{"channels":[{"id":"page-context","label":"Current page context","category":"Local browser context","status":"native","runtime_support":"live","description":"Sends the current page title, headings, and bounded body text to the model.","auth_modes":["none"],"config":{"type":"page_context","source":"active_document","max_chars":4200,"include_headings":true,"include_matches":true}},{"id":"recipe-index","label":"SecurityRecipes search index","category":"Local browser context","status":"native","runtime_support":"live","description":"Searches the generated recipe index and attaches the most relevant docs, prompts, and remediation pages.","auth_modes":["none"],"config":{"type":"recipes_index","source":"/recipes-index.json","top_k":5,"sections":["recipes","security-remediation","automation","docs"]}},{"id":"github-repository","label":"GitHub repository context","category":"Code and findings sources","status":"native","runtime_support":"live","description":"Pulls bounded public or authenticated GitHub repo metadata, manifest files, open issues, and pull requests.","auth_modes":["public","pat","oauth"],"config":{"type":"github_repository","repository":"owner/repo","include":["readme","security","contributing","manifests","issues","pull_requests"],"max_files":18,"max_chars_per_file":1600}},{"id":"deps-dev-advisories","label":"deps.dev advisory context","category":"Code and findings sources","status":"native","runtime_support":"live","description":"Checks public GitHub Dependency Graph SBOM packages against deps.dev advisory metadata.","auth_modes":["public","pat","oauth"],"config":{"type":"deps_dev_lookup","repository":"owner/repo","include":["sbom_packages","advisories","cvss","aliases"],"max_packages":40,"max_advisories":12}},{"id":"osv-vulnerability-api","label":"OSV.dev vulnerability context","category":"Code and findings sources","status":"native","runtime_support":"live","description":"Checks public GitHub Dependency Graph SBOM package URLs against OSV.dev vulnerability records without a token.","auth_modes":["public","pat","oauth"],"config":{"type":"osv_vulnerability_lookup","repository":"owner/repo","include":["sbom_packages","vulnerabilities","aliases","severity"],"max_packages":40,"max_vulnerabilities":12}},{"id":"mcp-http-gateway","label":"MCP HTTP gateway","category":"MCP and context gateways","status":"native","runtime_support":"live","description":"Calls one configured read-only MCP tool through a CORS-enabled Streamable HTTP gateway endpoint and attaches bounded text context to chat or agent runs.","auth_modes":["none","bearer_token","oauth"],"config":{"type":"mcp_http_gateway","transport":"streamable_http","read_only_tool_pattern":"search|query|list|get|read|find|lookup|fetch|describe|inspect|analyze|scan","max_chars":9000}},{"id":"gitlab-project-context","label":"GitLab project context","category":"Code and findings sources","status":"native","runtime_support":"live","description":"Pulls bounded GitLab project metadata, useful repository files, open issues, and open merge requests directly in the browser for GitLab-centered remediation work.","auth_modes":["public","pat","oauth"],"config":{"type":"gitlab_project_context","base_url":"https://gitlab.com/api/v4","project":"group/project","include":["project","readme","default_branch","issues","merge_requests","vulnerability_findings"],"max_items":20}},{"id":"azure-devops-repository","label":"Azure DevOps repository context","category":"Code and findings sources","status":"native","runtime_support":"live","description":"Pulls bounded Azure DevOps repository metadata, useful repo files, active pull requests, and recent open work items directly in the browser for remediation planning.","auth_modes":["oauth","pat"],"config":{"type":"azure_devops_repository","base_url":"https://dev.azure.com","organization":"YOUR-AZURE-DEVOPS-ORGANIZATION","project":"security-platform","repository":"payments-api","include":["repository","default_branch","readme","security","contributing","manifests","pull_requests","work_items"],"api_version":"7.1","max_files":18,"max_chars_per_file":1600}},{"id":"sarif-manual-import","label":"SARIF upload","category":"Scanner