Sold by: Orca Security CNAPP
Deployed on AWS
AWS Free Tier
Leverage the Orca Security MCP Server to connect your Orca Security Platform to query and act on your cloud security environment in natural language. The MCP Server allows customers to easily leverage their preferred AI assistants, like Claude, Cursor, ChatGPT, with no requirements for custom integrations or dashboards.
4.7
Overview
The Orca Security MCP Server brings your cloud security context directly into the AI tools your teams already use. Built on the Model Context Protocol (MCP), it lets security teams investigate, query, and act on their Orca environment through plain language conversation instead of custom integrations or hand built dashboards. Connect Orca to leading AI assistants and agents, including Claude Code, Claude Desktop, Cursor, and ChatGPT, using secure OAuth 2.0 or API token authentication over a remote HTTP endpoint.
With the Orca MCP Server, your teams can: get unified security context (access alerts, asset details, compliance data, and documentation in one place to simplify investigations and cut through noise); see the cloud in natural language (ask plain language questions about configurations, vulnerabilities, and posture through your LLM of choice); accelerate investigations (pivot from an alert to its related assets, risks, and documentation in seconds); and reduce risk proactively (surface hidden risks and compliance gaps before they become incidents).
Because MCP is an open standard, you can build and scale AI agents that work seamlessly against Orca, from continuous monitoring to automated triage, with every agent running against a consistent, secure interface. Orca supports a continually growing set of tools spanning alerts, assets, discovery, and documentation search.
Highlights
- Natural language cloud security: Ask plain language questions about alerts, assets, vulnerabilities, compliance, and posture, and act on them directly from AI assistants like Claude, Cursor, ChatGPT, and many others.
- Faster investigations, unified context: Pivot from an alert to its related assets, attack paths, risks, and documentation in seconds, with alerts, asset details, and compliance data in one interface.
- Open standard, agent ready: Built on the Anthropic backed Model Context Protocol with secure OAuth 2.0 and API token auth, so you can build and scale AI agents for continuous monitoring and automated triage.
Details
Sold by
Categories
Delivery method
Integration protocol
Type
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Trust Center
Access real-time vendor security and compliance information through their Trust Center powered by Drata or Vanta. Review certifications and security standards before purchase.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
This product is available free of charge. Free subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimensions summary
This listing offers a single pricing dimension: Free (default). You pay nothing to use it, and there are no paid tiers, usage add-ons, or instance sizes to choose from. Billing is measured in units, but the rate is zero. Because only one option exists, there is nothing to scale up or compare. You activate the product without committing to a term or quantity.
Top-of-mind questions for buyers
You activate the product at no charge. Billing is tracked in units, but the rate is zero, so no usage triggers a charge. There are no metered add-ons, seat counts, or resource tiers to monitor. Nothing in your usage causes the cost to rise above zero.
No. The platform uses an agentless approach that reads cloud block storage out-of-band to build a read-only model of your environment. No code runs inside your cloud accounts, so you avoid agent installation, updates, and the resource overhead agents typically add.
The agentless scanning covers Linux and Windows workloads, including cloud VMs, containers, Kubernetes applications, and serverless functions across multiple cloud providers. Because the Free dimension carries no metered limits, coverage is not restricted by a usage cap or paid threshold within this listing.
orca.security+1
Helpful?
Vendor refund policy
No Refund
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
API-Based Agents & Tools
API-Based Agents and Tools integrate through standard web protocols. Your applications can make API calls to access agent capabilities and receive responses.
