> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airmdr.com/llms.txt
> Use this file to discover all available pages before exploring further.
# runZero
> The Pluto Security integration enables AirMDR to authenticate with the Pluto API, retrieve supported security data, and execute supported actions such as issue triage, tagging, and add-on scanning.
To connect AirMDR with Pluto Security to retrieve security information and perform supported investigation and response actions using the Pluto API.
| Component | Supported configuration |
| --------------------- | ---------------------------------------------------------------------------------------------- |
| Pluto Security | Pluto Security cloud platform |
| US tenant | Default tenant; leave **Base URL** empty in AirMDR |
| EU tenant | `https://app.eu.pluto.security` |
| Authentication | Pluto API key |
| Required token prefix | `pluto_` |
| Transport | HTTPS |
| API version | Not displayed in the integration configuration; AirMDR uses the API supported by the connector |
Pluto rejects tokens that do not begin with the `pluto_` prefix.
The integration uses a Pluto API key as the API token.
| Credential | Required | Description | Example |
| ---------- | ----------: | -------------------------------------------------------------------------------------- | ------------------------------- |
| API Token | Yes | Pluto API key generated from the Pluto console. The key must begin with `pluto_`. | `pluto_xxxxxxxxxxxxxxxx` |
| Base URL | Conditional | Required only when connecting to the EU tenant. Leave empty for the default US tenant. | `https://app.eu.pluto.security` |
### API key access
According to the AirMDR configuration guidance, the Pluto API key:
* Authenticates requests to Pluto read endpoints.
* Authorizes supported issue-triage operations.
* Authorizes supported tagging operations.
* Authorizes supported add-on scanning operations.
* Attributes supported write operations to the API key in the Pluto audit log.
- Use a Pluto account authorized to access **Integrations** and manage API keys.
- Restrict API-key generation to approved administrators.
- If Pluto supports configurable key permissions, enable only the permissions required by the AirMDR integration.
- Do not generate the key from a personal account that may be disabled or removed unexpectedly.
- Review all write actions associated with the API key through the Pluto audit log.
## Pre-requisites
>
> An active Pluto Security tenant and access the **Integrations** page in the Pluto console.
>
>
>
> Determine whether your organization uses the US or EU Pluto tenant.
>
Pluto API keys provide access to read endpoints and supported write operations. Generate the key from an appropriately controlled administrative account.
## Setup Steps
1. Sign in to your organization’s Pluto Security console.
2. Open the **Integrations** page.
3. Locate the **Pluto API** section.
4. Select the available option to create a new API key.
The exact create-key button label may vary between Pluto UI versions.
5. If prompted, enter a recognizable name for the key, such as: `AirMDR-Production`.
6. Create the API key.
7. Copy the generated key and store it temporarily in an approved secrets-management system.
8. Verify that the key begins with the required prefix: `pluto_`.
9. Record the key owner, purpose, creation date, and planned rotation date.
Treat the API key as a password. Do not add it to documentation, tickets, source-control repositories, chat messages, or screenshots.
The Base URL is determined by your Pluto tenant region; it is not separately generated.
| Pluto tenant | AirMDR Base URL value |
| ----------------- | ------------------------------- |
| Default US tenant | Leave the field empty |
| EU tenant | `https://app.eu.pluto.security` |
1. Sign in to Pluto Security.
2. Check the hostname displayed in the browser address bar.
3. If the hostname is `app.eu.pluto.security`, use: [https://app.eu.pluto.security](https://app.eu.pluto.security).
4. If your organization uses the default US tenant, leave the **Base URL** field empty in AirMDR.
If your organization uses a custom or different hostname, contact Pluto Support or your Pluto administrator before proceeding.
Do not enter `https://pluto.security` as the Base URL. This is Pluto’s public website, not the tenant value specified for this integration.
