Rapid7 Bulk Export MCP
Rapid7 Bulk Export MCP
Rapid7 Command Platform 데이터를 MCP(Model Context Protocol) 및 AgentSkills와 함께 사용하여 AI 기반 분석을 지원합니다.
이 도구는 최선의 노력(best effort) 지원입니다. 이 도구를 활용할 도구와 워크플로우는 맞춤형이고 끊임없이 변화하기 때문에 MCP 코드 및 AgentSkill 콘텐츠 외부에서는 지원이나 안내를 제공할 수 없습니다.
이 도구는 무엇인가?
이 도구는 Rapid7 Bulk Export API를 통해 Rapid7 Command Platform에서 데이터를 내보내고 GenAI 및 에이전틱(Agentic) 워크플로우에서 쿼리할 수 있게 만듭니다.
MCP Server: 데이터를 가져오고 처리하며 쿼리할 수 있는 도구를 내장합니다.
Agent Skill / Kiro Power: MCP 도구 사용 방법에 대한 추가 컨텍스트, 스키마 지식 및 지침을 제공합니다.
DuckDB Database: 구조화된 빠른 쿼리를 지원하는 로컬 파일 기반 데이터베이스입니다.
Related MCP server: Rapid7 Bulk Export MCP Server
기능
AI 기반 분석: Kiro, Claude Desktop 또는 MCP 호환 AI 어시스턴트와 함께 사용할 수 있습니다.
온디맨드 데이터 로딩: Rapid7에서 자동으로 데이터를 가져와 로드합니다.
내보내기 재사용: 같은 날짜의 내보내기를 자동으로 재사용하여 중복 API 호출을 방지합니다.
자연어 쿼리: 일반 영어로 질문할 수 있습니다.
SQL 쿼리 실행: 취약점, 자산 및 기타 데이터에 대해 복잡한 SQL 쿼리를 실행할 수 있습니다.
스키마 탐색: 사용 가능한 데이터 필드를 탐색합니다.
통계 및 인사이트: 요약 및 분포를 즉시 확인할 수 있습니다.
보안 잠금: 사용자 쿼리는 샌드박스 처리됩니다. DuckDB 엔진 수준에서 파일시스템 및 네트워크 액세스가 차단됩니다.
Docker 지원: 원격 또는 공유 배포를 위한 컨테이너화된 HTTP 서비스로 실행할 수 있습니다.
로컬 vs 원격
설정에 따라 MCP 서버를 두 가지 모드로 실행할 수 있습니다.
로컬(stdio) — AI 클라이언트가 서버를 하위 프로세스로 생성하고 stdin/stdout을 통해 통신합니다. 이는 기본적이고 가장 간단한 옵션입니다. 서버는 사용자 머신에서 실행되고 데이터베이스는 그 옆에 있으며 모든 것이 로컬에 유지됩니다. 워크스테이션이나 노트북에서 개인적으로 사용할 때 가장 적합합니다.
원격(Docker / streamable HTTP) — 서버는 단일 /mcp 엔드포인트를 노출하는 컨테이너화된 HTTP 서비스로 실행됩니다. 클라이언트는 URL을 통해 네트워크로 연결됩니다. 공유 환경, 팀 사용 또는 AI 도구와 분리된 전용 인프라에서 서버를 실행하려는 경우에 가장 적합합니다. 이 경우 원격 MCP의 모든 사용자 간에 데이터가 공유될 수 있으므로 /mcp 엔드포인트를 인증하고 보호해야 합니다.
두 모드 모두 동일한 MCP 도구와 보안 제어를 사용합니다. 유일한 차이점은 클라이언트 연결 방식입니다.
빠른 시작
0. Rapid7 API 키 및 리전 가져오기
시작하기 전에 Rapid7 Insight Platform 계정의 자격 증명이 필요합니다.
API 키 생성:
중요: API 키는 플랫폼 관리자(Platform Admin) 가 생성해야 합니다. 벌크 내보내기 API는 플랫폼 전체의 모든 취약점 데이터를 반환하므로 관리자 수준 액세스가 필요합니다.
Rapid7 Insight Platform에 플랫폼 관리자로 로그인합니다.
Administration → API Key Management로 이동합니다.
키 유형을 선택합니다.
조직 키(Organization Key) (권장): 전체 관리자 권한(플랫폼 관리자 역할 필요)
사용자 키(User Key): 계정 권한을 상속합니다. 벌크 내보내기에 충분한 액세스 권한을 가지려면 플랫폼 관리자가 생성해야 합니다.
"Generate New Admin Key"(또는 플랫폼 관리자 계정을 사용하는 경우 "Generate New User Key")를 클릭합니다.
조직을 선택하고 키 이름을 지정합니다.
키를 즉시 복사하세요. 다시 볼 수 없습니다!
리전 찾기:
리전에 따라 사용할 API 엔드포인트가 결정됩니다. 리전을 찾으려면:
insight.rapid7.com으로 이동하여 로그인합니다.
오른쪽 상단의 계정 이름 아래에서 "Data Storage Region" 태그를 찾습니다.