Additional details
Usage instructions
MCP
GETTING STARTED / SETUP INSTRUCTIONS To get started using the Orca MCP server, follow the instructions below:
Available Tools This MCP server supports the following tools (examples — Orca adds more over time):
- discovery_search - Runs a natural-language search across your cloud environment and returns an app_url deep-link into Orca
- get_alert - Retrieves details for a specific alert
- update_alert_status - Updates an alert's status (open, in_progress, resolved)
- get_alert_attack_path_data - Returns attack-path data for an alert
- get_asset_by_id - Retrieves an asset by its ID
- get_aws_effective_permissions_policy_on_asset - Returns effective AWS permissions on an asset
- documentation_search - Answers questions from the Orca documentation
Prerequisites
- An Orca account and an Orca API token (create one in your Orca account settings)
- Install Node.js and npm (required for the mcp-remote bridge)
Authentication Orca supports OAuth 2.0 (recommended) via the central endpoint https://mcp.orcasecurity.io , and API token auth via your regional endpoint. For token auth, replace YOUR_ORCA_TOKEN with your actual key below. Orca uses the Token prefix (not Bearer).
Claude Desktop Edit the configuration file at:
- macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
- Windows: %APPDATA%\Claude\claude_desktop_config.json Add the below code: { "mcpServers": { "orca": { "command": "npx", "args": [ "mcp-remote", "https://api.orcasecurity.io/mcp ", "--header", "Authorization: Token <YOUR_ORCA_TOKEN>" ] } } }
Cline Cline stores MCP server configurations in a JSON file that can be modified. In the "Installed" tab, choose "Configure MCP Servers" to access the settings file. Add the following: { "mcpServers": { "orca": { "url": "https://api.orcasecurity.io/mcp ", "headers": { "Authorization": "Token <YOUR_ORCA_TOKEN>" }, "disabled": false, "autoApprove": ["discovery_search", "documentation_search"], "timeout": 30 } } }
Rate Limits
- Orca does not publish a fixed per-key request rate limit.
- AI discovery queries run through the MCP server consume Orca AI credits; see AI credits and plans for usage details.
Learn More MCP Docs: https://docs.orcasecurity.io/docs/orca-security-mcp-server
Support
Vendor support
For technical support, log in to your Orca platform and submit a request through the Support portal. For sales or general inquiries, visit
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Agentless Cloud Security in a Single, Complete Platform with 100% Coverage
Agentless Cloud Security in a Single, Complete Platform with 100% Coverage
Agentless Cloud Security in a Single, Complete Platform with 100% Coverage
skyPurple Cloud Managed Service for Orca Security
Customer reviews
Yagmi M.
Orca Makes Shadow Data Risks Obvious with Clear Sensitive Data Discovery
Reviewed on Aug 03, 2026
Review provided by G2
What do you like best about the product?
There was a recurring problem with shadow data: production data getting copied into staging and dev accounts that were nowhere near as locked down, plus data stores nobody even remembered creating. Orca discovers sensitive data across managed, unmanaged, and shadow stores, including files on VMs, containers, and buckets, and then classifies it against categories like PII and payment data. Seeing a forgotten production snapshot sitting in a loosely controlled dev account, and having that tied to how exposed the account was, makes it obvious which copies are genuinely risky versus intentional.
What do you dislike about the product?
A bit of tuning was needed to distinguish sanctioned data copies from the risky ones, since some of the lower-environment data was there on purpose. That said, the configuration was quick to align with our internal workflows.
What problems is the product solving and how is that benefiting you?
It provides real visibility into sensitive data sprawl, including shadow data and misplaced data, so the gap between well-secured production and looser accounts stops being an invisible exposure. It also highlights where AI agents could run into sensitive data they should never be able to touch, turning those risky paths into concrete cleanup work.
Nelson A.
Orca Adds Exposure Context That Makes Host Vulnerability Prioritization Easy
Reviewed on Aug 02, 2026
Review provided by G2
What do you like best about the product?
A lot of attention goes to containers these days, but there are still plenty of VMs and long-lived hosts, and those were exactly where our old scanning was the patchiest. Orca covers them in the same model as everything else, showing which host vulnerabilities sit on internet-facing machines, which are tied to privileged identities, and which are genuinely reachable versus buried behind existing controls. That added context lets us prioritize host patching based on real exposure instead of relying on raw CVSS scores.
