Orca Security
Orca SecurityIT & security
The Orca MCP Server extends Orca's reasoning into Claude, so your team can ask security questions from where the work already happens: Claude.ai in the browser, the Claude desktop app, and Claude Code in the terminal. The MCP Server carries correlated context from Orca's Unified Data Model, not raw data streams. Every asset, alert, identity, and dependency is already stitched together before Claude is asked a question, so answers factor in reachability, blast radius, and business impact from the first response. Tools that stitch sources together at query time return inconsistent, fragmented conclusions. Ask Claude to run in-depth analysis on an alert, query assets, investigate the code origins of a runtime risk, generate an executive readout, or kick off a remediation workflow. All of it happens without leaving Claude. Every response pulls asset, attack path, ownership, and remediation context in a single call, so end users get senior-analyst judgment baked into every answer. For teams that want the reasoning without writing the prompts, Orca maintains the AI Skills Hub, an open-source GitHub repo of agent skills that sits on top of the MCP Server. Analysts type "triage alert orca-9012345" in Claude, and the orca-alert-triage skill handles retrieval, analysis, and formatting. Teams can fork it, modify it, and extend it to their own use cases. The result: security and engineering teams work across cloud, code, and AI from a single workspace, with Claude as the interface and Orca's reasoning behind every answer.
Where it stands
Tools
add_alert_ comment change_alert_ score discovery_search dismiss_alert documentation_search get_alert get_alert_ attack_ path_ data get_alert_ code_ origin get_alert_ timeline get_alerts_ with_ similar_ alert_ type get_alerts_ with_ similar_ malware get_asset_ alerts_ count_ grouped_ by_ risk_ level get_asset_ by_ alert_ id get_asset_ by_ id get_asset_ by_ name get_asset_ crown_ jewel_ info get_asset_ related_ alerts_ summary get_asset_ related_ attack_ paths get_asset_ related_ attack_ paths_ summary get_assets_ with_ similar_ malware get_attack_ path get_aws_ effective_ permissions_ policy_ on_ asset get_business_ units_ data get_cdr_ events_ grouped_ by_ event_ name get_code_ origin get_compliance_ analysis_ by_ account_ or_ business_ unit get_compliance_ framework_ control_ tests get_compliance_ framework_ stats_ for_ asset get_compliance_ trend_ over_ time get_control_ test_ alerts get_control_ test_ assets get_enabled_ compliance_ frameworks get_framework_ assets_ with_ failed_ controls_ count get_integration_ configs_ data get_linked_ entities_ data get_linked_ entities_ mapping get_other_ secret_ occurrences get_recommended_ compliance_ frameworks_ to_ enable get_related_ compliance_ frameworks_ for_ asset get_scm_ posture_ alerts_ on_ asset get_terraform_ chain get_trending_ news mark_asset_ as_ crown_ jewel search_cdr_ events snooze_alert update_alert_ status verify_alert