자세한 내용은 다음을 참조하세요:
1. AI 도구 설정
아래에서 AI 도구를 선택하세요. 각 가이드는 MCP 서버 설치, Agent Skill 추가, 연결 확인 과정을 안내합니다.
API 키 보안:
RAPID7_API_KEY를 디스크에 평문으로 저장하지 마세요. 런타임에 키를 주입하려면 비밀 관리자를 사용하세요. 예를 들어 1Password CLI, Bitwarden CLI, macOS Keychain, Windows Credential Manager, PowerShell SecretManagement 등을 사용할 수 있습니다. 1Password를 사용하는 경우"command": "op"및"args": ["run", "--", "rapid7-mcp-server"]를 env 블록의op://시크릿 참조와 함께 설정할 수 있습니다. 키는 볼트에서 확인되며 구성 파일에 기록되지 않습니다. 사용 중인 비밀 관리자에 맞게 이 패턴을 조정하세요.
MCP 서버 설치
Claude Desktop을 열고 Customize → Connectors로 이동합니다.
커넥터 디렉터리에서 "Rapid7 Bulk Export"를 검색합니다.
Install을 클릭하고 프롬프트가 표시되면
RAPID7_API_KEY및RAPID7_REGION을 입력합니다.

Agent Skill 설치
Customize -> Skills로 이동합니다.
(+)를 클릭합니다.
Create Skill을 클릭합니다.
Upload Skill을 클릭합니다.
오른쪽 릴리스에서 최신 스킬 zip 파일을 업로드합니다.

확인
실행:
/rapid7-bulk-export-analysis-expert Load the latest vulnerability data from Rapid7
MCP 서버 설치
# Using uv
uv pip install git+https://github.com/rapid7/rapid7-bulk-export-mcp.git
# Or using pip
pip install git+https://github.com/rapid7/rapid7-bulk-export-mcp.git구성
.kiro/settings/mcp.json을 생성하거나 편집합니다.
{
"mcpServers": {
"rapid7-bulk-export": {
"command": "rapid7-mcp-server",
"args": [],
"env": {
"RAPID7_API_KEY": "your-api-key-here",
"RAPID7_REGION": "your-region"
}
}
}
}Agent Skill 설치
Kiro Skills 패널을 엽니다(Command Palette → "Kiro: Open Skills").
"Install from GitHub"를 클릭합니다.
리포지토리 URL을 입력합니다:
https://github.com/rapid7/rapid7-bulk-export-mcp/rapid7-bulk-export-skill
채팅에서 #rapid7-bulk-export-skill로 스킬을 활성화합니다.
확인
MCP 서버를 다시 시작하거나 연결을 다시 설정합니다(Command Palette → "MCP: Reconnect All Servers").
MCP 패널에서 "rapid7-bulk-export" 서버를 확인합니다("Connected"로 표시되어야 함).
실행:
#rapid7-bulk-export-skill Load the latest vulnerability data from Rapid7
MCP 서버 설치
# Using uv
uv pip install git+https://github.com/rapid7/rapid7-bulk-export-mcp.git
# Or using pip
pip install git+https://github.com/rapid7/rapid7-bulk-export-mcp.git구성
Claude Code CLI를 사용합니다:
claude mcp add --transport stdio \
--env RAPID7_API_KEY=your-api-key-here \
--env RAPID7_REGION=your-region \
rapid7-bulk-export \
-- rapid7-mcp-server또는 ~/.claude.json(사용자 범위) 또는 .mcp.json(프로젝트 범위)을 직접 편집합니다:
{
"mcpServers": {
"rapid7-bulk-export": {
"command": "rapid7-mcp-server",
"args": [],
"env": {
"RAPID7_API_KEY": "your-api-key-here",
"RAPID7_REGION": "your-region"
}
}
}
}프로젝트 간 액세스에는 --scope user를, 팀 공유에는 --scope project를 사용합니다.
Agent Skill 설치
# User-level (available in all projects)
mkdir -p ~/.claude/skills/rapid7-bulk-export
curl -sL https://raw.githubusercontent.com/rapid7/rapid7-bulk-export-mcp/main/rapid7-bulk-export-skill/SKILL.md \
-o ~/.claude/skills/rapid7-bulk-export/SKILL.md
# Or project-level (only in current project)
mkdir -p .claude/skills/rapid7-bulk-export
curl -sL https://raw.githubusercontent.com/rapid7/rapid7-bulk-export-mcp/main/rapid7-bulk-export-skill/SKILL.md \
-o .claude/skills/rapid7-bulk-export/SKILL.md또는 npx skills를 사용하여 직접 설치합니다:
npx skills install https://github.com/rapid7/rapid7-bulk-export-mcpClaude Code는 관련 작업에서 스킬을 자동으로 검색하여 사용합니다.
확인
Claude Code를 다시 시작하거나 창을 새로고침합니다.
채팅에서
/mcp를 입력하여 서버 상태를 확인합니다.목록에 "rapid7-bulk-export"가 표시되는지 확인합니다.
