{"protocolVersion":"1.0.0","name":"Aribot Security Agent","description":"Aribot is your security teammate. Ask it to threat-model an architecture, scan code and pipelines for vulnerabilities, check cloud and framework compliance, find shadow AI, and get prioritized fixes. Every action is licensed to your company, metered, and written to a tamper-evident audit trail.","url":"https://api.aribot.ayurak.com/aribot-api/v2/gateway/a2a","preferredTransport":"JSONRPC","version":"1.0.0","provider":{"organization":"Aristiun (Ayurak)","url":"https://ayurak.com"},"documentationUrl":"https://developer.ayurak.com","capabilities":{"streaming":false,"pushNotifications":false,"stateTransitionHistory":true},"defaultInputModes":["application/json","text/plain"],"defaultOutputModes":["application/json","text/plain"],"securitySchemes":{"oauth2":{"type":"oauth2","description":"Sign in with your Aribot account. An Owner or Security Manager authorizes the agent, then Aribot governs every call.","flows":{"authorizationCode":{"authorizationUrl":"https://api.aribot.ayurak.com/o/authorize/","tokenUrl":"https://api.aribot.ayurak.com/o/token/","scopes":{"read:findings":"Read code-review findings and traceability","run:codereview":"Start code-security scans","read:threatmodel":"Read threat models","write:threatmodel":"Create/upload/generate threat models","run:scan":"Run platform/cloud scans","read:insights":"Read insights, reports and compliance coverage","offline_access":"Issue refresh tokens for long-lived assistant connections","read:tickets":"Read tracker tickets linked to threats","write:tickets":"Send threats to trackers, assign threats, sync ticket status","write:code":"Comment on pull requests about threats in the code","manage:agents":"Onboard AI agents to governance and manage their policies","run:remediation":"Request remediations (live changes follow your approval policy)"}}}}},"security":[{"oauth2":["read:insights"]}],"skills":[{"id":"generate_threat_model","name":"Generate a threat model","description":"Create a threat model from a normalized architecture (ReactFlow nodes + edges). Aribot stores the components and generates the threats. Returns the diagram id.","tags":["threat","model","architecture","diagram","stride","create"],"examples":["Threat-model this architecture and tell me what could go wrong."],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"code_review_scan","name":"Run a code security scan","description":"Start (or re-run) a code-security scan for an existing scan/repository in your scope. Returns a poll pointer; results include SAST, secrets, deps, pipeline review and the traceability matrix.","tags":["code","scan","sast","secrets","security","review","pipeline"],"examples":["Scan this repository for security vulnerabilities."],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"compliance_scan","name":"Run a platform / compliance scan","description":"Run a cloud/platform or compliance scan against an account or diagram in your scope (async). scan_type ∈ platform|compliance|pipeline|sbom. Returns a task id to poll.","tags":["cloud","platform","compliance","scan","aws","azure","gcp","posture"],"examples":["Check my cloud accounts against SOC 2 and flag the gaps."],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"get_remediation","name":"Plan a remediation (dry run)","description":"Compute a remediation plan for a threat or finding without applying it (dry run). Runs Aribot's governed remediation checks and returns the proposed steps.","tags":["remediation","fix","heal","plan","dry run","self-healing"],"examples":["How do I fix this finding?"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"apply_remediation","name":"Apply a remediation (governed)","description":"Apply a remediation for real (mode=live). Goes through Aribot's governance checks (attack-path reachability, autonomy policy and the approval flow). If your policy requires approval it returns 'requires_approval' rather than acting.","tags":["remediation","apply","heal","fix","auto-heal","governed","approve"],"examples":["Fix the high-severity finding and show me what changed."],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"get_traceability","name":"Get the traceability matrix","description":"Return the diagram→threat→finding→control→requirement→remediation traceability matrix for a scan in your scope, with coverage metrics.","tags":["traceability","matrix","coverage","controls","requirements","mapping"],"examples":["Trace this threat back to the control and the code."],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"get_diagram_summary","name":"Get a diagram summary","description":"Summary of a diagram: threat counts by severity, risk value, compliance and framework