## Pluto Credential Reference Table
| AirMDR Field | What to Enter | Where to Get It in the Pluto Security UI | Example |
| :--------------- | :--------------------------------------------------------------------------------------------------- | :----------------------------------------------------------------------------------------- | :------------------------------------------------- |
| **Instance** | A unique name for the Pluto connection | User-defined in AirMDR | `Pluto-Production` |
| **Organization** | The AirMDR organization associated with the integration | Select the appropriate organization from the AirMDR **Organization** list | `AirMDR Organization` |
| **Description** | A brief description of the connection | User-defined in AirMDR | `Pluto Security production integration` |
| **API Token** | The Pluto API key beginning with the `pluto_` prefix | In the Pluto console, navigate to **Integrations → Pluto API**, and create an API key | `pluto_xxxxxxxxxxxxxxxx` |
| **Base URL** | The Pluto tenant URL for an EU-hosted organization. Leave this field empty for the default US tenant | Identify the tenant region from the Pluto console URL displayed in the browser address bar | EU: `https://app.eu.pluto.security`US: Leave empty |
Copy the API key immediately after generating it and store it securely. Do not include the key in documentation, screenshots, source code, or support tickets.
## Validate Connectivity
Use the following request to confirm a read-only Pluto API endpoint to confirm that the Base URL and API token can access the tenant:
```json theme={null}
curl --request GET \
--url "https://app.eu.pluto.security/" \
--header ": pluto_REPLACE_WITH_API_TOKEN" \
--header "Accept: application/json"
```
```json theme={null}
{
"status": "success",
"data": []
}
```
**Validation results**
| Result | Meaning | Recommended action |
| ------------------ | --------------------------------------------- | ------------------------------------------------------- |
| `200 OK` | The Base URL and API token are valid | Save the connection and run a read-only AirMDR skill |
| `401 Unauthorized` | The API token is invalid, expired, or revoked | Generate or enter a valid token beginning with `pluto_` |
| `403 Forbidden` | The token does not have the required access | Review the API-key permissions |
| `404 Not Found` | The endpoint or Base URL is incorrect | Confirm the Pluto API endpoint and tenant region |
| Connection timeout | Pluto cannot be reached from AirMDR | Review DNS, proxy, firewall, and Remote Agent settings |
The response structure above is illustrative. Replace it with the actual response returned by the confirmed Pluto endpoint.
Run credential tests only from an approved administrative system. Do not expose the API token through shell history, screenshots, terminal recordings, or logs.
## Configure Pluto in AirMDR Integrations Dashboard
1. Navigate to [AirMDR](https://app.airmdr.com/auth/login), provide the credentials and click **Login**
2. Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select **ADMIN → Integrations**.
3. Use the search option, enter the keyword "**Pluto**", select the **Connections** tab, and click **+ New Connection** button.
4. Use the following values in the AirMDR integration configuration screen:
| AirMDR field | Required | Description | Example |
| ------------ | ----------: | ---------------------------------------------------- | --------------------------------------- |
| Instance | Yes | Unique name used to identify the connection | `Pluto-Production` |
| Organization | Yes | AirMDR organization associated with the connection | `ASO – AirMDR System Organization` |
| Description | Yes | Short description of the connection’s purpose | `Pluto Security production integration` |
| API Token | Yes | API key generated from the Pluto console | `pluto_xxxxxxxxxxxxxxxx` |
| Base URL | Conditional | EU tenant URL; leave empty for the default US tenant | `https://app.eu.pluto.security` |
1. In **Remote Agent**, select an AirMDR Remote Agent only when the Pluto tenant must be accessed through an approved private network route, proxy, or controlled network environment. For publicly accessible Pluto SaaS tenants, leave this field unselected unless instructed otherwise by your AirMDR administrator.
2. In **Expiry**, select the date on which AirMDR should treat the stored Pluto credentials as expired, according to your organization’s credential-rotation policy.
The **Expiry** date controls credential validity in AirMDR. It does not automatically rotate or revoke the API key in Pluto Security. Generate a replacement key in Pluto, update the AirMDR connection, validate it, and then revoke the previous key.