실행:
Load the latest vulnerability data from Rapid7
MCP 서버 설치
# Using uv
uv pip install git+https://github.com/rapid7/rapid7-bulk-export-mcp.git
# Or using pip
pip install git+https://github.com/rapid7/rapid7-bulk-export-mcp.git구성
VS Code에서 MCP 설정을 편집합니다.
Command Palette 사용: "MCP: Edit Configuration"
또는 직접 편집:
.vscode/mcp.json(워크스페이스) 또는 사용자 설정
{
"mcpServers": {
"rapid7-bulk-export": {
"command": "rapid7-mcp-server",
"args": [],
"env": {
"RAPID7_API_KEY": "your-api-key-here",
"RAPID7_REGION": "your-region"
}
}
}
}Agent Skill 설치
# Project-level (recommended, stored in repository)
mkdir -p .github/skills/rapid7-bulk-export
curl -sL https://raw.githubusercontent.com/rapid7/rapid7-bulk-export-mcp/main/rapid7-bulk-export-skill/SKILL.md \
-o .github/skills/rapid7-bulk-export/SKILL.md
# Or user-level (available across all projects)
mkdir -p ~/.copilot/skills/rapid7-bulk-export
curl -sL https://raw.githubusercontent.com/rapid7/rapid7-bulk-export-mcp/main/rapid7-bulk-export-skill/SKILL.md \
-o ~/.copilot/skills/rapid7-bulk-export/SKILL.md또는 npx skills를 사용하여 직접 설치합니다:
npx skills install https://github.com/rapid7/rapid7-bulk-export-mcp스킬을 슬래시 명령으로 사용합니다: /rapid7-bulk-export.
확인
VS Code 창을 새로고침합니다.
상태 표시줄이나 출력 패널에서 MCP 상태를 확인합니다.
실행:
Load the latest vulnerability data from Rapid7
MCP 서버 설치
# Using uv
uv pip install git+https://github.com/rapid7/rapid7-bulk-export-mcp.git
# Or using pip
pip install git+https://github.com/rapid7/rapid7-bulk-export-mcp.git구성
Codex CLI를 사용하여 서버를 추가합니다:
codex mcp add rapid7-bulk-export \
--env RAPID7_API_KEY=your-api-key-here \
--env RAPID7_REGION=your-region \
-- rapid7-mcp-server또는 ~/.codex/config.toml을 직접 편집합니다:
[mcp_servers.rapid7-bulk-export]
command = "rapid7-mcp-server"
args = []
enabled = true
[mcp_servers.rapid7-bulk-export.env]
RAPID7_API_KEY = "your-api-key-here"
RAPID7_REGION = "your-region"하드코딩 대신 셸의 환경 변수를 사용하려면:
[mcp_servers.rapid7-bulk-export]
command = "rapid7-mcp-server"
args = []
enabled = true
env_vars = ["RAPID7_API_KEY", "RAPID7_REGION"]확인
구성된 서버 목록:
codex mcp list서버 세부 정보 확인:
codex mcp get rapid7-bulk-export실행:
Load the latest vulnerability data from Rapid7
MCP 서버 설치
# Using uv
uv pip install git+https://github.com/rapid7/rapid7-bulk-export-mcp.git
# Or using pip
pip install git+https://github.com/rapid7/rapid7-bulk-export-mcp.git구성
Antigravity MCP 구성 파일을 편집합니다.
macOS/Linux:
~/.gemini/antigravity/mcp_config.jsonWindows:
C:\Users\<USERNAME>\.gemini\antigravity\mcp_config.json
Antigravity Agent 패널 → "..." → MCP Servers → Manage MCP Servers → View raw config에서도 이 파일에 액세스할 수 있습니다.
mcp_config.json에 다음을 추가합니다:
{
"mcpServers": {
"rapid7-bulk-export": {
"command": "rapid7-mcp-server",
"args": [],
"env": {
"RAPID7_API_KEY": "your-api-key-here",
"RAPID7_REGION": "your-region"
}
}
}
}확인
변경 사항을 적용하려면 Antigravity를 다시 시작합니다.
MCP Servers 패널을 엽니다("..." 메뉴 → MCP Servers).
"rapid7-bulk-export"가 사용 가능한 도구와 함께 표시되는지 확인합니다.
실행:
Load the latest vulnerability data from Rapid7
Docker 이미지
Python 3.12.13이 사전 설치된 Red Hat UBI 10 Python 3.12 Minimal 기본 이미지를 사용합니다. 읽기 전용 파일시스템 작업을 지원합니다. Red Hat 구독은 필요 없습니다.
빌드 및 실행
docker compose 사용(권장):
RAPID7_API_KEY=your-key RAPID7_REGION=us docker compose up -ddocker run 사용:
# Build
docker build -t rapid7-bulk-export-mcp .
# Run with read-only filesystem
docker run -d \
-p 8000:8000 \
-e RAPID7_API_KEY=your-api-key-here \
-e RAPID7_REGION=us \
-e DATA_DIR=/data \
-e TMPDIR=/tmp \
-v rapid7-data:/data \
--tmpfs /tmp \
--read-only \
--security-opt no-new-privileges:true \
--name rapid7-bulk-export-mcp \
rapid7-bulk-export-mcpMCP 클라이언트 구성
MCP 호환 클라이언트를 HTTP 엔드포인트로 지정합니다:
{
"mcpServers": {
"rapid7-bulk-export": {
"url": "http://localhost:8000/mcp"
}
}
}Agent Skill 설치
위의 특정 AI 도구에 대한 스킬 설치 방법을 따르세요. 스킬은 MCP 서버가 로컬이든 원격이든 동일하게 작동합니다.