coverage.","tags":["summary","diagram","threats","risk","severity","compliance","coverage"],"examples":["Summarize the security posture of this diagram."],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"list_diagrams","name":"List threat-model diagrams","description":"List your company's threat-model diagrams (id, name, last update), newest first, optionally filtered by part of the name.","tags":["diagram","diagrams","list","find","threat model","architecture"],"examples":[],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"get_insights","name":"Get diagram insights","description":"Code-security metrics for a diagram: the threat → finding → control metrics of its latest code-security scan. code_scan is null when the diagram has no scan yet.","tags":["insights","metrics","controls","framework","coverage","diagram"],"examples":["What are my top security risks right now?"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"verify_threats_in_code","name":"Verify threats in code","description":"Verify whether modelled STRIDE/LINDDUN threats are mitigated in a scan's uploaded code or AST. If threat_id is provided, returns synchronous verdict; otherwise dispatches batch verification across all diagram threats.","tags":["verify","code","threats","traceability","mitigation","ast","stride"],"examples":["Verify this threat actually exists in my code."],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"discover_shadow_ai","name":"Discover Shadow AI & APIs","description":"Scan connected repositories and network traffic for unmanaged LLMs, foundational model endpoints, vector databases, agent frameworks, and leaked API keys (async).","tags":["shadow ai","llm","discovery","openai","anthropic","vector db","apis"],"examples":["Find the unsanctioned AI tools and models used across my code."],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"get_framework_coverage","name":"Get compliance framework coverage","description":"Get control-mapped coverage percentages, gap counts, and mapped controls for EU AI Act, DORA, NIST AI RMF, ISO 27001, SOC 2, etc.","tags":["compliance","framework","coverage","controls","eu ai act","dora","nist","iso"],"examples":["How well am I covered against OWASP and NIST?"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"compliance_status","name":"Company compliance status rollup","description":"Company-level compliance posture: per-framework posture from the daily cloud scans (checks passed/failed, controls tested/failing), plus threat and control metrics from code scans. Pass `framework` (e.g. 'ISO 27001') to get that framework's most-failing controls. Rates are percentages (0-100).","tags":["compliance","status","posture","audit","frameworks","rollup","gate","controls","gaps"],"examples":[],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"generate_architecture","name":"Generate architecture & threat model from prompt","description":"Generate a multi-tier cloud/AI architecture and auto-synthesize STRIDE/LINDDUN threat models, security requirements, and regulatory control mappings directly from a natural-language description. Runs in the background (a few minutes); returns the name the diagram is saved under.","tags":["architecture","generate","prompt","cloud","threat model","design","ai","stride"],"examples":[],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"run_ai_governance_audit","name":"Audit architecture or scan against AI regulations","description":"Audit an architecture diagram or code scan against statutory AI governance frameworks (EU AI Act 2024, EU DORA 2022, NIST AI RMF 1.0, ISO 42001). Evaluates article-by-article conformity, satisfied controls, open gaps, and generates actionable remediation guidance.","tags":["ai governance","eu ai act","dora","nist ai rmf","iso 42001","audit","compliance","conformity"],"examples":[],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"get_code_findings","name":"Get code-security findings","description":"Findings from a code-security scan (SAST, secrets, dependencies): title, severity, file and line, CWE/OWASP category, status and the recommended fix. Latest completed scan when scan_id is omitted.","tags":["code","findings","vulnerabilities","sast","secrets","issues","code review"],"examples":[],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"get_shadow_ai","name":"Get shadow-AI discoveries","description":"AI usage found in your code and network traffic: provider, service type, model, endpoint, where it was found, risk level, classification and whether a hard-coded key was seen. Company-wide, or one scan with scan_id.","tags":["shadow ai","ai usage","llm","models","unsanctioned","discovery"],"examples":[],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"get_agent_governance","name":"Get