What can you do with this server?

The Tenable Identity Exposure MCP Server exposes the Tenable Identity Exposure (TIE) REST API as tools for LLM clients, enabling AI-driven Active Directory security monitoring, threat detection, and identity risk analysis. * Discover API Resources (tie_catalog): List all available TIE API resources and their paths — recommended as a first step before using other tools. * Raw API Access (tie_request): Make direct HTTP calls (GET, POST, PUT, PATCH, DELETE) to any TIE API endpoint for maximum flexibility. * Generic CRUD Operations (tie_resource_action): Perform list, get, create, update, or delete operations on any TIE resource (directories, attacks, users, alerts, etc.). * Unified Recent Activity Timeline (tie_recent_activity): Get a merged, time-ordered view of both IoE (Indicator of Exposure) alerts and IoA (Indicator of Attack) attacks, enriched with deviance details. * Security Profiles (tie_profiles): List all security profiles, which are required to scope IoE/IoA queries. * Security Scores (tie_scores): Retrieve per-directory AD security scores reflecting outstanding IoE deviances. * AD Topology (tie_topology): View Active Directory topology including domains, forests, and trust relationships. * IoA Attack Instances (tie_attacks): Query attack instances scoped to an infrastructure, directory, hostname, or IP, with optional filtering by attack type, date range, and status. * Alerts (tie_alerts): List security alerts for a profile, with optional filtering by archived status. * IoE Deviances (Time-Windowed) (tie_deviances): Find AD objects with IoE deviances for a specific checker within a relative or absolute time window. * IoE Deviances by Checker (tie_deviances_by_checker): Retrieve full IoE deviances for a checker without a date filter, with optional expression-based filtering. * IoE Deviances by Directory (tie_deviances_by_directory): Retrieve full IoE deviances scoped to a specific directory without a date filter. * AD Event Search (tie_search_events): Search AD security events across one or more directories within a specified date range. * AD Object Search (tie_search_ad_objects): Search for Active Directory objects (users, computers, groups, OUs) by name or attribute, with optional type and directory filtering. * Current User Identity (tie_whoami): Retrieve the identity, roles, and permissions associated with the current API key.

How do I use Tenable Identity Exposure MCP Server?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Tenable Identity Exposure MCP Server list my security profiles" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

Tenable Identity Exposure MCP Server

by knethteo

Overview Schema Source Related Servers Discussions Admin

Python

Remote

The Tenable Identity Exposure MCP Server exposes the Tenable Identity Exposure (TIE) REST API as tools for LLM clients, enabling AI-driven Active Directory security monitoring, threat detection, and identity risk analysis.

Discover API Resources (tie_catalog): List all available TIE API resources and their paths — recommended as a first step before using other tools.
Raw API Access (tie_request): Make direct HTTP calls (GET, POST, PUT, PATCH, DELETE) to any TIE API endpoint for maximum flexibility.
Generic CRUD Operations (tie_resource_action): Perform list, get, create, update, or delete operations on any TIE resource (directories, attacks, users, alerts, etc.).
Unified Recent Activity Timeline (tie_recent_activity): Get a merged, time-ordered view of both IoE (Indicator of Exposure) alerts and IoA (Indicator of Attack) attacks, enriched with deviance details.
Security Profiles (tie_profiles): List all security profiles, which are required to scope IoE/IoA queries.
Security Scores (tie_scores): Retrieve per-directory AD security scores reflecting outstanding IoE deviances.
AD Topology (tie_topology): View Active Directory topology including domains, forests, and trust relationships.
IoA Attack Instances (tie_attacks): Query attack instances scoped to an infrastructure, directory, hostname, or IP, with optional filtering by attack type, date range, and status.
Alerts (tie_alerts): List security alerts for a profile, with optional filtering by archived status.
IoE Deviances (Time-Windowed) (tie_deviances): Find AD objects with IoE deviances for a specific checker within a relative or absolute time window.
IoE Deviances by Checker (tie_deviances_by_checker): Retrieve full IoE deviances for a checker without a date filter, with optional expression-based filtering.
IoE Deviances by Directory (tie_deviances_by_directory): Retrieve full IoE deviances scoped to a specific directory without a date filter.
AD Event Search (tie_search_events): Search AD security events across one or more directories within a specified date range.
AD Object Search (tie_search_ad_objects): Search for Active Directory objects (users, computers, groups, OUs) by name or attribute, with optional type and directory filtering.
Current User Identity (tie_whoami): Retrieve the identity, roles, and permissions associated with the current API key.

