qualys-pci-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| QUALYS_PCI_BASE_URL | No | Base URL of the Qualys PCI API. | https://pci-api.qualys.com |
| QUALYS_PCI_PASSWORD | Yes | Your Qualys PCI password for API authentication. | |
| QUALYS_PCI_USERNAME | Yes | Your Qualys PCI username for API authentication. | |
| QUALYS_PCI_DOWNLOAD_DIR | No | Directory where scan-report PDFs are saved. | ~/.local/share/qualys-pci-mcp/downloads |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| pci_list_assetsA | List declared in-scope PCI assets. Args: asset_type: ALL, IP, DNS, or VIRTUALHOST. This is declared scope -- configuration, not observation. It says nothing about whether a host responded to a scan. |
| pci_compliance_summaryA | Per-host PCI Pass/Fail status. The primary way to iterate hostnames. Args: offset: 1-based record offset. 0 is invalid. limit: Rows per page, 1-1000. dns: Filter to a single hostname. compliance_status: Filter by "Pass" or "Fail". fetch_all: Walk every page rather than returning one. There is deliberately no Returns total_count so growth in scope is always visible. |
| pci_list_vulnsA | List vulnerability findings as compact rows. Args: offset: 1-based record offset. limit: Rows per page, 1-1000. ip: Filter by IP, CIDR, or range. dns: Filter by hostname. qid: Filter by Qualys ID. title: Keyword search on the finding title. severity: Any of CONFIRMED_HIGH, CONFIRMED_MED, CONFIRMED_LOW, POTENTIAL_HIGH, POTENTIAL_MED, POTENTIAL_LOW. false_positive: Any of Requested, Rejected, Expired. pci_fail_vulns: True to return only findings that fail PCI. fetch_all: Walk every page rather than returning one. Prose fields are deliberately absent; call pci_get_vuln for one finding's threat, impact, and solution text. |
| pci_get_vulnA | Full detail for one vulnerability finding, including prose fields. Args:
detection_id: The finding's |
| pci_list_scansA | List PCI scans, newest first. Args: offset: 1-based record offset. limit: Rows per page, 1-1000. |
| pci_get_scanA | Detail for one scan. Args:
scan_id: The scan's
|
| pci_download_scan_reportA | Download a scan's report PDF and return the path it was saved to. Args:
scan_id: The scan's PDF is the only format Qualys offers here. The bytes are written to disk and only a path is returned -- a PDF is not usable as tool output. A 404 is the normal case, not a failure. Reports must be generated in the Qualys console first, and generation is a write operation this server does not perform. A 404 means only "no report has been generated for this scan yet". It does not mean the scan is missing, and it is not a compliance finding -- do not report it as one. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Each tool targets a distinct resource and action: assets, compliance summary, vulnerabilities (list/detail), scans (list/detail), and report download. No two tools overlap in purpose, and the descriptions clarify any potential confusion between list and get variants.
All tools follow a consistent 'pci_<verb>_<noun>' pattern with clear verbs: list, get, download. Plural nouns for list operations and singular for get operations are conventional and predictable.
Seven tools is well within the typical 3-15 range and each tool addresses a necessary aspect of the PCI compliance workflow: asset scope, compliance status, vulnerability findings, scan management, and report retrieval. No tool feels redundant or missing.
The tool set covers the primary read-only workflows for Qualys PCI compliance: listing assets, viewing compliance status, enumerating and detailing vulnerabilities, listing and detailing scans, and downloading scan reports. Minor gaps exist, such as no ability to initiate scans or generate reports in Qualys, but the server explicitly notes these are write operations outside its scope.