5. Click **Save**.
## Skills provided by this Integration
These read-only skills retrieve AI asset inventories, discovered tools, and web-domain activity.
| Skill ID | Purpose | Minimum Pluto Role | Required Access |
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------ | ----------------------------------------------------- |
| `get_pluto_inventory` | Retrieves records from Pluto’s AI inventories, including builders, applications, MCP servers, browser extensions, AI assistants, AI models, skills, VPNs, remote-access tools, and packages. | API user with inventory-view access | Read access to the selected Pluto inventory type |
| `get_pluto_discovered_tools` | Retrieves the organization’s discovered-tool catalogue and associated approval tags, including **Approved**, **Rejected**, and **In Review**. | API user with discovered-tool access | Read access to discovered tools and their tags |
| `get_pluto_web_domain_summary` | Summarizes web domains accessed by AI agents, including allowed and blocked activity and unique-user counts. | API user with agent-activity access | Read access to web-domain activity and policy results |
When retrieving inventory for a specific system or user, provide `hostname` or `user_email` to limit the result set.
These skills retrieve Pluto security issues and write investigation outcomes back to Pluto.
| Skill ID | Purpose | Minimum Pluto Role | Required Access |
| ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------- | ------------------------------------------------------------- |
| `get_pluto_issues` | Retrieves Pluto security issues for investigation and supports filtering by duration, status, severity, issue type, server, or entity. | API user with issue-view access | Read access to Pluto issues and affected-host information |
| `update_pluto_issue` | Updates an issue’s status, risk level, or assignees after investigation. | API user authorized to modify issues | Write access to issue status, risk level, and assignee fields |
| `manage_pluto_issue_comment` | Creates, updates, or deletes investigation comments in the Pluto issue timeline. | API user authorized to manage issue comments | Write access to issue comments |
In `update_pluto_issue`, `assignee_emails` and `assignee_ids` replace the existing assignee list. Use `clear_assignees` to remove all existing assignees.
These read-only skills support investigation of AI coding-agent activity and organization-level audit events.
| Skill ID | Purpose | Minimum Pluto Role | Required Access |
| -------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | ----------------------------------------------------- |
| `get_pluto_claude_code_session_events` | Retrieves Claude Code session events, including prompts, tool results, API requests, errors, permission decisions, token usage, and endpoint context. | API user with Claude Code activity access | Read access to Claude Code session events |
| `get_pluto_agentic_tool_hook_events` | Retrieves hook events from supported AI coding tools, including Claude Code, Cursor, Codex, Windsurf, VS Code, and Copilot Studio. | API user with agent-event access | Read access to agent hook events and policy decisions |
| `get_pluto_audit_log` | Retrieves Pluto audit activity such as logins, policy changes, tag updates, integration changes, automation changes, issue updates, and data access. | API user with audit-log access | Read access to the Pluto organization audit log |
Pluto rejects Claude Code session-event and agentic-hook queries with a time window greater than 14 days. Use a duration of `14d` or less.
These skills manage approval tags, inventory metadata, and organization-level business context.
| Skill ID | Purpose | Minimum Pluto Role | Required Access |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------- | -------------------------------------------------------------------- |
| `manage_pluto_tags` | Creates an organization tag or assigns and removes an existing tag from a Pluto entity. | API user authorized to manage tags | Read and write access to organization tags and supported entities |
| `update_pluto_inventory_metadata` | Adds a review comment or updates the risk level of a supported inventory entity. | API user authorized to modify inventory metadata | Write access to inventory comments and supported risk-level fields |
| `get_or_update_pluto_business_context` | Retrieves or replaces the organization’s customer-supplied business description used by Pluto for risk detection and classification. | API user authorized to view or manage organization context | Read access to retrieve context; write access to replace or clear it |
Pluto returns `403 Forbidden` when tagging is disabled for the organization. IDE-extension tags are managed by Pluto and cannot be changed through the API.
**Inventory metadata limitations**
* `risk_level` can be updated only for `builder` and `application` entity types.
* Use `comment` when updating other supported entity types.
