tenable-vpr-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| TIO_URL | No | Base URL for the Tenable API. Optional, defaults to https://cloud.tenable.com | https://cloud.tenable.com |
| TIO_ACCESS_KEY | Yes | Your Tenable.io access key. Generate API keys in Tenable.io / Tenable One under Settings > My Account > API Keys. | |
| TIO_SECRET_KEY | Yes | Your Tenable.io secret key. Generate API keys in Tenable.io / Tenable One under Settings > My Account > API Keys. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| extensions | {
"io.modelcontextprotocol/ui": {}
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_scansA | List scans visible to the authenticated API key, optionally filtered by folder ID. Returns id, name, status, and last run time per scan. |
| get_scan_detailsA | Get the latest results for a single scan by ID: hosts scanned, per-plugin findings, and vulnerability counts by severity. |
| list_assetsA | List assets known to Tenable.io / Tenable One (hostname, IPs, UUID,
last seen, sources). Capped at |
| get_asset_detailsA | Get full detail for a single asset by UUID: network interfaces, installed software, tags, and exposure scores (ACR/AES) if licensed. |
| search_vulnerabilitiesA | Search current findings across the tenant via the vulnerability
workbench. Filter by CVSS severity (any of "info", "low", "medium",
"high", "critical" — case-insensitive) and/or plugin family
(e.g. ["Windows", "Web Servers"]). Returns per-plugin aggregate records
including CVSS severity, VPR score, and affected asset count. Capped at
|
| get_plugin_detailsA | Get full plugin detail: description, solution, CVSS vectors, CVEs, and VPR drivers for a given Tenable plugin ID. |
| list_tagsA | List all asset tag categories and values configured in the tenant. |
| list_agentsA | List Nessus Agents linked to the tenant with status, platform, and
last connect / last scanned timestamps. Capped at |
| compare_vpr_reprioritizationA | Build a before/after re-prioritization table for live findings: CVSS-based severity vs. VPR-based severity, per plugin, with a 'rerating' flag (escalated / downgraded / unchanged / unrated) and affected asset count. Designed for POC/assessment deliverables that need to show clients how VPR re-ranks their existing scan data (e.g. a Tenable One CTEM engagement). Escalated findings are sorted first since they represent the highest-priority remediation gap a CVSS-only view would have missed. Optionally filter the underlying findings by CVSS |
| check_kev_epss_exposureA | Cross-reference live findings against two independent, publicly sourced exploitation signals (not Tenable's proprietary VPR):
Useful alongside compare_vpr_reprioritization to back a re-prioritization
argument with vendor-independent evidence. Each finding gets a
|
| scan_deltaA | Compare a baseline scan against a re-test scan by plugin ID and return three buckets: fixed (present in baseline, gone in re-test), still_open (present in both), and new_since_baseline. Includes a remediation-rate percentage. Built for pentest/assessment re-test reporting where a client needs proof of what got remediated between engagement rounds. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 11 tools
Each tool targets a clearly distinct resource or action: assets, vulnerabilities, plugins, tags, agents, scans, and specialized analyses (VPR comparison, KEV/EPSS cross-reference, scan delta). No two tools have overlapping purposes.
Most tools follow a verb_noun pattern (get_asset_details, search_vulnerabilities, list_scans, compare_vpr_reprioritization, check_kev_epss_exposure). However, 'scan_delta' deviates as a noun-noun compound, breaking the otherwise consistent convention.
11 tools is well within the ideal 3-15 range and each tool serves a specific purpose for the server's VPR-focused analysis domain. The count feels neither excessive nor thin.
The server covers core retrieval and comparison workflows well, including asset and scan details, vulnerability search, and specialized reporting tools. A minor gap is the lack of a per-asset vulnerability findings endpoint, but existing tools can work around this.