LabscoMCP early access ↗
rad-securityMCP SERVER · OFFICIAL PROJECT

RAD Security

Investigate a Kubernetes security question end to end — which containers are running, what CVEs sit in their images, who shelled into a pod, and what the runtime behaviour looked like at the time.

by rad-security ↗Vulnerability Scanning & Application Security✓ Official

LABSCO SUMMARY

The interesting half is behavioural: process trees and baselines, not just a CVE list.

Plenty of tools will tell you which images carry which vulnerabilities. What is harder to get into a conversation is what a container actually did — the processes it spawned, how that compares to its baseline, and who opened a shell into the pod according to the audit log. Having those beside the vulnerability data is what turns a triage question into one session rather than three consoles. Two supporting pieces matter more than they look: RadQL exposes its own data types and valid filter values, so a query is constructed against reality rather than guessed, and ignoring a CVE is a recorded disposition you can list back rather than a silent suppression.

What it is

A client for RAD Security's Kubernetes and cloud security platform, spanning runtime inventory, vulnerability management, findings triage, automation workflows, a knowledge base, dashboards, and a query language over the underlying data.

What you get

  • Runtime inventory: containers filtered by image, digest, namespace, cluster or free text, one container in detail, the clusters under management, and Kubernetes resources listed or read individually (list_containers, get_container_details, list_clusters, get_cluster_details, list_k8s_resources, get_k8s_resource_details).
  • Behaviour rather than just configuration — the process trees a container actually produced, its behavioural baselines, and an LLM analysis of what it has been doing (get_containers_process_trees, get_containers_baselines, get_container_llm_analysis).
  • The audit answer people reach for first in an incident: who shelled into a pod, straight from Kubernetes audit logs (who_shelled_into_pod).
  • Vulnerability management as a workflow, not a report: images listed, their CVEs filtered by severity, the most vulnerable images surfaced, an image's SBOM retrieved, and a CVE ignored or un-ignored for confirmed false positives and accepted risk, with the dispositions readable afterwards (list_images, list_image_vulnerabilities, get_top_vulnerable_images, get_image_sbom, ignore_cve, unignore_cve, list_cve_dispositions).
  • Findings and the inbox: security findings listed and their status updated, inbox items listed and read in detail, and an item marked a false positive (list_security_findings, update_security_finding_status, list_inbox_items, get_inbox_item_details, mark_inbox_item_as_false_positive).
  • Automation: workflows listed and read, runs listed and inspected, a workflow triggered on demand, schedules read and added, and custom workflows created or updated (list_workflows, get_workflow, list_workflow_runs, get_workflow_run, run_workflow, list_workflow_schedules, add_workflow_schedule, create_custom_workflow, update_custom_workflow).
  • RadQL over the platform's own data: the available data types and their metadata, the valid values for a filter, a builder for constructing a query, and single or batched execution (radql_list_data_types, radql_get_type_metadata, radql_list_filter_values, radql_query_builder, radql_query, radql_batch_query).
  • A knowledge base searched, browsed by collection and document, queried within one document, and read or downloaded in full (search_knowledge_base, list_knowledge_base_collections, list_knowledge_base_documents, query_knowledge_base_document, get_knowledge_base_document_content, get_knowledge_base_document_download_url).
  • Reporting surfaces: widget and dashboard templates, existing dashboards read, created and updated, and the external integrations configured on the account (list_widget_templates, get_widget_template, list_dashboard_templates, get_dashboard_template, list_dashboards, get_dashboard, create_dashboard, update_dashboard, list_external_integrations).

Requirements

A RAD Security account and an API access key created in its console. RAD Security runs the server for you at https://api.rad.security/mcp/ over Streamable HTTP — the trailing slash matters — with the credential sent as Bearer <access_key_id>:<secret_key>:<account_id>. Every request is authenticated against the RAD Security API and nothing is stored server-side. A short-lived session-token form also works but expires, so an access key is the right choice for anything long-lived. Client config differs in small ways worth checking: VS Code uses a servers key, Gemini CLI uses httpUrl, and Cline wants the type spelled streamableHttp.

Setup effort

One command plus a key — claude mcp add --transport http rad-security https://api.rad.security/mcp/ --header "Authorization: Bearer <access_key_id>:<secret_key>:<account_id>"

See installation options