확인
컨테이너가 실행 중인지 확인합니다:
docker ps엔드포인트 테스트:
curl http://localhost:8000/mcpAI 도구를 연결하고 실행:
Load the latest vulnerability data from Rapid7
2. 분석 시작
참고: 첫 번째 내보내기는 조직 규모에 따라 1-5분 정도 걸립니다. 완료되면 데이터가 캐시되고 이후 로드는 동일한 내보내기를 재사용합니다. 최신 데이터를 얻으려면 언제든지 데이터 새로고침을 요청할 수 있습니다.
Show me the top 10 critical vulnerabilities with known exploitsWhat's the severity distribution across my cloud assets?도구 참조
start_rapid7_export
Rapid7 서버에서 새 내보내기 작업을 시작합니다. 내보내기 ID와 함께 즉시 반환됩니다. vulnerability, policy, remediation의 세 가지 내보내기 유형을 지원합니다.
Start a vulnerability export from Rapid7check_rapid7_export_status
내보내기 작업의 현재 상태를 확인하기 위해 Rapid7 API를 한 번 호출합니다. start_rapid7_export 이후에 데이터가 준비되었는지 확인할 때 사용합니다.
Check the status of export abc-123download_rapid7_export
완료된 내보내기의 Parquet 파일을 다운로드하여 로컬 DuckDB 데이터베이스에 로드합니다. 이 시점부터 데이터를 쿼리할 수 있습니다.
Download and load export abc-123load_rapid7_parquet
기존 Parquet 파일을 디스크에서 직접 로드합니다(~/.rapid7_mcp/imports/ 내에 있어야 함). 이미 내보낸 파일이 있고 API 호출을 건너뛰려는 경우 유용합니다.
Load parquet files from ~/.rapid7_mcp/imports/my-export/query_rapid7
로드된 데이터에 대해 SQL을 실행합니다. 로드 후 연결은 잠금 처리됩니다. 파일시스템 읽기/쓰기 및 네트워크 액세스는 모두 DuckDB 엔진 수준에서 차단됩니다.
사용 가능한 테이블: assets, vulnerabilities, policies, vulnerability_remediation.
Run: SELECT severity, COUNT(*) FROM vulnerabilities GROUP BY severityget_rapid7_schema
로드된 모든 테이블의 열 이름과 데이터 유형을 반환합니다. 쿼리를 작성하기 전에 사용 가능한 필드를 이해하는 데 사용합니다.
Show me the schema of the loaded dataget_rapid7_stats
요약 통계를 반환합니다. 행 수, 심각도 분포, CVSS 점수 범위, 악용 횟수, 클라우드 공급자 분석 등을 포함합니다.
Give me an overview of the vulnerability datalist_rapid7_exports
최근 내보내기 기록을 ID, 날짜, 상태, 행 수와 함께 표시합니다. 다시 로드할 이전 내보내기를 찾는 데 유용합니다.
List my recent exportspurge_rapid7_data
취약점 데이터베이스와 내보내기 추적 데이터베이스를 모두 디스크에서 영구적으로 삭제합니다. 분석이 끝났거나 머신을 인계하기 전에 사용합니다.
Purge all local Rapid7 data아키텍처
graph TB
subgraph "AI Layer"
LLM[LLM/AI Assistant<br/>Copilot, Kiro, Claude Desktop, etc.]
end
subgraph "Rapid7 Bulk Export MCP Tool"
MCP[MCP Server<br/>rapid7-bulk-export]
Skill[Agent Skill / Power<br/>rapid7-bulk-export-skill]
end
subgraph "Data Layer"
DB[(DuckDB<br/>rapid7_bulk_export.db)]
Tracker[(Export Tracker<br/>rapid7_bulk_export_tracking.db)]
end
subgraph "Rapid7 API"
R7[Rapid7 Bulk Export API<br/>/export/graphql ]
end
LLM <-->|Model Context Protocol| MCP
LLM -.->|Enhanced Context| Skill
MCP -->|SQL Queries| DB
MCP -->|Track Exports| Tracker
MCP -->|Fetch Data| R7
R7 -->|Parquet Files| MCP
MCP -->|Load Data| DB
style LLM fill:#e1f5ff
style MCP fill:#fff4e1
style Skill fill:#f0e1ff
style DB fill:#e8f5e9
style Tracker fill:#e8f5e9
style R7 fill:#ffe1e1개발
AgentSkill 및 MCP 변경 사항은 로컬에서 수행하여 환경에 맞게 조정할 수 있습니다. 이 리포지토리로의 기여는 언제나 환영합니다.
