@aikidosec/mcp 1.0.8 → 1.0.9

package/README.md

@@ -3,20 +3,24 @@
 A lightweight Model Context Protocol (MCP) server that exposes Aikido’s Code and Secrets Scan as a tool for AI coding agents and IDEs. It lets your agent scan code and returns machine-readable findings you can triage, fix or ignore.
 
 ## Prerequisites
-- **Node.js** 18 or newer
-- An **Aikido API key** (get yours from [Aikido Security](https://app.aikido.dev))
+- **Node.js** 18.19.0 or newer
+- An **Aikido account** ([sign up](https://app.aikido.dev))
 
-## Configuration
+## Authentication
 
-### API Key Setup
+The MCP authenticates in one of two ways. You don’t need to pick up front — just add the server to your IDE (see below) and run any Aikido tool.
 
-The MCP server requires an Aikido API key to authenticate with the Aikido API. You can provide it in two ways:
+### Browser sign-in (recommended)
 
-1. **Via MCP Configuration (Recommended)**: Set the `AIKIDO_API_KEY` environment variable in your MCP configuration file
-2. **Via System Environment Variable**: Set `AIKIDO_API_KEY` as a system environment variable
+If no token is configured, the first tool call returns a one-time set of sign-in links — one per Aikido region (EU / US / ME). Click the link that matches your account.
+
+### Environment variable (CI / headless)
+
+For CI, containers, or any setup where opening a browser/using keychain isn’t an option, generate a Personal Access Token in **Settings → Integrations → MCP Server** and pass it as `AIKIDO_API_KEY` — either in your MCP config’s `env` block (examples below) or as a system env var. When set, `AIKIDO_API_KEY` takes precedence over the cached browser token.
 
 ## Add to your IDE or agent
-Below are example configurations to add to your the Aikido MCP to your IDE.
+
+Below are example configurations. They use the browser sign-in flow. To use `AIKIDO_API_KEY` instead, add an `env` block to any of them — see [Using AIKIDO_API_KEY](#using-aikido_api_key).
 
 ### Cursor
 
@@ -29,17 +33,12 @@ Add the following configuration to your Cursor `~/.cursor/mcp.json` file. See [C
   "mcpServers": {
     "aikido": {
       "command": "npx",
-      "args": ["-y", "@aikidosec/mcp"],
-      "env": {
-        "AIKIDO_API_KEY": "your-api-key-here"
-      }
+      "args": ["-y", "@aikidosec/mcp"]
     }
   }
 }
 ```
 
-**Note**: Replace `"your-api-key-here"` with your actual Aikido API key.
-
 ### Windsurf
 
 Add the following config to `~/.codeium/windsurf/mcp_config.json`. See [Windsurf MCP docs](https://docs.windsurf.com/windsurf/cascade/mcp) for more info.
@@ -49,17 +48,12 @@ Add the following config to `~/.codeium/windsurf/mcp_config.json`. See [Windsurf
   "mcpServers": {
     "aikido": {
       "command": "npx",
-      "args": ["-y", "@aikidosec/mcp"],
-      "env": {
-        "AIKIDO_API_KEY": "your-api-key-here"
-      }
+      "args": ["-y", "@aikidosec/mcp"]
     }
   }
 }
 ```
 
-**Note**: Replace `"your-api-key-here"` with your actual Aikido API key.
-
 ### VS Code
 
 Open the VS Code Command Palette by using Ctrl+⇧Shift+P or ⌘Command+⇧Shift+P (macOS). Type `MCP: Open User Configuration`.
@@ -68,6 +62,21 @@ Add the following config to the MCP config file. See [VS Code MCP docs](https://
 ```json
 {
   "servers": {
+    "aikido": {
+      "command": "npx",
+      "args": ["-y", "@aikidosec/mcp"]
+    }
+  }
+}
+```
+
+## Using AIKIDO_API_KEY
+
+To use a pre-generated token instead of the browser sign-in flow, add an `env` block to any of the configs above:
+
+```json
+{
+  "mcpServers": {
     "aikido": {
       "command": "npx",
       "args": ["-y", "@aikidosec/mcp"],
@@ -78,5 +87,3 @@ Add the following config to the MCP config file. See [VS Code MCP docs](https://
   }
 }
 ```
-
-**Note**: Replace `"your-api-key-here"` with your actual Aikido API key.