Tenable Identity Exposure MCP Server

An MCP server exposing the Tenable Identity Exposure (TIE, formerly Tenable.ad) REST API as tools for LLM clients. Built on FastMCP from the official mcp SDK.

Verified end-to-end against a live TIE SaaS instance (v3.120.1).

⚠️ Disclaimer: This is not an officially supported Tenable project. It was built with assistance from Claude — treat its output as a starting point and validate responses against the Tenable console before acting on them.

Tools

Tool	Description
`tie_catalog`	List available resources + the filter-expression grammar — call this first
`tie_request`	Raw HTTP call to any endpoint (`method`, `path`, `params`, `body`)
`tie_resource_action`	Generic CRUD (`list`/`get`/`create`/`update`/`delete`) on flat resources
`tie_recent_activity`	Unified IoE+IoA timeline for the last N hours (one call)
`tie_find_ad_object`	Resolve an AD object by name/identifier (`by=sAMAccountName\|cn\|upn\|dn\|sid\|guid`)
`tie_get_ad_object`	Get one object's full attributes by `directory_id` + `ad_object_id` (the only working get-by-id)
`tie_account_report`	One-shot account exposures + privileges (resolve → deviances → key attrs)
`tie_profiles`	List security profiles (IoE/IoA data is profile-scoped)
`tie_scores`	Per-directory security scores for a profile
`tie_topology`	AD topology (domains, forests, trusts) for a profile
`tie_attacks`	IoA attack instances, slim by default (`resource_type` + `resource_value`; `actor`/`include_template`)
`tie_attacks_aggregate`	Counts by attack type + distinct source IPs/hosts/usernames over a window
`tie_attack_types_summary`	Compact attack-type list (id, codeName, name, criticity, mitre)
`tie_checkers_summary`	Compact IoE checker list (no description blobs)
`tie_alerts`	Alerts for a profile
`tie_deviances`	IoE deviant AD objects for a checker within a time window
`tie_deviances_bulk`	All active deviances in a few cursor-paginated calls
`tie_deviances_by_checker`	Full IoE deviances for a checker (no date filter)
`tie_deviances_by_directory`	Full IoE deviances for a directory (no date filter)
`tie_search_events`	Search AD security events in a date range (slim + paginated)
`tie_search_ad_objects`	Deprecated — delegates to `tie_find_ad_object`
`tie_whoami`	Current user identity, roles, permissions

Response envelope

List-returning tools wrap their output in a consistent envelope so an empty result is never ambiguous:

{ "count": 0, "page": 1, "perPage": 25, "hasMore": false,
  "appliedFilters": { "...": "..." }, "warnings": ["..."], "results": [] }

Always check warnings — an unrecognized filter, a defaulted profile, or a substring-vs-exact match is reported there rather than silently dropped.

Finding AD objects & filter grammar

There is no GET /api/ad-objects?search= — the API rejects it. Resolve accounts with tie_find_ad_object (backed by the event stream, TIE's only server-side object-attribute search), then use tie_get_ad_object for full attributes.
The filter expression used by tie_deviances and tie_search_events is a predicate map: {"attributeName": "substring"} (case-insensitive contains), multiple keys ANDed, combined with {"AND":[…]} / {"OR":[…]}. {} matches all. The {"attribute","operator","value"} form silently matches nothing — the tools now warn when they see it.

