Sysdig Headless Cloud Security plugin
A Sysdig plugin for Claude Code: cloud onboarding, vulnerabilities, risk analysis and runtime threat investigation.
- 62 ★ on the repository
- Last commit
Broad access
Why this level
- The agent connects cloud accounts and reads security data from your environment.
- The terms allow autonomous and semi-autonomous actions based on prompts and policies.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/sysdig-headless-cloud-securityDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent connects cloud accounts and reads security data from your environment.
- The terms allow autonomous and semi-autonomous actions based on prompts and policies.
This is third-party code. Review the repository files before installing.
What it does
The plugin packages Sysdig expertise into agent skills: onboarding cloud environments, vulnerability management, risk analysis and runtime threat investigation. Signals come from a Falco-based runtime layer, so findings rest on deterministic data. All actions are meant to keep humans in control and write a structured log for audit. The user describes a task in plain language: onboard an AWS account, show the highest-risk vulnerabilities in production or investigate an alert. Skills work through the hosted Sysdig MCP server with OAuth. `sysdig-onboarding` and `sysdig-posture` need an API token. Claude Code is the primary agent, and in Amazon Kiro the plugin installs as a power.
Who it is for. Cloud security teams on Sysdig who move onboarding, vulnerability triage and investigations into a conversation with an agent.
Good fit when
- A new AWS account must be onboarded to Sysdig.
- A list of the most dangerous vulnerabilities in production is needed.
- A runtime alert fired and you must understand whether it is exploitable.
- An audit of agent actions with a log is required.
Not a fit when
- The organisation does not use Sysdig.
- A fully autonomous incident response with no human is needed.
- The agent cannot be given access to the cloud environment.
Example request
Show the highest-risk vulnerabilities in production and check whether any are exploited at runtime.Limitations
A Sysdig account is needed, and the hosted MCP server is not part of the plugin and is registered separately with `claude mcp add` using your region URL. `sysdig-onboarding` and `sysdig-posture` need an API token in environment variables, while other skills use OAuth; never paste credentials in chat. The plugin is governed by the Sysdig AI addendum and acceptable use policy and may act semi-autonomously. Python 3 is required by plugin scripts. No licence is stated in the repository.
How to disable. Uninstall the plugin with the Claude Code `/plugin` command, remove the `secure-mcp-server` MCP server with `claude mcp remove` and unset the token from environment variables.
FAQ
Is an API token needed?
Only for `sysdig-onboarding` and `sysdig-posture`, taken from the Sysdig Secure API settings. Other skills use OAuth.
How do I connect the MCP server?
Run `claude mcp add --transport http secure-mcp-server` with your region URL ending in `/mcp/secure`.
Which agents are supported?
Claude Code is primary. Amazon Kiro installs it as a power, and Cursor, Codex and OpenCode can use the bare skills.
What is Falco here?
The runtime layer that provides precise deterministic signals on which skills base their findings.
Does a human control the agent?
The plugin is designed for human control and writes a structured log, but the terms allow semi-autonomous actions.
Discussion
No questions or reviews yet.
Related
PluginsA code security plugin: finds vulnerabilities, challenges its findings, proves exploitability and fixes with a verified patch
A code security audit skill by Cloudflare: the agent runs recon, coverage-led hunting and independent verification of findings, then produces a structured repor
A plugin and approval server for Claude Code and Codex: a risky tool call waits for your decision before it runs
An open set of Claude Code plugins for compliance: findings from cloud and SaaS, gap reports and OSCAL output
An AppSec plugin for Claude Code: secret, dependency and code scanners plus skills that judge whether each finding is real
A pack of about fifty Claude Code subagents for authorized pentesting: planning, recon, exploit research and chaining, post-exploitation, detection and reportin
README in short
The official Sysdig plugin: skills for cloud onboarding, vulnerabilities, risk and investigations based on runtime signals.