{"protocolVersion":"1.0.0","name":"Aribot Security Agent","description":"Aribot is your security teammate. Ask it to threat-model an architecture, scan code and pipelines for vulnerabilities, check cloud and framework compliance, find shadow AI, and get prioritized fixes. Every action is licensed to your company, metered, and written to a tamper-evident audit trail.","url":"https://api.aribot.ayurak.com/aribot-api/v2/gateway/a2a","preferredTransport":"JSONRPC","version":"1.0.0","provider":{"organization":"Aristiun (Ayurak)","url":"https://ayurak.com"},"documentationUrl":"https://developer.ayurak.com","capabilities":{"streaming":false,"pushNotifications":false,"stateTransitionHistory":true},"defaultInputModes":["application/json","text/plain"],"defaultOutputModes":["application/json","text/plain"],"securitySchemes":{"oauth2":{"type":"oauth2","description":"Sign in with your Aribot account. An Owner or Security Manager authorizes the agent, then Aribot governs every call.","flows":{"authorizationCode":{"authorizationUrl":"https://api.aribot.ayurak.com/o/authorize/","tokenUrl":"https://api.aribot.ayurak.com/o/token/","scopes":{"read:findings":"Read code-review findings and traceability","run:codereview":"Start code-security scans","read:threatmodel":"Read threat models","write:threatmodel":"Create/upload/generate threat models","run:scan":"Run platform/cloud scans","read:insights":"Read insights, reports and compliance coverage","offline_access":"Issue refresh tokens for long-lived assistant connections"}}}}},"security":[{"oauth2":["read:insights"]}],"skills":[{"id":"generate_threat_model","name":"Generate a threat model","description":"Create a threat model from a normalized architecture (ReactFlow nodes + edges). Ingests components via the shared Stage-0 service; the pipeline then auto-generates threats. Returns the diagram id.","tags":["threat","model","architecture","diagram","stride","create"],"examples":["Threat-model this architecture and tell me what could go wrong."],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"code_review_scan","name":"Run a code security scan","description":"Start (or re-run) a code-security scan for an existing scan/repository in your scope. Returns a poll pointer; results include SAST, secrets, deps, pipeline review and the traceability matrix.","tags":["code","scan","sast","secrets","security","review","pipeline"],"examples":["Scan this repository for security vulnerabilities."],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"compliance_scan","name":"Run a platform / compliance scan","description":"Run a cloud/platform or compliance scan against an account or diagram in your scope (async). scan_type ∈ platform|compliance|pipeline|sbom. Returns a task id to poll.","tags":["cloud","platform","compliance","scan","aws","azure","gcp","posture"],"examples":["Check my cloud accounts against SOC 2 and flag the gaps."],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"get_remediation","name":"Plan a remediation (dry run)","description":"Compute a remediation plan for a threat/finding WITHOUT applying it (mode=dry_run). Runs the same governed engine as apply_remediation, including the patent gates, and returns the proposed steps.","tags":["remediation","fix","heal","plan","dry run","self-healing"],"examples":["How do I fix this finding?"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"apply_remediation","name":"Apply a remediation (governed)","description":"Apply a remediation for real (mode=live). Routed through the full governance funnel — patent reachability/kill-chain gates, autonomy policy and the approval flow. If your policy requires approval it returns 'requires_approval' rather than acting.","tags":["remediation","apply","heal","fix","auto-heal","governed","approve"],"examples":["Fix the high-severity finding and show me what changed."],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"get_traceability","name":"Get the traceability matrix","description":"Return the diagram→threat→finding→control→requirement→remediation traceability matrix for a scan in your scope, with coverage metrics.","tags":["traceability","matrix","coverage","controls","requirements","mapping"],"examples":["Trace this threat back to the control and the code."],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"get_diagram_summary","name":"Get a diagram summary","description":"The canonical diagram summary every badge/card/header reads: threat counts by severity, risk value, compliance and framework coverage.","tags":["summary","diagram","threats","risk","severity","compliance","coverage"],"examples":["Summarize the security posture of this diagram."],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"get_insights","name":"Get diagram insights","description":"Threat/control matrix metrics + framework coverage for a diagram, joined with its latest code-security scan when one exists.","tags":["insights","metrics","controls","framework","coverage","diagram"],"examples":["What are my top security risks right now?"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]}]}