클론 및 설치
git clone https://github.com/rapid7/rapid7-bulk-export-mcp.git
cd rapid7-bulk-export-mcp
uv sync개발용 구성
.kiro/settings/mcp.json을 생성하거나 편집합니다:
{
"mcpServers": {
"rapid7-bulk-export": {
"command": "/absolute/path/to/rapid7-bulk-export-mcp/.venv/bin/rapid7-mcp-server",
"args": [],
"env": {
"RAPID7_API_KEY": "your-api-key-here",
"RAPID7_REGION": "your-region",
"DATA_DIR": "/Users/you/.rapid7-mcp"
}
}
}
}참고:
command를cwd와 함께uv run을 사용하는 대신 venv 진입점에 직접 지정하세요. Claude Desktop은 MCP 서버를 시작할 때 작업 디렉터리를 보장하지 않으므로,uv run은 로컬 소스 대신 캐시되거나 시스템에 설치된 패키지 버전을 사용하게 될 수 있습니다.
테스트 실행
uv run pytest환경 변수
변수 | 필수 | 기본값 | 설명 |
| 예 | — | Rapid7 InsightVM API 키 |
| 예 |
| API 지역: |
| 아니요 |
| 데이터베이스 파일용 디렉터리입니다. 쓰기 가능해야 합니다. 수동 parquet 가져오기는 |
| 아니요 |
| 전송 프로토콜: |
| 아니요 |
| HTTP 바인드 주소 ( |
| 아니요 |
| HTTP 포트 ( |
Available Tools
9 toolscheck_rapid7_export_statusCheck Rapid7 Export StatusARead-onlyIdempotent
Check the current status of a Rapid7 export job.
This is a fast, non-blocking call that queries the Rapid7 API once and returns the current status. Does NOT poll or wait.
| Name | Required | Description | Default |
|---|---|---|---|
| export_id | Yes | The export ID returned by start_rapid7_export. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds useful context beyond annotations by specifying it is a fast, non-blocking call that queries the API once and does not poll or wait, which clarifies the operational behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences, front-loaded with the purpose and followed by the key non-polling behavior. Every word earns its place and there is no redundant content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple: one parameter, full schema coverage, rich annotations, and an output schema present. The description adds the crucial behavioral guarantee of non-polling. Nothing material is missing for an agent to select and invoke this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the sole parameter export_id is already fully documented in the schema. The tool description does not add additional parameter meaning, but the baseline of 3 is appropriate when the schema carries the full load.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Check the current status of a Rapid7 export job.' It clearly differentiates itself from sibling tools by emphasizing this is a status check and by noting 'Does NOT poll or wait,' which distinguishes it from any waiting/polling or export-starting workflow.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool: when you need the current status without blocking or waiting. However, it does not explicitly name alternatives or state conditions for when not to use it, such as 'if you need to wait for completion, use start_rapid7_export' or 'use download_rapid7_export when ready.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
download_rapid7_exportDownload Rapid7 ExportAIdempotent
Download a completed Rapid7 export and load into the database.
Call this after check_rapid7_export_status confirms the export is COMPLETE. Downloads the Parquet files and loads them into the local DuckDB database for querying.
| Name | Required | Description | Default |
|---|---|---|---|
| export_id | Yes | The export ID of a completed export. | |
| export_type | No | Type of export. One of "vulnerability", "policy", or "remediation". | vulnerability |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that this tool downloads Parquet files and loads them into the local DuckDB database for querying, which adds side-effect context beyond the annotations. It also states the completion prerequisite. It does not detail overwrite behavior or failure handling, but idempotentHint and destructiveHint already cover safety expectations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and front-loaded with the core purpose. There is mild redundancy between the first sentence and the final sentence, both saying the export is loaded into a database, but overall every sentence carries useful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the key invocation context: call after status is COMPLETE, download Parquet files, and load into DuckDB for querying. With a complete input schema and an output schema present, an agent has enough information to invoke it correctly. The only notable gap is the relationship to load_rapid7_parquet.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema fully documents both parameters with clear descriptions, so the baseline is 3. The description adds no extra parameter-level meaning beyond restating 'completed export,' which the schema already includes.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb and resource: 'Download a completed Rapid7 export' and 'load into the database.' It is distinct from siblings like start_rapid7_export or check_rapid7_export_status, but it does not explicitly differentiate itself from load_rapid7_parquet, since both involve loading Parquet into DuckDB.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says to call this after check_rapid7_export_status confirms the export is COMPLETE, giving clear timing guidance. It does not mention when not to use it or point to alternatives such as load_rapid7_parquet, but the prerequisite is concrete and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_rapid7_schemaGet Rapid7 SchemaARead-onlyIdempotent
Get the schema of all database tables.
Returns column names and data types for all existing tables: assets, vulnerabilities, policies, and vulnerability_remediation. Tables that have not been loaded yet are omitted.
Use this to understand what data is available before writing queries.