* Passing an empty `business_context` value clears the existing business-context field.
* The business-context value is limited to 4,000 characters.
* The Pluto-managed `org_info` field is not modified by the business-context skill.
These skills submit MCP servers or agent skills for scanning and retrieve their results.
| Skill ID | Purpose | Minimum Pluto Role | Required Access |
| ------------------------- | ----------------------------------------------------------------------------------------- | ----------------------------------- | ------------------------------------------------------ |
| `submit_pluto_addon_scan` | Submits an MCP server or agent skill to Pluto Studio for asynchronous security scanning. | API user authorized to submit scans | Write access to Pluto Studio scan-submission endpoints |
| `get_pluto_addon_scan` | Retrieves the status and result of a previously submitted MCP-server or agent-skill scan. | API user with scan-result access | Read access to Pluto Studio scan results |
To view the details of Input Parameters and Output for the respective skills
* Go to [AirMDR → Pluto](https://app.airmdr.com/integrationsv2/cfc50d5f-ee9b-4495-b62f-1d670a760cc1/skills?search=pluto) Integration page.
* Select the **Skills** tab and click on the required listed skills.
### **Permission Summary**
| Access category | Included skills |
| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Read-only API access** | `get_pluto_inventory`, `get_pluto_discovered_tools`, `get_pluto_web_domain_summary`, `get_pluto_issues`, `get_pluto_claude_code_session_events`, `get_pluto_agentic_tool_hook_events`, `get_pluto_audit_log`, `get_pluto_addon_scan` |
| **Conditional read/write access** | `get_or_update_pluto_business_context` |
| **Write access** | `update_pluto_issue`, `manage_pluto_issue_comment`, `manage_pluto_tags`, `update_pluto_inventory_metadata`, `submit_pluto_addon_scan` |
| **Administrative UI approval** | Approval or rejection of completed add-on scans in the Pluto Studio review queue |
## Additional Information
**Recovery procedure**
1. Confirm the Pluto tenant region.
2. Verify that the API token begins with `pluto_`.
3. Confirm that the token has not been revoked or rotated.
4. Review the AirMDR connection configuration.
5. Test a read-only operation.
6. Review AirMDR execution details and the Pluto audit log.
7. Generate a replacement key if the existing key cannot be validated.
8. Contact support if the issue continues.
| Symptom | Likely cause | Recovery |
| ----------------------------------- | --------------------------------------------------- | --------------------------------------------------------------- |
| API token rejected | Token does not begin with `pluto_` | Generate a valid Pluto API key and update the AirMDR connection |
| `401 Unauthorized` | Invalid, expired, rotated, or revoked token | Confirm the active key and replace the stored token |
| `403 Forbidden` | API key or associated account lacks access | Review key permissions and Pluto role assignments |
| Connection fails only for EU tenant | Base URL is missing or incorrect | Enter `https://app.eu.pluto.security` |
| Default US connection fails | An EU Base URL was entered for a US tenant | Remove the Base URL and save the connection again |
| `404 Not Found` | Incorrect tenant URL or unsupported resource | Confirm the tenant region and skill compatibility |
| TLS or certificate error | Proxy, certificate inspection, or trust-store issue | Validate the certificate chain and outbound proxy settings |
| DNS or timeout error | Network or firewall restriction | Permit outbound HTTPS access to the Pluto tenant |
| `429 Too Many Requests` | Pluto API request limit reached | Reduce request frequency and retry with an appropriate delay |
| Read succeeds but write fails | Write access is unavailable or restricted | Review the API key’s permissions and the Pluto audit log |
| Key creation option is unavailable | User role cannot manage API keys | Contact a Pluto administrator |
**Pluto audit log**
Use the Pluto audit log to review supported write operations executed through the API key, including:
* Issue-triage activity.
* Tagging operations.
* Add-on scanning requests.
* Identity or API key associated with the action.
* Timestamp and action status, where available.
The exact navigation path for the audit log may depend on the Pluto UI version and your role.