findings","status":"native","runtime_support":"live","description":"Uploads a local SARIF 2.1.0 file in the browser, normalizes the findings, and attaches a bounded summary to prompts and agent runs.","auth_modes":["none"],"config":{"type":"sarif_bundle","source":"local_file","accepted_formats":["sarif-2.1.0-json"],"expected_files":["findings.sarif.json"],"required_fields":["runs[].tool.driver.name","runs[].results[].ruleId","runs[].results[].level"],"normalization":{"severity_map":"sarif_default","max_results":250}}},{"id":"sbom-manual-import","label":"SBOM upload","category":"Scanner findings","status":"native","runtime_support":"live","description":"Uploads a local CycloneDX or SPDX JSON SBOM in the browser and attaches a bounded package, dependency, and vulnerability summary to prompts.","auth_modes":["none"],"config":{"type":"sbom_bundle","source":"local_file","accepted_formats":["cyclonedx-json","spdx-json"],"format_markers":["bomFormat=CycloneDX","spdxVersion"],"normalization":{"max_components":5000,"infer_ecosystem":true}}},{"id":"scanner-export-bundle","label":"Major scanner JSON exports","category":"Scanner findings","status":"native","runtime_support":"live","description":"Uploads major scanner and findings-platform JSON exports in the browser, normalizes them into a bounded summary, and feeds the exposure queue plus downstream reports without any server-side secret handling.","auth_modes":["none"],"config":{"type":"scanner_export_bundle","source":"local_file","accepted_formats":["aws-security-hub-asff","tenable-vulnerability-export","defectdojo-findings-json","generic-findings-array-json"],"normalization":{"max_files":12,"max_findings":1500,"max_sample_findings":12}}},{"id":"wiz-findings-api","label":"Wiz findings API","category":"Scanner findings","status":"template","runtime_support":"planned","description":"Pre-populated browser-side config for pulling cloud and workload findings from Wiz when a customer enables direct API access.","auth_modes":["api_key","oauth"],"config":{"type":"wiz_findings","base_url":"https://api.us1.app.wiz.io/graphql","scopes":["issues:read"],"filters":{"status":["OPEN"],"severity":["CRITICAL","HIGH"]},"pagination":{"page_size":100}}},{"id":"snyk-issues-api","label":"Snyk issues API","category":"Scanner findings","status":"native","runtime_support":"live","description":"Pulls a bounded first page of high-priority Snyk organization issues directly in the browser for scanner-aware triage and remediation planning.","auth_modes":["api_token"],"config":{"type":"snyk_issues","base_url":"https://api.snyk.io/rest","version":"2024-10-15","filters":{"status":["open"],"effective_severity_level":["high","critical"]}}},{"id":"security-hub-api","label":"AWS Security Hub","category":"Scanner findings","status":"template","runtime_support":"planned","description":"Config profile for pulling ASFF findings into remediation reports and downstream workflow packs.","auth_modes":["aws_sigv4"],"config":{"type":"aws_security_hub","region":"us-east-1","filters":{"RecordState":["ACTIVE"],"SeverityLabel":["HIGH","CRITICAL"]}}},{"id":"microsoft-defender-xdr-incidents","label":"Microsoft Defender XDR incidents","category":"Scanner findings","status":"native","runtime_support":"live","description":"Pulls a bounded Microsoft Defender XDR incident sample directly in the browser with local severity and status filters for queueing, reporting, and remediation planning.","auth_modes":["oauth"],"config":{"type":"microsoft_defender_xdr_incidents","base_url":"https://api.security.microsoft.com/api/incidents","scopes":["Incident.Read.All"],"filters":{"status":["Active"],"severity":["High","Medium"]},"pagination":{"top":50}}},{"id":"microsoft-sentinel-incidents","label":"Microsoft Sentinel incidents","category":"Scanner findings","status":"native","runtime_support":"live","description":"Pulls a bounded Microsoft Sentinel workspace incident sample directly in the browser with local severity and status filters for queueing, reporting, and remediation