Skip to main content

Set up the Aikido Security MCP server

The Aikido Security MCP server lets AI agents scan code, secrets, and infrastructure-as-code with Aikido's scanners, and list or ignore issues from your Aikido feed. This guide covers generating an Aikido personal access token and installing the server from the MintMCP MCP store.

Prerequisites​

  • A MintMCP admin account
  • An Aikido Security account (sign up)

Generate an Aikido personal access token​

Aikido personal access tokens are tied to the user who creates them. For per-user access, share these steps with your team so each member creates their own token.

  1. Go to app.aikido.dev and sign in.
  2. Navigate to Settings > Integrations > IDE > MCP.
  3. Generate a personal access token and copy it. You'll need it in the next step.

If some MCP tools are missing after connecting, an Aikido admin may need to enable them on the Aikido permissions page. See Aikido's AI coding assistants (MCP) article for details.

Add Aikido to MintMCP​

Aikido Security is pre-listed as a recommended server in the MintMCP MCP store, so MintMCP runs it on its own infrastructure and you only supply the token.

  1. In MintMCP, go to MCP store > Manage store.

  2. Find Aikido Security in the recommended servers list and click Install.

  3. Select an authentication method:

    MethodBehavior
    Per-user API keyEach user supplies their own token when they connect, so their own Aikido permissions apply
    Shared API keyYou supply one token that every user's requests run with

  4. For Shared API key, enter the Aikido API key you copied above.

  5. Click Install.

The token determines which Aikido region the server connects to, so no region setting is needed.

How scanning works on a hosted server​

The Aikido server runs its scanners inside the container. The hosted server cannot read files from a user's machine or repository checkout, so:

  • Scans work when the agent passes the code content to the server. The aikido_full_scan tool takes file contents directly and is the tool to use through MintMCP.
  • The aikido_scan_paths tool reads files from disk by path. On the hosted server those paths do not exist, so it returns an error. Hide it with tool customization so agents use aikido_full_scan instead.
  • Issue tools (aikido_issues_list, aikido_ignore_issue) read from and write to your Aikido feed and work as usual.

For workspace-wide scanning of a local checkout, use Aikido's IDE integration directly instead of the hosted server.

Security considerations​

  • Store personal access tokens securely. Treat each token as the user's Aikido credential.
  • Choose Per-user API key so scans and ignored issues are attributed to individual users rather than a shared account.
  • A Shared API key gives every user the permissions of the account that generated it, including the ability to ignore issues in the Aikido feed.
  • Code passed to the scan tool is sent to the hosted server and processed by Aikido's scanners. Findings are reported to your Aikido account.

Next steps​