Connect Orca’s ChatGPT Plugin: Cloud Risk Context in Chat and Codex

What it is

The Orca Security plugin for ChatGPT and Codex connects to Orca's MCP server, which exposes Orca's Unified Data Model (alerts, assets, attack paths, effective IAM permissions, code-to-cloud origins, and Orca docs) as callable tools. It's now live in the ChatGPT and Codex plugin directory.

How it works

When a user asks a question via natural-language prompt (prefixed with @Orca Security in ChatGPT), the model decides which Orca tools to call and in what order — the user doesn't need to know tool names or query syntax. Orca's data is already correlated before the query runs: findings carry reachability, blast radius, and business impact baked in, so the model reasons over pre-joined context rather than raw lists. For alerts specifically, ChatGPT renders an interactive "Orca card" in the chat (with status and action buttons for attack path / affected asset) instead of a text wall, letting an analyst chain follow-up actions without re-prompting. Orca also maintains an open-source "AI Skills Hub" repo with prebuilt agent skills (e.g., orca-alert-triage) that teams can fork for repeatable workflows without writing prompts.

Preconditions / Affected

Requires an existing Orca Security subscription/environment connected to the MCP server; the plugin is installed from the ChatGPT/Codex plugin directory. Developer workflows (Codex) additionally require Codex to have read access to the local repo so it can match Orca's code-origin/Terraform-chain data to actual files.

What to do

Example prompts given on the page, usable as templates:

• Discovery: @Orca Security show the most critical internet-exposed risks in my AWS environment
• CVE triage: @Orca Security find every asset affected by CVE-2025-55182 covered in the news, tell me which ones are internet-facing or hold sensitive data, and draft a remediation plan in priority order
• Alert-to-blast-radius: @Orca Security get alert orca-1234, walk me through its attack path hop by hop, and tell me the blast radius if it's exploited
• Pattern check: @Orca Security find alerts similar to orca-1234 across our environment and tell me whether this looks like a broader campaign
• IAM review: @Orca Security what can arn:aws:iam::123456789012:role/ExampleRole actually do, and which of those permissions are risky?
• Codex fix-in-place: Investigate Orca alerts orca-1636403 and orca-3194767, find the files in this repo that cause them, and prep fixes for my review
• Codex origin trace: Orca flagged asset <asset_id>. Find the code and Terraform that created it, then fix the misconfiguration at the source

Note the CVE example references "CVE-2025-55182" only as sample prompt text illustrating usage, not as a disclosed vulnerability analyzed by the post.

flowchart LR
    A[Natural-language prompt] --> B[Model selects Orca MCP tools]
    B --> C[Orca Unified Data Model:\nalerts, assets, attack paths,\nIAM, code origins]
    C --> D{Alert result?}
    D -->|Yes| E[Interactive Orca card\n+ action buttons]
    D -->|No| F[Text/report answer]
    C --> G[Codex: match to\nTerraform/Dockerfile in repo]
    G --> H[Diff fix for review]

Caveats

This is a vendor product announcement; all use cases and outcomes are Orca's own framing, with no independent benchmarks, pricing, or limitations on tool coverage stated (the page explicitly notes the tool list is "a sample, not the full list" and growing).