Returns: Table schemas as formatted JSON, keyed by table name
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the tool read-only, idempotent, and non-destructive. The description adds meaningful behavior beyond annotations: tables not yet loaded are omitted, and schemas are returned as formatted JSON keyed by table name. No contradiction exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, well-structured, and front-loaded with the core action. Every sentence adds useful information: scope, included tables, omission behavior, and usage intent. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only schema tool with an output schema and rich annotations, the description covers everything needed: what it returns, which tables, the omission nuance, and how to use it. Nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the description does not need to document parameter behavior. The baseline of 4 applies because the schema already fully covers the empty parameter set.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource: 'Get the schema of all database tables,' then enumerates exactly which tables are included. This makes the tool's scope unambiguous and distinguishes it from query/stats/export tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly tells the agent when to use the tool: 'Use this to understand what data is available before writing queries.' It does not discuss exclusions or compare against alternatives, but given the sibling set, no other tool claims schema discovery, so the guidance is adequate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_rapid7_statsGet Rapid7 StatisticsARead-onlyIdempotent
Get summary statistics for all database tables.
Returns row counts and relevant distributions for all existing tables: assets, vulnerabilities, policies, and vulnerability_remediation. Tables that have not been loaded yet are omitted.
Useful for getting an overview of the data across all loaded datasets.
Returns: Summary statistics as formatted JSON, keyed by table name
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it readOnly, idempotent, and non-destructive. The description adds meaningful behavior beyond those hints: it returns row counts plus distributions, omits tables not yet loaded, and returns formatted JSON keyed by table name. There is no contradiction with the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and front-loaded with the core purpose and return shape. A small redundancy exists between 'Returns row counts...' and the later 'Returns: Summary statistics as formatted JSON...' line, but the latter adds keying detail so the duplication is minor.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-argument read-only tool with annotations and an output schema available, the description is complete: it identifies the covered tables, the omission behavior for unloaded tables, and the return format. No critical call-time information is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has no parameters, so there is nothing to document beyond the baseline for zero-parameter tools. The description's statement of what the stats cover is the only relevant semantic context and it is adequate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource ('Get summary statistics for all database tables') and then enumerates the exact outputs ('row counts and relevant distributions') and the tables involved (assets, vulnerabilities, policies, vulnerability_remediation). This makes it clearly distinct from siblings like query_rapid7 or get_rapid7_schema, which are for detailed queries or schema inspection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives an explicit use context: 'Useful for getting an overview of the data across all loaded datasets.' It does not name alternatives or state when not to use it, so it stops short of a full routing rule, but the intended scenario is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_rapid7_exportsList Rapid7 ExportsARead-onlyIdempotent
List recent Rapid7 exports tracked in the system.
Shows export metadata including export ID, date, status, type, and row counts. Useful for understanding what exports are available for reuse.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of exports to return (default: 10) |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the safety profile is covered. The description adds useful behavioral context: it lists only 'recent' exports, scopes them to 'tracked in the system', and specifies the metadata fields returned. This goes beyond the structured annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no filler. The primary action is front-loaded, and the second sentence adds valuable detail about output contents and intended use. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only listing tool with one optional parameter, a full output schema, and safety annotations already present, the description provides sufficient context. It explains what the tool returns, what the results represent, and why an agent would call it. Nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with the limit parameter already documented including its default. The description adds no additional parameter semantics, but the schema fully covers the single optional parameter. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses a specific verb ('List') and identifies the exact resource ('Rapid7 exports tracked in the system'). It names the metadata fields returned, which distinguishes this from sibling tools like start_rapid7_export or download_rapid7_export. The phrase 'available for reuse' clarifies its role as an inventory/reuse tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool: to see what exports exist and what can be reused. It does not explicitly state when not to use it or name alternatives, but the intended use case is clear enough for a simple listing tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
load_rapid7_parquetLoad Rapid7 Parquet FileAIdempotent
Load vulnerability data from existing Parquet file(s).
Use this if you already have Parquet files downloaded and want to skip the export process. This is much faster than running a full export.
| Name | Required | Description | Default |
|---|---|---|---|
| parquet_path | Yes | Path to a Parquet file or directory containing Parquet files |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish the safety profile (idempotentHint=true, destructiveHint=false, readOnlyHint=false), and the description's 'load' claim is consistent with those. The description adds a performance trait ('much faster than running a full export') and the workflow context of skipping exports. However, it doesn't disclose what happens when data is loaded into a non-empty store (overwrite vs. append), which is the key behavioral unknown for a load tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no filler: the purpose is front-loaded, the usage condition follows, and the performance rationale comes last. Each sentence earns its place, and the whole is well under any reasonable length limit.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter tool with 100% schema coverage, an output schema, and annotations covering idempotency and destructiveness, the description is nearly complete. The only gap is conflict semantics with pre-existing data (does loading replace or merge?), which is a minor omission for an idempotent loader.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% — parquet_path's description states it accepts a file or directory, so the schema already carries the full semantic load. The description's phrase 'Parquet file(s)' reinforces the directory case but adds no new meaning beyond the schema, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Load vulnerability data from existing Parquet file(s).' This is unambiguous among the siblings, which are all export-management or query tools (start_rapid7_export, download_rapid7_export, query_rapid7, etc.), so there is no confusion about what this tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives an explicit trigger condition: use this when you already have Parquet files downloaded and want to skip the export process. It contrasts this path with running a full export, letting an agent infer that the export siblings (start_rapid7_export, download_rapid7_export) are the alternative. It stops short of naming a specific sibling tool, but the condition is clear enough to route correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
purge_rapid7_dataPurge Rapid7 DataADestructiveIdempotent
Permanently delete all local Rapid7 data and tracking databases.