**AirMDR logs**
Use AirMDR integration and skill-execution records to review:
* Connection-test results.
* Skill execution status.
* Request failures.
* Authentication errors.
* Response codes.
* Retry attempts.
**Illustrative log entries**
The following entries are examples only and do not represent Pluto’s exact log format.
```text theme={null}
INFO Pluto connection validated successfully
INFO Pluto read operation completed status=200
WARN Pluto request temporarily unavailable retry_attempt=1
ERROR Pluto authentication failed status=401
ERROR Pluto authorization failed status=403
```
**Recommended log levels**
| Level | Recommended use |
| :---- | :----------------------------------------------------------------------------- |
| INFO | Successful connection tests, completed requests, and normal operations |
| WARN | Retryable failures, temporary unavailability, or approaching rate limits |
| ERROR | Invalid credentials, authorization failures, and unsuccessful skill executions |
| DEBUG | Temporary troubleshooting only; API tokens must remain redacted |
Never record the API token, authorization header, or complete credential payload in logs.
**✅ Do**
* Use a dedicated API key for AirMDR.
* Apply least-privilege access wherever Pluto supports configurable permissions.
* Store the key in an approved secrets-management system.
* Rotate the API key according to your organization’s security policy.
* Monitor write operations through the Pluto audit log.
* Restrict integration administration to authorized users.
* Test configuration changes with a read-only action first.
* Revoke the API key immediately if exposure is suspected.
* Keep production and non-production credentials separate.
* Review integration access after administrator or employee changes.
**❌ Don’t**
* Sharing the API key through email, Slack, tickets, or documents.
* Storing the token in scripts or source-control repositories.
* Reusing a key assigned to another integration.
* Entering the public `https://pluto.security` website as the API Base URL.
* Using the EU Base URL for a default US tenant.
* Capturing the API token in screenshots or logs.
* Disabling TLS certificate validation.
* Leaving unused or former integration keys active.
* 📧 Contact [**AirMDR Support**](mailto:support@airmdr.com) through your designated support channel.
* 🔁 Rotate credentials regularly. Recommended cadence: Every 90 days or as per internal security policy
* 🔄 **Reconnect in AirMDR immediately when API Keys are changed.**
* Use the official [Pluto Security contact page](https://pluto.security/contact-us/?utm_source=chatgpt.com), Pluto also identifies `info@pluto.security` as a contact address in its published terms.
**Data exchanged**
Depending on the selected AirMDR skill, the integration may exchange:
* Requests for supported Pluto security information.
* Issue and finding identifiers.
* Issue-triage instructions.
* Tags and tag updates.
* Add-on scanning requests.
* Status information and API responses.
* Error codes and troubleshooting details.
The exact fields exchanged depend on the AirMDR skill being executed.
**Encryption**
| Area | Guidance |
| :----------------- | :-------------------------------------------------------------------------------------------------------------- |
| Data in transit | AirMDR connects to Pluto using an HTTPS endpoint. |
| Data at rest | Verify Pluto’s current encryption-at-rest controls through the Pluto Trust Center or your Pluto representative. |
| Credential storage | Store the API token only in AirMDR’s protected credential field and an approved secrets-management system. |
| TLS inspection | Ensure that any proxy or TLS-inspection control does not invalidate the Pluto certificate chain. |
Pluto provides a public [Trust Center](https://trust.pluto.security/?utm_source=chatgpt.com) for security and compliance information. Access to detailed reports may require authorization.
**Ports and endpoints**
| Direction | Protocol and port | Destination |
| :---------------- | :---------------- | :--------------------------------------------------------------------- |
| AirMDR to Pluto | HTTPS/TCP 443 | Organization’s Pluto tenant |
| EU tenant | HTTPS/TCP 443 | `app.eu.pluto.security` |
| Default US tenant | HTTPS/TCP 443 | Tenant endpoint managed by the AirMDR connector when Base URL is empty |
If your organization uses IP allowlisting, a proxy, or restricted outbound access, obtain the current destination information from Pluto or AirMDR Support.