What do you dislike about the product?
A couple of the older hosts had the usual configurations that warranted a closer look, but the underlying findings were sound, and the added context made them straightforward to interpret.
What problems is the product solving and how is that benefiting you?
It closed the gap between our modern container coverage and our older VM estate. As a result, host risk is no longer prioritized on severity scores alone, but on how exposed it actually is. It also helps us understand when host and VM risk could affect the infrastructure supporting AI agents, or the systems those agents depend on.
Saran K.
Orcca Delivered Rapid Visibility Into AI Agent Risks
Reviewed on Aug 02, 2026
Review provided by G2
What do you like best about the product?
Our business moves fast. Developers, analysts, and PMs are constantly shipping, and AI agents are woven into many of those workflows. We needed visibility that could keep up with that pace—not a slow rollout that would still be incomplete by the time the next agent went live.
Orcca connected to our cloud account, and within days it gave us a real risk picture, including the AI agents: the identities they run as, the endpoints they expose, and the data they could touch. We didn’t have to chase teams to get a clear understanding of our agent services.
Orcca connected to our cloud account, and within days it gave us a real risk picture, including the AI agents: the identities they run as, the endpoints they expose, and the data they could touch. We didn’t have to chase teams to get a clear understanding of our agent services.
What do you dislike about the product?
The main follow-on work was organizing the findings to match how our teams and business units are structured, including grouping agents by owner and function. That organizational step has made ongoing reviews much clearer for leadership.
What problems is the product solving and how is that benefiting you?
This removed the usual deployment barrier and gave us AI agent visibility before we could normally even finish planning the rollout. That speed matters even more as agents and their workflows appear across the state, because they become visible and governable as quickly as teams create them.
Cathrine S.
Orca’s Attack Path View Transformed How We Prioritize Fixes
Reviewed on Jul 29, 2026
Review provided by G2
What do you like best about the product?
The thing that really changed how we work is the attack path view. Instead of a list of separate findings, Orca shows the full chain: an exposed asset, the vulnerability on it, the identity it can assume, and the sensitive data at the end of that path. Seeing the entire route makes it obvious which single fix can break the whole chain, so we stopped trying to patch everything and started cutting the links that actually matter.
What do you dislike about the product?
In a large environment, the attack path graphs can hold a lot of detail, so we found it most effective to scope to the crown jewel assets first. Once we did that, the overall picture became clear and genuinely useful.
What problems is the product solving and how is that benefiting you?
It moved us from simply counting vulnerabilities to reasoning about exploitable routes, which is a much better use of a small team’s time. It’s especially valuable when AI agents sit somewhere along that route, because we can see how the agents access identities and how the data paths factor into the real chain an attacker could follow. As a result, we fix fewer things, but we reduce the more real risk.
Kishore K.
Orca Uncovered Hidden Malware and Suspicious Workflows Our Other Tools Missed
Reviewed on Jul 29, 2026
Review provided by G2
What do you like best about the product?
Orca flagged malicious files and suspicious workflows across our workloads that none of our other tooling had caught, including scenarios where an abused AI agent could have been used to plant or trigger malware. It goes beyond simple hash matching, picking up things like cryptominers and web shells that agents might deploy or invoke as part of a compromised toolchain. Because scanning happens off the workload at the storage and configuration layer, there’s nothing for the malware to hide from on the box itself, and it also covers hosts and agent-linked paths we never would have pointed a dedicated scanner at.
What do you dislike about the product?
We aligned the Orca agent-aware malware and threat findings with our existing endpoint response processes, which helped us fold that context smoothly into the way the team already operates.
What problems is the product solving and how is that benefiting you?
It gave us malware and abuse visibility across our cloud workloads and the agent paths that were previously blind spots. We can see not just that malware exists, but how AI agents could be used to deploy or spread it, and then cut those routes off.