Time windows, profiles, and token budget

Time-aware tools (tie_recent_activity, tie_deviances, tie_attacks_aggregate) accept a relative hours=N window or explicit date_start/date_end. All timestamps are UTC.
IoE/IoA data is profile-scoped. The API does not expose which profile your console has selected, so pass profile_id explicitly — use tie_profiles to list them. If omitted, tools default to profile 1 and add a warning to warnings.
By default, deviance/object/attack results are slimmed (descriptions rendered, oversized values dropped, attack vector.template omitted). Pass verbose=true (or include_template=true for attacks) for the full raw payload.

Related MCP server: tenable-mcp

Configuration

Set via environment variables (or --tie-url / --tie-api-key flags):

Variable	Description
`TIE_URL`	Base URL, e.g. `https://your-host.tenable.ad`
`TIE_API_KEY`	API key (TIE console → System → Configuration → API key)
`TIE_VERIFY_SSL`	`true` (default) or `false` for self-signed certs

Auth uses the X-API-Key header.

Install & run

python -m venv .venv && . .venv/bin/activate
pip install -e .

cp .env.example .env   # fill in TIE_URL and TIE_API_KEY

# stdio (Claude Desktop / Claude Code)
set -a; . ./.env; set +a
tenable-tie-mcp

# or network transports
tenable-tie-mcp --transport sse --port 8000
tenable-tie-mcp --transport http --port 8000

Running with uv / uvx (alternative to a manual venv)

uv can manage the environment for you. uv is the full tool; uvx (alias for uv tool run) runs a package in a throwaway env, like npx. Both need uv installed (brew install uv).

# uv run: resolves deps from pyproject.toml into a managed .venv, then runs
uv run tenable-tie-mcp

# uvx: run ephemerally from the project path, nothing persisted
uvx --from . tenable-tie-mcp

Claude Desktop / Claude Code config

Use the full path to the executable. Claude Desktop does not launch from your shell, so it does not inherit your PATH — a bare tenable-tie-mcp will fail with "command not found" unless the tool is on the system PATH (e.g. a pipx install).

For a venv install, point at the venv's launcher:

{
  "mcpServers": {
    "tenable-tie": {
      "command": "/absolute/path/to/tenable-ie-mcp/.venv/bin/tenable-tie-mcp",
      "env": {
        "TIE_URL": "https://your-host.tenable.ad",
        "TIE_API_KEY": "your-key"
      }
    }
  }
}

Find the exact path with echo "$PWD/.venv/bin/tenable-tie-mcp" from the project root. See claude_desktop_config.sample.json for a complete example.

If you installed globally with pipx install . (or uv tool install), the bare "command": "tenable-tie-mcp" works because it lands on the system PATH.

With uv (alternative)

Point command at the full path of uv (which uv, e.g. /opt/homebrew/bin/uv) and let it manage the environment:

{
  "mcpServers": {
    "tenable-tie": {
      "command": "/opt/homebrew/bin/uv",
      "args": ["run", "--directory", "/absolute/path/to/tenable-ie-mcp", "tenable-tie-mcp"],
      "env": {
        "TIE_URL": "https://your-host.tenable.ad",
        "TIE_API_KEY": "your-key"
      }
    }
  }
}

Docker

docker compose up --build   # reads TIE_URL / TIE_API_KEY from environment

Example prompts

"Show me IoE and IoA activity in the last 12 hours." → tie_recent_activity
"Find the account SECURITYPEN and show its exposures and privileges." → tie_account_report
"Resolve the user administrator to its object id and DN." → tie_find_ad_object
"Which security profiles exist?" → tie_profiles
"List the monitored directories and their security scores."
"Show the latest IoA attacks against directory 8." → tie_attacks
"Which source hosts and accounts are behind attacks on directory 8?" → tie_attacks_aggregate
"What IoE deviances appeared for checker 15 in the last day?" → tie_deviances
"Show unread alerts for profile 2."