This removes:
The main vulnerability database (rapid7_bulk_export.db)
The export tracking database (rapid7_bulk_export_tracking.db)
Any associated WAL files
Use this when you are done with your analysis session, before handing off a machine, or to free disk space. After purging, you will need to run a new export to query data again.
Returns: Confirmation of purged data.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=true, and the description reinforces and enriches this by naming the exact databases and WAL files that will be destroyed and noting that the action is 'permanent.' It clearly discloses the irreversible destructive behavior without contradicting the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is tightly organized with a one-line summary, a bulleted list of affected files, a clear usage statement, and a return note. Every sentence adds useful information and there is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter destructive tool with annotations covering destructiveness and idempotency, the description is complete: it names exactly what is deleted, says when to use it, warns about the need to re-export afterward, and states the return value. No critical context is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema is empty, so there is nothing to document at the parameter level. The description instead clarifies that the operation acts on all local Rapid7 data, which is the only relevant 'scope' information an agent needs. Baseline 4 is appropriate for a no-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Permanently delete all local Rapid7 data and tracking databases.' It goes on to enumerate the exact files removed (rapid7_bulk_export.db, rapid7_bulk_export_tracking.db, WAL files), which clearly distinguishes it from the read/query/export sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use the tool: 'when you are done with your analysis session, before handing off a machine, or to free disk space.' It also explains the consequence—'After purging, you will need to run a new export to query data again'—which tells the agent the practical impact and when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
query_rapid7Query Rapid7 DataARead-onlyIdempotent
Execute a SQL query against the Rapid7 database.
The database contains the following tables loaded from Rapid7 InsightVM Bulk Export API Parquet files:
assets — Asset inventory data: Key fields: orgId, assetId, agentId, hostName, ip, mac, osFamily, osProduct, osVersion, osDescription, riskScore, sites, assetGroups, tags, awsInstanceId, azureResourceId, gcpObjectId
vulnerabilities — Combined asset + vulnerability data: Key fields: orgId, assetId, vulnId, checkId, port, protocol, title, description, severity, severityRank, cvssScore, cvssV3Score, cvssV3Severity, hasExploits, epssscore, epsspercentile, riskScoreV2_0, cves, firstFoundTimestamp, reintroducedTimestamp, dateAdded, dateModified, datePublished, pciCompliant, pciSeverity
policies — Policy compliance results (agent and scan based): Key fields: orgId, assetId, benchmarkNaturalId, profileNaturalId, benchmarkVersion, ruleNaturalId, ruleTitle, finalStatus, proof, lastAssessmentTimestamp, benchmarkTitle, profileTitle, publisher, fixTexts, rationales, source ('agent' or 'scan')
vulnerability_remediation — Vulnerability remediation tracking: Key fields: orgId, assetId, cveId, vulnId, proof, firstFoundTimestamp, reintroducedTimestamp, lastDetected, lastRemoved, title, description, cvssV2Score, cvssV3Score, cvssV2Severity, cvssV3Severity, cvssV2AttackVector, cvssV3AttackVector, riskScoreV2_0, datePublished, dateAdded, dateModified, epssscore, epsspercentile
Use this tool to query any of the above tables. You can filter, aggregate, join across tables, or perform any SQL-based analysis supported by DuckDB.
Examples:
SELECT * FROM vulnerabilities WHERE severity = 'Critical' LIMIT 10
SELECT severity, COUNT(*) FROM vulnerabilities GROUP BY severity
SELECT * FROM policies WHERE finalStatus = 'fail' LIMIT 10
SELECT cveId, COUNT(*) FROM vulnerability_remediation GROUP BY cveId
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | SQL query to execute against the database |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds useful context: the data comes from Rapid7 InsightVM Bulk Export Parquet files and SQL is executed with DuckDB support. This gives the agent expectations about the underlying engine and data source without contradicting the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The opening sentence is direct, and the table-by-table field lists are useful rather than filler for a SQL tool. The examples are compact and illustrative. It is long, but the length is mostly justified by the need to document the data model for query authoring.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex SQL-query tool, the description covers the available tables, representative fields, dialect, and example queries. An output schema exists, so return-value documentation is not the description's job. It does not mention result limits, timeouts, or error behavior, but those are minor given the annotations and the tool's read-only nature.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single sql parameter, so the baseline is 3. The description adds real value by specifying DuckDB as the SQL dialect, listing queryable tables with key columns, and providing representative examples. This materially reduces ambiguity about what kinds of queries are valid.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Execute a SQL query against the Rapid7 database') and goes beyond the name by enumerating the four available tables and their key fields. This clearly distinguishes it from sibling lifecycle tools like start_rapid7_export, download_rapid7_export, or purge_rapid7_data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Use this tool to query any of the above tables' and gives concrete SQL examples, establishing clear context for when it applies. It does not name exclusions or alternatives, but the sibling set is self-evident enough that an agent can see this is the data-querying tool versus export/schema/stats helpers.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_rapid7_exportStart Rapid7 ExportAIdempotent
Start a new Rapid7 export job (non-blocking).
