Composio for SecOps
Give your AI secure access to 71 security tools in minutes
Connect Claude Code, Codex, OpenCode, or your own agent to VirusTotal, Shodan, Okta, Jira and more, with one key. Then watch it go from advice to action.
71
providers
1
API key
0
SDKs
Works with
claude — ~/secops
▐▛███▜▌ ▝▜█████▛▘ ▘▘ ▝▝
Claude Code v2.1
Opus 5.5 · Claude Max
~/secops
> is 45.83.12.7 malicious? check greynoise and abuseipdb
Pondering… (esc to interrupt)
∴ Thought for 2s
⏺ Bash(curl -s $SATU/api/greynoise/lookup_ip \
-H "X-API-Key: $SATU_KEY" -d '{"ip":"45.83.12.7"}')
⎿ Running…
⎿ {"noise":true,"classification":"malicious","last_seen":"2026-09-27"}
⏺ Bash(curl -s $SATU/api/abuseipdb/lookup_ip_address \
-H "X-API-Key: $SATU_KEY" -d '{"ip_address":"45.83.12.7"}')
⎿ Running…
⎿ {"data":{"abuseConfidenceScore":100,"totalReports":412,"countryCode":"NL"}}
⏺ Yes — treat 45.83.12.7 as hostile.
• GreyNoise: malicious scanner, seen yesterday
• AbuseIPDB: 100/100 confidence, 412 reports
Block it at the edge and grep access logs for prior hits.
> Try "hash lookup on virustotal for this sample"
? for shortcuts● only $SATU_KEY in this session
claude — ~/secops
▐▛███▜▌ ▝▜█████▛▘ ▘▘ ▝▝
Claude Code v2.1
Opus 5.5 · Claude Max
~/secops
> should we patch CVE-2024-3400 tonight? note it on SEC-142
Pondering… (esc to interrupt)
∴ Thought for 3s
⏺ Bash(curl -s $SATU/api/nvd/get \
-H "X-API-Key: $SATU_KEY" -d '{"cve_id":"CVE-2024-3400"}')
⎿ Running…
⎿ {"baseScore":10,"baseSeverity":"CRITICAL","cisaExploitAdd":"2024-04-12"}
⏺ Bash(curl -s $SATU/api/epss/score \
-H "X-API-Key: $SATU_KEY" -d '{"cve":"CVE-2024-3400"}')
⎿ Running…
⎿ {"cve":"CVE-2024-3400","epss":"0.95","percentile":"0.99"}
⏺ Bash(curl -s $SATU/api/jira/add_issue_comment \
-H "X-API-Key: $SATU_KEY" -d '{"issue_id_or_key":"SEC-142","comment":"Patch tonight"}')
⎿ Running…
⎿ 201 · comment added to SEC-142
⏺ Yes, patch tonight.
CVSS 10.0, in CISA KEV, and EPSS puts it in the top 1%. Noted on SEC-142.
> Try "hash lookup on virustotal for this sample"
? for shortcuts● only $SATU_KEY in this session
claude — ~/secops
▐▛███▜▌ ▝▜█████▛▘ ▘▘ ▝▝
Claude Code v2.1
Opus 5.5 · Claude Max
~/secops
> jdoe's laptop was stolen. lock the account and kill every session
Pondering… (esc to interrupt)
∴ Thought for 1s
⏺ Bash(curl -s $SATU/api/okta/suspend_user \
-H "X-API-Key: $SATU_KEY" -d '{"user_id":"jdoe@acme.com"}')
⎿ Running…
⎿ 200 · user suspended
⏺ Bash(curl -s $SATU/api/okta/clear_user_sessions \
-H "X-API-Key: $SATU_KEY" -d '{"user_id":"jdoe@acme.com"}')
⎿ Running…
⎿ 204 · all sessions revoked
⏺ Bash(curl -s $SATU/api/jira/add_issue_comment \
-H "X-API-Key: $SATU_KEY" -d '{"issue_id_or_key":"SEC-143","comment":"jdoe locked out"}')
⎿ Running…
⎿ 201 · comment added to SEC-143
⏺ Done. jdoe is locked out.
Account suspended in Okta, every session revoked, and SEC-143 updated.
> Try "hash lookup on virustotal for this sample"
? for shortcuts● only $SATU_KEY in this session