Notes

Every list tool returns the {count, hasMore, appliedFilters, warnings, results} envelope — read warnings (defaulted profile, unrecognized filter, truncation).
profile_id defaults to 1 when omitted, and the tool warns; pass it (or profile_name where supported) to target your console's active profile.
AD-object lookup is via tie_find_ad_object / tie_get_ad_object; the flat GET /api/ad-objects/{id} and ?search= routes do not work and are not used.
Attacks must be scoped: resource_type ∈ infrastructure|directory|hostname|ip and resource_value is the id or name/ip. search matches source host/IP only — use actor to filter by the acting account in the attack vector.
Non-JSON responses are returned as {"content_type": ..., "text": ...} rather than crashing.
Scoring and prioritization: TIE checkers carry a remediationCost (easy / medium / hard) but no native asset-level severity score. If your workflow requires AES (Asset Exposure Score) or ACR (Asset Criticality Rating) — for example, to rank affected identities by business risk — connect your environment to Tenable One. Tenable One aggregates data across TIE, Tenable Vulnerability Management, and other sources to produce unified AES/ACR scores that can be surfaced here via the API.

Available Tools

15 tools

tie_alertsA

List alerts for a security profile.

Args: profile_id: Security profile id (default 1). page: Page number (1-based). per_page: Results per page. archived: Optionally filter by archived status (True/False).

Inputs: page, archived, per_page, profile_id.

tie_attacksA

List IoA attack instances for a resource within a profile.

The TIE API requires scoping attacks to a resource. For example, to see attacks against directory id 8: resource_type="directory", resource_value="8".

Args: resource_type: What resource_value refers to — infrastructure, directory, hostname, or ip. resource_value: The id (for infrastructure/directory) or name/ip value to scope to. profile_id: Security profile id (default 1). attack_type_ids: Optional list of attack type ids to filter (e.g. DCSync, Kerberoasting). date_start: Optional ISO 8601 start of date range. date_end: Optional ISO 8601 end of date range. include_closed: Include closed attacks (default False). limit: Max results (default 50). order: Sort order by date, "desc" (newest first) or "asc". search: Optional free-text search filter.

Inputs: resource_type (required), resource_value (required), limit, order, +6 more.

tie_catalogA

List all available Tenable Identity Exposure API resources and their paths.

Call this first to discover what resources exist before using other tools.

Inputs: no named parameters. Returns: result

tie_deviancesA

Find AD objects with IoE deviances for a checker within a time window.

This is the time-filterable deviance query (server-side dateStart/dateEnd via the checker's ad-objects/search endpoint). Provide hours for a relative window (e.g. hours=12) or explicit date_start/date_end. With neither, defaults to the last 24h.

Args: checker_id: IoE checker id (see resource="checkers"). profile_id: Security profile id (default 1). Note: your console may use a non-default profile — call tie_profiles to list them. directory_ids: Restrict to these directory ids (default: all directories in scope). hours: Relative look-back window in hours (e.g. 12). Ignored if date_start given. date_start: Explicit ISO 8601 UTC start (e.g. "2026-07-07T16:00:00.000Z"). date_end: Explicit ISO 8601 UTC end (default: now). reasons: Optional reason ids to filter (see /api/profiles/{id}/checkers/{id}/reasons). show_ignored: Include deviances that are currently ignored (default False). page: Page number (1-based). per_page: Results per page. verbose: If False (default), truncate giant attribute values.

Inputs: checker_id (required), page, hours, reasons, +7 more.

tie_deviances_by_checkerA

List IoE deviances for a given checker within a profile (full detail, no date filter).

For a time-bounded view use tie_deviances(hours=...) or tie_recent_activity instead. The TIE API models this as a POST with a filter expression body; an empty expression returns all deviances for the checker.

Args: checker_id: IoE checker id (see tie_resource_action resource="checkers"). profile_id: Security profile id (default 1). page: Page number (1-based). per_page: Results per page. expression: Optional filter expression object. Defaults to {} (no filter). verbose: If False (default), render descriptions and drop giant attribute values to save tokens. Set True for the full raw payload.

