-read markdown brief: their name/email/ID, recent notifications, the CURRENT organization (name, id, plan, the user's role) and CURRENT group (name, id, security policy), plus the lists of organizations, groups, org members, and scanned projects, and handy dashboard links. Use this for questions like "who am I", "what is my plan", "what org/group am I in", "what projects have I scanned", "what is my security policy", or "do I have any notifications".
list_projectsLists the projects (repositories) in the configured organization and group — name, id, Git URL, and default branch. Use this when the user wants to see, browse, or pick a project, or when you need a project's Git URL/branch to start a scan. For findings use list_vulnerabilities; for an overall posture summary use get_security_summary.
search_docsSearches the AQUILAX PRODUCT documentation and FAQ knowledge base (about the Aquilax platform itself) and returns the most relevant passages. Use ONLY for questions about what Aquilax is and how to use it — its features, scanners, plans/pricing, integrations, configuration, and "how do I…" product questions. Do NOT use this tool for general knowledge, current events, news, weather, code help, or anything that is not specifically about the Aquilax platform — it only knows Aquilax docs and will return nothing useful for those.
BEFORE YOU INSTALL
12 tools when we connected.
CONTEXT COST
Rated by the size of the 12 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Add the endpoint to your client.
https://mcp.aquilax.ai/mcpMCP servers
novadyne-hq
GroundNG
notasandy
cycodehq