---
title: "cast-highlight"
description: "Analyze your application portfolio with CAST Highlight, technical debt, open-source security risk, cloud readiness, and agentic/AI readiness, and trigger new code scans via the CAST Highlight GitHub Action."
canonical: https://agentpluginsdirectory.com/plugins/cast-highlight
last-updated: 2026-10-21
---

# cast-highlight
Analyze your application portfolio with CAST Highlight, technical debt, open-source security risk, cloud readiness, and agentic/AI readiness, and trigger new code scans via the CAST Highlight GitHub Action.
- Slug: cast-highlight
- Publisher: CAST Software
- Repository: https://github.com/CASTHighlight/askcast-kiropower
- Manifest: plugin.json
- Version: 1.1.0
- License: MIT
- Category (editorial): security
- Skills: 4 (getting-started, portfolio-analysis, run-code-scan, security-findings)
- MCP servers: 1 (ask-cast)
- Stars: 1
- Repository created: 2026-09-03
- Repository last pushed: 2026-09-03
- Publisher type: Organization
- Listing: https://agentpluginsdirectory.com/plugins/cast-highlight
- Schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json

## What cast-highlight does, in the publisher's words

Gives Kiro's agent instant, on-demand access to CAST Highlight's application portfolio data, technical debt, open-source security risk, cloud readiness, and agentic/AI readiness, via the CAST Highlight MCP Server, the domain vocabulary to talk about results the way CAST Highlight does (Portfolio Advisor quadrants, Verified/Inferred CVE detection, etc.), and the ability to trigger a fresh scan of a repo via MichaelMULLER/highlight-scan-github-action.

mcp.json now wires up two servers:

- cast-highlight: your existing remote server (unchanged), reads portfolio/scorecard/CVE data
- github: GitHub's official remote MCP server (https://api.githubcopilot.com/mcp/), scoped to the actions and repos toolsets, used only to check/trigger the scan workflow and read run status, not to browse or modify code beyond that
- Open Kiro → Powers panel → Add Custom Power

From the project README, punctuation lightly normalized. Full text: https://raw.githubusercontent.com/CASTHighlight/askcast-kiropower/HEAD/README.md

## Skills

- getting-started: Connect Kiro to the CAST Highlight MCP Server and verify the connection before doing any portfolio analysis
- portfolio-analysis: Analyze an application portfolio with CAST Highlight data, technical debt, cloud readiness, agentic readiness, and Portfolio Advisor positioning
- run-code-scan: Trigger a CAST Highlight scan of a repository using the highlight-scan-github-action, then check the run and pull the refreshed results
- security-findings: Investigate open-source security findings (CVEs) surfaced by CAST Highlight's software composition analysis

Descriptions come from the frontmatter of each SKILL.md, punctuation lightly normalized.

## MCP servers

- ask-cast: transport: stdio; command: npx; url: ${CAST_HIGHLIGHT_MCP_URL}

Read from the plugin's own mcp.json. Environment variable names only, never values.