RAD Security MCP Server

List containers secured by RAD Security with optional filtering by image name, image digest, namespace, cluster_id, or free text search

Get detailed information about a container secured by RAD Security

List Kubernetes clusters managed by RAD Security

Get detailed information about a specific Kubernetes cluster managed by RAD Security

Get k8s audit logs with information about users who shelled into a pod

List container images with optional filtering by page, page size, sort, and search query

List vulnerabilities in a container image with optional filtering by severity

Get the most vulnerable images from your account

Get the SBOM of a container image

Ignore a CVE for this account so it no longer appears in vulnerability reporting. Use for confirmed false positives, accepted risks, or won't-fix decisions. Do NOT use for remediated CVEs — those drop off automatically on the next scan.

Remove an account-wide CVE disposition, restoring the CVE to vulnerability reporting.

List active CVE dispositions (ignored / false positive) for this account, with reason and author.

Get the latest manifest of a Kubernetes resource

List Kubernetes resources with optional filtering by namespace, resource types, and cluster

Get process trees for multiple containers

Get runtime baselines for multiple containers

Get LLM analysis of a container's process tree

List security findings with optional filtering by types, severities, sources, and status

Update the status of a security finding

Mark an inbox item as a false positive with a reason

List inbox items with optional filtering by any field. Multiple filters can be combined eg. 'search:cve-2024-12345 and severity:high'

Get detailed information about a specific inbox item

List all workflows

Get detailed information about a specific workflow by ID. It contains the workflow definition, default arguments, and schema how to run the workflow

List workflow runs with optional filtering by workflow ID

Get detailed information about a specific workflow run

Run a workflow with optional argument overrides

List workflow schedules with optional filtering by workflow ID

Create a new automation (a Windmill workflow) from a YAML definition. Pass the YAML document itself as a string, not a file path. It is validated server-side before deployment; on failure nothing is deployed and the errors are returned. Returns the new automation WITHOUT echoing the definition back — use `id` from the result when referring to it, and `get_workflow` if you need to read the definition.

Update an existing automation with new YAML. Only automations created via create_custom_workflow can be updated. Returns the updated automation without echoing the definition back.

Add a cron-based schedule to an automation so it runs automatically at the specified times.

Search your organization's knowledge base to find relevant uploaded documents, procedures, reports, and other content using natural language queries

List all collections in your organization's knowledge base. Collections are used to organize and categorize documents

List documents in your organization's knowledge base with optional filtering by collections, file type, or status

Query a CSV document from the knowledge base using natural language. IMPORTANT: This tool ONLY works with CSV documents. Use list_knowledge_base_documents with filters='file_type:csv' to find CSV document IDs (search_knowledge_base results also contain document IDs). Results are returned as a markdown table

Get the FULL text content of a knowledge base document (extracted text for PDF/DOCX, the raw file for markdown/plaintext/CSV). Use this to read or analyze a whole document rather than the excerpts search_knowledge_base returns. Find document IDs via list_knowledge_base_documents or search_knowledge_base results

Get a time-limited download URL for the ORIGINAL document file (any format, including PDF/DOCX binaries). Use when you need the original file itself — e.g. to fetch it into a sandbox for structural parsing (tables, layout), or when get_knowledge_base_document_content reports no text available. For reading text, prefer get_knowledge_base_document_content

List all available RadQL data types (discovery). ALWAYS call this FIRST before using other RadQL tools to discover what data is available to query. Returns data types like 'containers', 'kubernetes_resources', 'inbox_items', 'cloud_resources', 'cloud_benchmarks', 'cloud_benchmark_summaries', etc. with descriptions.

Get schema/metadata for a specific RadQL data type. Shows available fields, data types, which fields can be filtered/searched, and provides query examples. Call this AFTER radql_list_data_types to understand how to query a specific data type.

List possible values for a filter field (e.g., namespace list, cluster list, severity values). Useful for building dynamic filters when you need to know available enum-like values. Call this when constructing filters that need specific values.

Execute RadQL queries for security investigations. Supports: list (filter/search), get_by_id (single item), stats (aggregations). WORKFLOW: radql_list_data_types -> radql_get_type_metadata -> radql_query COMMON FIELDS BY DATA TYPE: containers: name, image_name, image_repo, owner_kind, cluster_id, created_at Example: image_name:*nginx* AND owner_kind:Pod finding_groups: type, source_kind, source_name, rule_title, severity, event_timestamp Types: k8s_misconfiguration, k8s_audit_logs_anomaly Example: type:k8s_misconfiguration AND severity:critical inbox_items: severity (High|Medium|Low), type, title, archived, false_positive, created_at Example: severity:High AND archived:false kubernetes_resources: kind, name, namespace, cluster_id, owner_kind, created_at Example: kind:Deployment AND namespace:production CLOUD RESOURCES & COMPLIANCE (use these RadQL data types instead of dedicated cloud tools): cloud_resources: cloud_provider, cloud_account_id, resource_type, resource_name, resource_id, resource_json, last_seen_at Example: cloud_provider:aws AND resource_type:aws_iam_policy cloud_benchmark_summaries: cloud_provider, cloud_account_id, benchmark_id, title, description, fail_count, pass_count, total_count, last_seen_at Example: cloud_provider:aws AND fail_count>0 cloud_benchmarks: cloud_provider, cloud_account_id, benchmark_id, control_id, control_title, severity, status, reason, resource_id, last_seen_at Example: status:fail AND benchmark_id:*cis* CRITICAL QUOTING RULES: MUST quote when value contains: - Dates/timestamps: created_at>"2024-01-01" (NOT created_at>2024-01-01) - Hyphens: cluster_id:"abc-123-def", name:"kube-system" - UUIDs: id:"550e8400-e29b-41d4-a716-446655440000" - Spaces: title:"my alert" - Special chars: :, =, <, >, !, (, ) - Wildcards with hyphens: name:"kube-*" OK to leave unquoted: - Simple strings: status:active, kind:Pod - Numbers: count:123 - Booleans: archived:true - Simple wildcards: name:nginx* For complete schema: call radql_get_type_metadata with target data_type

Helper tool to build RadQL queries programmatically from structured conditions. Useful when you need to construct complex filter or stats queries from structured inputs.

Execute multiple RadQL queries in parallel for efficiency. Useful for fetching related data from different data types simultaneously (e.g., container details + vulnerabilities + network connections).

List widget templates with optional filtering by visualization type and category

Get detailed information about a specific widget template

List dashboard templates with optional filtering by category

Get detailed information about a specific dashboard template

List dashboards for the account

Get detailed information about a specific dashboard

Create a dashboard for the account. Build `rows` from the widget templates (list_widget_templates / get_widget_template) so the visualization and query shapes are valid.

Update an existing dashboard. Omitted fields are left unchanged, so a small edit (a title, one row) does not require resending the whole dashboard.

List external integrations configured for the tenant (e.g., Slack, AWS CloudTrail, Okta). Returns integration details including capabilities, configuration, mcp support and sync status.