Use the Aikido plugin

Install the Aikido plugin from the EOS marketplace to add Aikido security tools to supported AI coding runtimes and require a security scan before code changes are finalized.

Install the plugin

apm marketplace add tillotech/eos
apm install aikido@eos --global

Omit --global when Aikido is a repository dependency that should be recorded in the project’s apm.yml and apm.lock.yaml.

APM installs the @aikidosec/mcp stdio server into each configured Claude, Cursor, and Codex runtime. Node.js 18.19.0 or newer is required to run the server.

Authenticate interactively

Browser sign-in is Aikido’s recommended authentication method for local use. Ask the agent to call aikido_login, open the URL for the region that hosts the Aikido account, and complete sign-in. Aikido stores the resulting token securely.

Authenticate in a headless environment

For CI, containers, or other environments without browser access, create a Personal Access Token under Aikido’s Settings > Integrations > IDE > MCP page and expose it as AIKIDO_API_KEY before starting the AI coding runtime:

export AIKIDO_API_KEY=your-token-here

Keep the token in the environment or a secret manager. Do not add it to apm.yml, a runtime MCP configuration file, or version control.

Available tools

The plugin provides Aikido’s tools for scanning changed code, listing security issues, ignoring an issue with a reason, and starting the interactive login flow. Aikido administrators control which tools are enabled for users from the MCP permissions page.

The installed instruction requires agents to run aikido_full_scan on new or modified code before finalizing a change.

See Aikido’s Cursor MCP guide and token authentication guide for the upstream setup and authentication details.