qualys-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| QUALYS_POD | No | Qualys platform POD (e.g., US2, EU1). Used to derive API and gateway URLs automatically. | |
| QUALYS_BASE_URL | No | Qualys API base URL (overrides POD-based URL) | |
| QUALYS_PASSWORD | No | Qualys platform password | |
| QUALYS_USERNAME | No | Qualys platform username | |
| QUALYS_SSL_VERIFY | No | Set to 'false' to disable SSL verification (for self-signed certificates) | true |
| QUALYS_GATEWAY_URL | No | Qualys gateway URL (overrides POD-based URL) |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| extensions | {
"io.modelcontextprotocol/ui": {}
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| investigateA | [Investigation] Deep-dive investigation on any security topic — CVEs, threat actors, assets, endpoint events, vulnerability intelligence. @slow USE WHEN: "tell me about CVE-2024-3400", "are we exposed to Lazarus Group?", "investigate this IP", "what ransomware vulns exist?", "deep dive on Log4Shell", "what's happening on 10.0.0.1?" |
| assess_riskA | [Risk Assessment] Cross-domain risk assessment — VMs, cloud, containers, web apps, certificates, assets. @slow USE WHEN: "what's our risk?", "show me cloud risk in AWS", "top risky assets", "container vulnerabilities", "expiring certificates", "EOL systems", "risk by business unit", "how's our security posture?" |
| check_complianceA | [Compliance] Compliance posture assessment — framework pass/fail rates, failing controls, risk acceptances. @slow USE WHEN: "are we PCI compliant?", "compliance gaps", "show failing controls", "risk acceptances expiring", "HIPAA posture", "CIS benchmark results", "what frameworks do we have?" |
| plan_remediationA | [Remediation] Remediation planning — patch priorities, deployment status, mitigation coverage, program gaps. @slow USE WHEN: "what should we patch?", "outstanding patches", "patch deployment status", "mitigation coverage", "is there a mitigation for CVE-X?", "what's missing from our security program?", "how do we reduce risk?" |
| security_overviewA | [Overview] Security briefing — daily/weekly/monthly summary with scanner health, findings, and risk trends. @slow when quick=False USE WHEN: "morning briefing", "what happened this week?", "security overview", "any new critical vulns?", "scanner status", "what needs attention today?" |
| reportsB | [Reporting] Unified report operations — list, templates, generate, status, download, delete. |
| cache_statusB | [Admin] Show cache stats or clear all caches. |
| aws_org_connectorsA | [Cloud] AWS Organization connectors — list and health status for multi-account AWS setups. USE WHEN: "show AWS org connectors", "AWS Organizations status", "multi-account cloud connector health", "which AWS accounts are connected", "AWS org sync status" |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 8 tools
Each tool targets a distinct security domain: cache admin, investigation, risk, compliance, remediation, overview, reporting, and cloud connectors. The descriptions provide clear use cases that prevent confusion, with only minor overlap between assess_risk and security_overview that is still disambiguated by their scope.
Naming conventions are mixed: some tools use verb_noun (assess_risk, check_compliance, plan_remediation), some are bare verbs (investigate), and others are nouns or noun phrases (reports, aws_org_connectors, cache_status, security_overview). There is no consistent pattern across the set.
Eight tools is a well-scoped count for a broad security platform, covering major operational areas without bloat. Each tool represents a meaningful high-level capability, making the count appropriate.
The tool set covers the core security operations lifecycle: investigation, risk assessment, compliance, remediation, overview, reporting, and cloud connector management. Minor gaps exist such as explicit asset management or scan configuration, but these are workable through the provided tools.