This is a fast, non-blocking call that creates an export job on the Rapid7 platform and returns the export ID immediately. The export will process in the background on Rapid7's servers (typically 3-5 minutes).
Use check_rapid7_export_status(export_id) to monitor progress, then download_rapid7_export(export_id, export_type="...") once it completes.
If an export from today already exists, returns that export's ID instead of creating a duplicate.
For remediation exports, the Rapid7 API limits each request to 31 days. If the date range exceeds 31 days, this tool automatically splits it into multiple 31-day chunks and kicks off an export for each chunk.
| Name | Required | Description | Default |
|---|---|---|---|
| end_date | No | End date in YYYY-MM-DD format (only for remediation exports). Defaults to today if not specified. | |
| start_date | No | Start date in YYYY-MM-DD format (only for remediation exports). Defaults to 30 days ago if not specified. | |
| export_type | No | Type of export to create. One of "vulnerability", "policy", or "remediation". | vulnerability |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds substantial behavioral context beyond the annotations: non-blocking background processing, typical 3-5 minute completion, automatic reuse of a same-day export ID, and automatic splitting of >31-day remediation exports. These are exactly the kind of runtime behaviors an agent needs to know and cannot infer from the schema or annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded with the essential non-blocking behavior, followed by downstream tool usage and edge-case behavior. It is slightly repetitive ('non-blocking' appears twice; returning the export ID is stated more than once), but every block of information serves a distinct purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with three optional parameters, an output schema, and annotations available, the description is fully complete. It explains what the tool returns, what happens in the background, how long it typically takes, how to check/download the result, and how edge cases like duplicates and long date ranges are handled.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already covers parameter types, defaults, and enum values at 100%, so the baseline is 3. The description adds extra value by clarifying that date parameters are remediation-focused and by explaining the 31-day chunking behavior, which directly affects how start_date and end_date should be provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Start a new Rapid7 export job (non-blocking)', giving a specific verb and resource. It clearly separates this tool from siblings like check_rapid7_export_status, download_rapid7_export, and list_rapid7_exports by focusing on job creation and immediate ID return.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear workflow: call this first, then check_rapid7_export_status, then download_rapid7_export. It also explains the existing-export deduplication behavior, which helps the agent decide whether a new call is needed. It does not explicitly name alternatives like list_rapid7_exports for checking existing exports, so it falls just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
9 tool updates
v0.5.2- First observed
check_rapid7_export_status - First observed
download_rapid7_export - First observed
get_rapid7_schema - First observed
get_rapid7_stats - First observed
list_rapid7_exports - First observed
load_rapid7_parquet - First observed
purge_rapid7_data - First observed
query_rapid7 - First observed
start_rapid7_export
TDQS
Scored across 9 tools
Each tool covers a distinct phase of the export/query lifecycle: starting, checking, downloading, loading, listing, querying, inspecting, and purging. While list_rapid7_exports and check_rapid7_export_status both surface status information, their purposes are clearly separated and their descriptions remove ambiguity.
Tool names consistently follow a verb_rapid7_object pattern, such as start_rapid7_export, download_rapid7_export, and get_rapid7_schema. Even query_rapid7 fits the pattern by treating Rapid7 as the object, and pluralization is used sensibly for list_rapid7_exports.
Nine tools is well-scoped for the server's purpose: managing Rapid7 exports, loading data, and querying the local database. Each tool earns its place and there is no redundant bloat.
The tool set covers the complete export-to-analysis lifecycle: start an export, check status, download it, load existing Parquet files, list available exports, inspect schema and stats, query the data, and purge everything when done. No critical workflow dead-ends are apparent.
Maintenance
Related MCP Connectors
Real-time CVE, exploit, and vulnerability intelligence for AI assistants (350K+ CVEs, 115K+ PoCs)
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Defensive vulnerability intelligence search across public CVE/NVD and GitHub advisory APIs with CVSS
Related MCP Servers
- AlicenseBqualityDmaintenanceProvides conversational access to a local CVE (Common Vulnerabilities and Exposures) database, enabling natural language queries to search vulnerabilities, retrieve detailed CVE information, and view security statistics.3MIT
- AlicenseAqualityAmaintenanceEnables AI-powered analysis of Rapid7 vulnerability and asset data by exporting via the Bulk Export API and making it queryable through natural language or SQL in MCP-compatible tools.933MIT
- AlicenseNot gradedqualityCmaintenanceConnects AI assistants to HackerOne to pull bug bounty history, program scopes, and report details into a local SQLite database, exposing tools for searching, analyzing, and generating attack briefings using both personal and public disclosed reports.358MIT
- AlicenseNot gradedqualityDmaintenanceA unified MCP server for Rapid7's security platform, exposing InsightVM (vulnerability management), InsightIDR (SIEM/investigations), and Metasploit Pro (pentest telemetry) as tools for Claude, Cursor, and any MCP-compatible LLM client.6MIT