rad-security/mcp-server

A Model Context Protocol (MCP) server for RAD Security, providing AI-powered security insights for Kubernetes and cloud environments.
Connect (hosted — recommended)
RAD Security runs the MCP server for you, so most users don't need to install or host anything. Point your MCP client at the hosted endpoint and authenticate with your RAD Security credentials.
- **Endpoint:** https://api.rad.security/mcp/ — note the **trailing slash**.
- **Transport:** Streamable HTTP.
- **Authentication:** send your credential in the Authorization header:
and are a RAD Security API access key (create one in the RAD Security console); is your account ID. The server authenticates every request against the RAD Security API — no credentials are stored server-side.
> A short-lived form Bearer ory_st_ : also works, but session tokens expire — prefer an access key for anything long-lived (e.g. Slack / Claude Tag).
Claude Code
OpenAI Codex CLI
~/.codex/config.toml:
Or via the CLI, keeping the secret in an env var (export RAD_MCP_TOKEN= : : ):
Cursor
.cursor/mcp.json:
VS Code (GitHub Copilot)
.vscode/mcp.json — note the wrapper key is servers, not mcpServers:
Gemini CLI
~/.gemini/settings.json — note the URL field is httpUrl (not url):
Cline
cline_mcp_settings.json — note type must be exactly streamableHttp (camelCase):
Windsurf
~/.codeium/windsurf/mcp_config.json — note the URL field is serverUrl:
Other clients
Most MCP clients accept a remote Streamable HTTP server with a URL and an Authorization header — only the field names differ. Keep the **trailing slash** on the URL in every case.
| Client | Config location | URL field | Transport marker | Header field |
| --- | --- | --- | --- | --- |
| Claude Code | claude mcp add | positional arg | --transport http | --header |
| OpenAI Codex CLI | ~/.codex/config.toml | url | inferred | http_headers / bearer_token_env_var |
| Cursor | .cursor/mcp.json | url | type: "http" | headers |
| VS Code | .vscode/mcp.json (servers) | url | type: "http" | headers |
| Gemini CLI | ~/.gemini/settings.json | httpUrl | inferred | headers |
| Cline | cline_mcp_settings.json | url | type: "streamableHttp" | headers |
| Windsurf | ~/.codeium/windsurf/mcp_config.json | serverUrl | inferred | headers |
Claude.ai / Claude Desktop / Claude Tag (Slack)
These surfaces add remote MCP servers as **connectors**, which use their own credential settings rather than a raw request header. Add https://api.rad.security/mcp/ as a custom connector, then supply the bearer credential through the connector's settings:
- **Claude Tag (Slack):** attach the server as a plugin whose .mcp.json points at the endpoint, and add the bearer credential on the Access bundle's **Credentials** tab. See Claude Tag — connect a custom MCP server.
- **Claude.ai / Desktop:** add it under Settings → Connectors; see custom connectors.
Test it (MCP Inspector or curl)
Scoping the tools an agent sees
By default a connection gets every toolkit. To give an agent a smaller set — less context/token overhead, and least privilege — add a scoping header to that connection alongside Authorization. The subset is enforced: an out-of-scope tool is hidden from tools/list **and** rejected if called.
| Header | Effect |
| --- | --- |
| X-Rad-Toolkits: findings, images | only these toolkits |
| X-Rad-Exclude-Toolkits: workflows | every toolkit except these |
| X-Rad-Readonly: true | only read-only tools (drops the write tools) |
Toolkits: containers, clusters, audit, images, kubeobject, runtime, findings, inbox, workflows, knowledge_base, radql, dashboards, integrations. All are enabled by default — narrow with the headers above, and use X-Rad-Readonly when you want to exclude every write tool.