Contents

Use

AI narratives and assistants

Risk narratives

On a finding, Generate narrative (engineers and above) asks an AI model for a plain-English summary of the attack path, business impact and remediation status, for readers who aren't engineers.

  • Narratives are labelled AI-generated, cite the finding they describe, and record the model and region used.
  • The model sees only facts Akesis already holds about the finding (advisory text, package and versions, exploit signals, status, fix pull request). Never your source code.
  • Requests run on Amazon Bedrock, in the region for your organisation's data residency (EU organisations in the EU), and aren't used to train models.
  • If AI isn't enabled or is unavailable, only narratives pause; everything else carries on. Settings → AI features shows the status.

Ask your AI assistant about your backlog (MCP)

Akesis is a remote MCP server, so Claude, ChatGPT, Cursor, VS Code and other assistants that speak the Model Context Protocol can read your backlog. It is read-only: assistants can list and read findings, the backlog summary, repositories, autonomy policies, the emergency-stop state, fix pull requests and the audit log, and verify the audit chain. They can't change policies, merge, stop or resume, close findings or administer anything.

Apps that sign in (claude.ai, ChatGPT and similar): add https://akesis.app/mcp as a connector in the app. You sign in with your usual company sign-in and approve the app on a consent screen. Settings → Connected apps lists the apps you've approved; Disconnect stops one at once.

Tools that take a token (Claude Code, Cursor, VS Code): in Settings → AI assistants (MCP), Create token, choose its scopes and expiry (at most a year), and copy it; it's shown once. The page gives ready-made setup for each tool. You can have up to 10 active tokens and revoke any of them.

An assistant can never do more than you can: it has the lower of its scopes and your current role, and disabling your account stops it immediately. Admins can list and revoke every token and connected app in the organisation through Akesis's API (there's no screen for it yet). Scanner text (titles, descriptions) reaches assistants marked as untrusted, and every call is recorded in the audit log.