planning.","auth_modes":["oauth"],"config":{"type":"microsoft_sentinel_incidents","base_url":"https://management.azure.com","resource_path":"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents","api_version":"2025-09-01","include":["incidents"],"filters":{"status":["New","Active"],"severity":["High","Medium"]},"pagination":{"top":50}}},{"id":"gitlab-vulnerability-findings","label":"GitLab vulnerability findings","category":"Scanner findings","status":"native","runtime_support":"live","description":"Pulls a bounded first page of GitLab project vulnerability findings directly in the browser when AppSec findings and fix ownership live in the same GitLab namespace.","auth_modes":["pat","oauth"],"config":{"type":"gitlab_vulnerability_findings","base_url":"https://gitlab.com/api/v4","project":"group/project","endpoint":"/projects/:id/vulnerability_findings","filters":{"report_type":["dependency_scanning","sast"],"severity":["high","critical"],"state":["detected","confirmed"]}}},{"id":"crowdstrike-detections","label":"CrowdStrike detections","category":"Scanner findings","status":"template","runtime_support":"planned","description":"Starter config for bounded CrowdStrike Falcon detection intake into browser-side triage and response workflows.","auth_modes":["oauth","api_key"],"config":{"type":"crowdstrike_detections","base_url":"https://api.crowdstrike.com","endpoint":"/detects/queries/detects/v1","filters":{"status":["new","in_progress"],"severity":["high","critical"]}}},{"id":"tenable-vulnerability-management","label":"Tenable vulnerability management","category":"Scanner findings","status":"template","runtime_support":"planned","description":"Starter config for exporting high-severity Tenable vulnerabilities into remediation and report workflows.","auth_modes":["api_key"],"config":{"type":"tenable_vuln_export","base_url":"https://cloud.tenable.com","export_path":"/vulns/export","filters":{"severity":["high","critical"],"state":["OPEN","REOPENED"]}}},{"id":"defectdojo-findings","label":"DefectDojo findings","category":"Scanner findings","status":"template","runtime_support":"planned","description":"Starter config for pulling active high-severity DefectDojo findings with enough context for analyst routing and ticket creation.","auth_modes":["api_token","oauth"],"config":{"type":"defectdojo_findings","base_url":"https://YOUR-DEFECTDOJO-HOST/api/v2","endpoint":"/findings","include":["product","engagement","test","finding"],"filters":{"active":true,"severity":["Critical","High"]}}},{"id":"prisma-cloud-alerts","label":"Prisma Cloud alerts","category":"Scanner findings","status":"template","runtime_support":"planned","description":"Starter config for Prisma Cloud alert intake across posture and runtime findings.","auth_modes":["access_key"],"config":{"type":"prisma_cloud_alerts","base_url":"https://api.prismacloud.io","resource":"/alert","filters":{"policy_severity":["high","critical"],"alert_status":["open"]}}},{"id":"google-cloud-scc-findings","label":"Google Cloud SCC findings","category":"Scanner findings","status":"template","runtime_support":"planned","description":"Starter config for Security Command Center findings when cloud exposures need browser-side triage and routing.","auth_modes":["oauth"],"config":{"type":"google_cloud_scc_findings","base_url":"https://securitycenter.googleapis.com","resource":"organizations/{organizationId}/sources/-/findings","filters":{"state":["ACTIVE"],"severity":["HIGH","CRITICAL"]}}},{"id":"github-code-scanning-alerts","label":"GitHub code scanning alerts","category":"Scanner findings","status":"template","runtime_support":"planned","description":"Starter config for pulling open high-severity GitHub code scanning alerts into browser-side triage and remediation planning.","auth_modes":["pat","oauth"],"config":{"type":"github_code_scanning_alerts","base_url":"https://api.github.com","repository":"owner/repo","endpoint":"/repos/{owner}/{repo}/code-scanning/alerts","filters":{"state":["open"],"severity":["high","critical"]}}},{"id":"semgrep-appsec-findings","label":"Semgrep AppSec findings","category":"Scanner findings","status":"template","runtime_support":"planned","description":"Starter config for bringing bounded Semgrep AppSec findings into browser-side reviewer queues and remediation