Inputs: checker_id (required), page, verbose, per_page, +2 more.

tie_deviances_by_directoryA

List IoE deviances for a specific directory (full detail, no date filter).

Args: infrastructure_id: Infrastructure (forest) id — see resource="infrastructures". directory_id: Directory id — see resource="directories". page: Page number (1-based). per_page: Results per page. verbose: If False (default), render descriptions and drop giant attribute values.

Inputs: directory_id (required), infrastructure_id (required), page, verbose, +1 more.

tie_profilesA

List security profiles (id + name).

IoE/IoA data is scoped to a profile. The console has a selected profile that the API does not expose, so pass the right profile_id explicitly to other tools.

Inputs: no named parameters.

tie_recent_activityA

Unified recent-activity timeline of IoE alerts and IoA attacks in one call.

Answers questions like "show me IoE/IoA in the last 12 hours". IoE is sourced from the profile's alert feed (time-ordered) and each in-window alert is enriched with its deviance detail (checker + rendered description). IoA is sourced from the attacks endpoint per directory. Results are merged and sorted newest-first. All timestamps are UTC.

Args: hours: Look-back window in hours (default 12). profile_id: Security profile id (default 1). See tie_profiles. include_ioe: Include IoE deviance alerts (default True). include_ioa: Include IoA attacks (default True). directory_ids: Restrict to these directory ids (default: all in scope). max_items: Cap on enriched items per category (default 50); truncation is reported. verbose: If False (default), attribute values are slimmed.

Inputs: hours, verbose, max_items, profile_id, +3 more.

tie_requestA

Make a direct HTTP call to any Tenable Identity Exposure API endpoint.

Args: method: HTTP method (GET, POST, PUT, PATCH, DELETE). path: API path, e.g. "/api/directories" or "/api/attacks/123". params: Optional query string parameters as a dict. body: Optional request body as a dict (used with POST/PUT/PATCH).

Returns: Parsed JSON response from the TIE API.

Inputs: path (required), method (required), body, params.

tie_resource_actionB

Perform CRUD operations on a TIE resource.

Args: resource: Resource name from tie_catalog (e.g. "directories", "attacks", "users"). action: Operation — list, get, create, update, or delete. id: Resource ID for get/update/delete operations. body: Request body for create/update operations. params: Optional query parameters (e.g. pagination, filters).

Examples: List all directories: resource="directories", action="list" Get directory #5: resource="directories", action="get", id=5 List recent attacks: resource="attacks", action="list", params={"page": 1} Create a user: resource="users", action="create", body={...} Delete an alert: resource="alerts", action="delete", id=42

Inputs: resource (required), id, body, action, +1 more.

tie_scoresA

Get per-directory security scores for a profile.

Returns a list of {directoryId, score} reflecting the AD security posture (higher is better; scores reflect outstanding IoE deviances).

Args: profile_id: Security profile id (default 1).

Inputs: profile_id.

tie_search_ad_objectsA

Search Active Directory objects (users, computers, groups, OUs) by name or attribute.

Args: query: Search string to match against AD object names/attributes. directory_id: Restrict search to a specific directory. object_type: Filter by object type: "user", "computer", "group", "ou". page: Page number (1-based). per_page: Results per page.

Inputs: query (required), page, per_page, object_type, +1 more.

tie_search_eventsA

Search AD security events within a date range.

Args: directory_ids: One or more directory ids to search (see resource="directories"). date_start: ISO 8601 start of range, e.g. "2026-07-01T00:00:00.000Z". date_end: ISO 8601 end of range. profile_id: Security profile id (default 1). expression: Optional filter expression object. Defaults to {} (no filter). order: Optional ordering object, e.g. {"column": "date", "direction": "desc"}.

Inputs: date_end (required), date_start (required), directory_ids (required), order, +2 more.

tie_topologyA

Get the Active Directory topology (domains, forests, and trust relationships).

Args: profile_id: Security profile id (default 1).