governed AI agents","description":"Your governed AI-agent fleet: each agent's id, name, cohort, whether it is active, its execution state (running, held, suspended), deviation score and the reason for any hold. Totals by state.","tags":["agents","agent governance","fleet","suspended","ai agents","nhi"],"examples":[],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"get_self_healing","name":"Get self-healing activity","description":"Remediation (self-healing) history: each planned or applied fix with its threat, rule, resource, mode (dry run or live), status and outcome, plus whether autonomous live remediation is switched on for your company.","tags":["self-healing","remediation","fixes","history","autonomy","applied"],"examples":[],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"list_ticket_destinations","name":"List ticket destinations","description":"Trackers, routes and destinations this caller may send threats to (no credentials).","tags":["jira","github","gitlab","azure","servicenow","tracker","route","ticket"],"examples":[],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"file_threat_tickets","name":"Send threats to a tracker","description":"Send 1-50 threat report entries to the tracker their route points at (or `destination`). One ticket per threat per report; a repeat returns already_filed. dry_run=true returns the exact tickets without sending; a preview with public_repository=true goes to a public repository, visible to anyone. Error codes: permission_missing, role_missing, destination_not_found, already_filed, rate_limited, assignee_unmapped, no_route, no_entry, not_found, invalid, no_company, tracker_error, filed_unrecorded, outcome_unknown, not_attempted, not_configured, tracker_unreachable, unsupported. filed_unrecorded and outcome_unknown mean the ticket may already exist in the tracker; not_attempted means the item was not sent.","tags":["ticket","issue","jira","github","send","file","developer"],"examples":[],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"get_threat_tickets","name":"Get tickets for threats","description":"Tickets (tracker, number, state, assignee) for the given threat entries, or for a diagram.","tags":["ticket","status","issue"],"examples":[],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"sync_threat_tickets","name":"Sync ticket status now","description":"Pull the current state and assignee of this company's open tickets (max 50 per call, time-boxed). Returns {checked, changed, errors, remaining}; remaining > 0 means call again to continue. Error codes: permission_missing, role_missing, destination_not_found, already_filed, rate_limited, assignee_unmapped, no_route, no_entry, not_found, invalid, no_company, tracker_error, filed_unrecorded, outcome_unknown, not_attempted, not_configured, tracker_unreachable, unsupported. filed_unrecorded and outcome_unknown mean the ticket may already exist in the tracker; not_attempted means the item was not sent.","tags":["sync","status","ticket"],"examples":[],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"assign_threat","name":"Assign a threat","description":"Set the owner and due date of a threat entry; the linked ticket follows. Error codes: permission_missing, role_missing, destination_not_found, already_filed, rate_limited, assignee_unmapped, no_route, no_entry, not_found, invalid, no_company, tracker_error, filed_unrecorded, outcome_unknown, not_attempted, not_configured, tracker_unreachable, unsupported. filed_unrecorded and outcome_unknown mean the ticket may already exist in the tracker; not_attempted means the item was not sent.","tags":["assign","owner","due"],"examples":[],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"comment_threat_on_change","name":"Comment on a pull request about threats","description":"For a completed pipeline scan of a pull request: post, or update, one comment per threat whose linked code the pull request changes. A re-run with nothing changed makes no calls. Returns each comment's status (posted, updated, skipped with the reason, failed). Public repositories are skipped with the reason 'public repository'. Error codes: permission_missing, role_missing, destination_not_found, already_filed, rate_limited, assignee_unmapped, no_route, no_entry, not_found, invalid, no_company, tracker_error, filed_unrecorded, outcome_unknown, not_attempted, not_configured, tracker_unreachable, unsupported. filed_unrecorded and outcome_unknown mean the ticket may already exist in the tracker; not_attempted means the item was not sent.","tags":["pull request","merge request","comment","code","review","threat"],"examples":[],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]}]}