A security tool that returns a rewritten file invites an agent to overwrite work it did not read. Returning a minimal replacement for the vulnerable lines keeps the diff reviewable and the blast radius small. The stateless design is the other honest detail: credentials ride on every call rather than being held server-side, which means an agent's access ends the moment you stop passing the key.
AquilaX's static analysis behind an MCP endpoint. We connected and it listed 12 tools: organisations and groups, scans, findings, and an AI fix tool that rewrites the vulnerable lines.
- start_scan on a Git repository and get_scan_status while it runs asynchronously
- scan_code for a snippet or single file, returning structured findings
- list_vulnerabilities filtered by severity, status, path, branch or scan
- fix_vulnerability — a secure, minimal replacement for a known-vulnerable snippet, returning only the fixed lines
- get_security_summary and get_scan_report for posture and per-scan detail, plus search_docs over AquilaX's own documentation
An API key in the X-AX-Key header, with organisation and group headers recommended. There is no OAuth path for MCP. Every tool takes the key as an argument as well, so the server holds no session.
Paste a URL with a key — add the endpoint to your client