Inputs: profile_id.

tie_whoamiA

Get the current user's identity, roles, and permissions (from the API key).

Inputs: no named parameters.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A4/5.0

Scored 2026-07-08 06:25 across 15 tools

Disambiguation4/5

Most tools have clearly distinct purposes, but there is slight overlap among tie_deviances, tie_deviances_by_checker, and tie_deviances_by_directory. However, descriptions clarify that they differ by date filtering and scoping, so ambiguity is minimal.

Naming Consistency5/5

All tools use the consistent 'tie_' prefix and follow snake_case naming. Naming patterns are predictable: nouns for entity listings (tie_alerts, tie_attacks) and verb_noun for search actions (tie_search_ad_objects). No mixed conventions.

Tool Count5/5

15 tools is well-scoped for the Tenable Identity Exposure domain. Each tool covers a distinct aspect (alerts, attacks, deviances, profiles, search, topology) without unnecessary duplication or missing core functionality.

Completeness5/5

The tool set comprehensively covers the API surface: CRUD via tie_resource_action, specific queries for alerts, attacks, deviances, scores, topology, and search. The tie_recent_activity tool fills a gap by merging IoE and IoA timelines. No obvious missing operations.

Maintenance

ActivityInactive

ResponsivenessNo recent community issues

Resources

Related MCP Connectors

Canopy account
com.canopy-io
Every Canopy public API operation as a tool, run as you after a browser sign-in or on an API key.
CRM Project Management Payments & Billing
1
https://auth.canopy-io.com/mcp/v1
mcp
com.vibgrate
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
Security Monitoring
2
https://mcp.vibgrate.com
Synlake
ai.synlake
Unified API to query AWS, GCP, Azure and generate Terraform/CLI execution kits for AI agents.
Cloud Platforms Developer Tools Agent Orchestration
2
https://api.synlake.ai/api/mcp
mcp-serverA
com.httpstatus
AI-callable tools for API mocking, testing, monitoring, security, and automation.
API Testing Testing & QA Tools App Automation
92
https://mcp.httpstatus.com/mcp

Related MCP Servers

@beyondidentity/mcpofficial
Security Cloud Platforms
gobeyondidentity
A
license
B
quality
C
maintenance
Enables AI agents to directly manage Beyond Identity resources such as identities, groups, applications, SSO configurations, and credentials via natural language tool calls.
Updated 5 months ago (2026-06-24 20:47 UTC)
36
7 npm
Apache 2.0
tenable-mcp
Security Penetration Testing
nguyenthdat
A
license
A
quality
C
maintenance
Exposes Tenable security operations as MCP tools for AI-powered security workflows, enabling asset, vulnerability, scan, plugin, and tag management via natural language.
Updated 4 months ago (2026-07-09 08:11 UTC)
17
MIT
tenable-identity-exposure-mcp
Security Monitoring
ukkugh
A
license
A
quality
D
maintenance
Provides MCP tools to query the Tenable Identity Exposure (TIE) API for security profiles, deviances, attacks, and activity timelines, with enforced read-only mode to protect credentials.
Updated 3 months ago (2026-08-13 08:35 UTC)
17
MIT
Tenable OT Security MCP Server
Security Monitoring
aqamahn
A
license
B
quality
D
maintenance
Connects AI clients to Tenable OT Security, exposing OT/ICS asset inventory, vulnerabilities, events, policies, and findings as read tools, with an opt-in dry-run write layer for asset edits and policy management.
Updated 2 months ago (2026-09-06 15:02 UTC)
59
Apache 2.0

Tenable Identity Exposure MCP Server

Tools

Response envelope

Finding AD objects & filter grammar

Time windows, profiles, and token budget

Configuration

Install & run

Running with uv / uvx (alternative to a manual venv)

Claude Desktop / Claude Code config

With uv (alternative)

Docker

Example prompts

Notes

Available Tools

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

@beyondidentity/mcpofficial

tenable-mcp

tenable-identity-exposure-mcp

Tenable OT Security MCP Server