handoffs.","auth_modes":["api_token"],"config":{"type":"semgrep_appsec_findings","base_url":"https://semgrep.dev/api/v1","resource":"/deployments/{deploymentId}/findings","filters":{"state":["open","triaged"],"severity":["high","critical"]}}},{"id":"sonarqube-issues","label":"SonarQube security issues","category":"Scanner findings","status":"template","runtime_support":"planned","description":"Starter config for pulling open SonarQube vulnerabilities and security hotspots into a browser-local remediation queue.","auth_modes":["api_token"],"config":{"type":"sonarqube_issues","base_url":"https://YOUR-SONARQUBE-HOST/api","endpoint":"/issues/search","filters":{"statuses":["OPEN","CONFIRMED","REOPENED"],"severities":["CRITICAL","BLOCKER"],"types":["VULNERABILITY","SECURITY_HOTSPOT"]}}},{"id":"checkmarx-one-findings","label":"Checkmarx One findings","category":"Scanner findings","status":"template","runtime_support":"planned","description":"Starter config for pulling high-severity Checkmarx One findings into browser-side triage and routed handoff workflows.","auth_modes":["oauth","api_key"],"config":{"type":"checkmarx_one_findings","base_url":"https://ast.checkmarx.net/api","resource":"/findings","filters":{"state":["NEW","TO_VERIFY"],"severity":["HIGH","CRITICAL"]}}},{"id":"veracode-findings","label":"Veracode findings","category":"Scanner findings","status":"template","runtime_support":"planned","description":"Starter config for pulling actionable Veracode findings into a browser-local remediation and reporting workflow.","auth_modes":["api_key"],"config":{"type":"veracode_findings","base_url":"https://api.veracode.com/appsec/v1","resource":"/findings","filters":{"scan_status":["OPEN"],"severity":["HIGH","VERY_HIGH"]}}},{"id":"aws-inspector-findings","label":"AWS Inspector findings","category":"Scanner findings","status":"template","runtime_support":"planned","description":"Starter config for pulling Amazon Inspector findings into browser-side prioritization, reporting, and downstream routing.","auth_modes":["aws_sigv4"],"config":{"type":"aws_inspector_findings","base_url":"https://inspector2.us-east-1.amazonaws.com","resource":"/findings/list","filters":{"finding_status":["ACTIVE"],"severity":["HIGH","CRITICAL"]}}},{"id":"rapid7-insightvm-vulnerabilities","label":"Rapid7 InsightVM vulnerabilities","category":"Scanner findings","status":"template","runtime_support":"planned","description":"Starter config for pulling high-risk Rapid7 InsightVM vulnerabilities into browser-side triage and routing workflows.","auth_modes":["api_key"],"config":{"type":"rapid7_insightvm_vulnerabilities","base_url":"https://console.insight.rapid7.com/api/3","resource":"/vulnerabilities","filters":{"severity":["Severe","Critical"],"status":["active"]}}},{"id":"orca-security-alerts","label":"Orca Security alerts","category":"Scanner findings","status":"template","runtime_support":"planned","description":"Starter config for Orca alert intake when cloud exposure and workload findings need browser-side case and report handling.","auth_modes":["api_token"],"config":{"type":"orca_security_alerts","base_url":"https://api.orcasecurity.io","resource":"/api/alerts","filters":{"state":["open"],"severity":["high","critical"]}}},{"id":"lacework-alerts","label":"Lacework alerts","category":"Scanner findings","status":"template","runtime_support":"planned","description":"Starter config for pulling open high-severity Lacework alerts into browser-side remediation and escalation planning.","auth_modes":["api_key"],"config":{"type":"lacework_alerts","base_url":"https://api.lacework.net","resource":"/api/v2/Alerts/Search","filters":{"status":["Open"],"severity":["High","Critical"]}}},{"id":"confluence-knowledge","label":"Confluence runbook context","category":"Knowledge sources","status":"native","runtime_support":"live","description":"Searches Confluence Cloud pages in the browser to bring internal runbooks, exception notes, and operational context into a scoped agent session.","auth_modes":["api_token","oauth"],"config":{"type":"confluence_search","base_url":"https://YOUR-ATLASSIAN-SITE.atlassian.net/wiki","spaces":["SEC","ENG"],"max_pages":10}}]}