Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@tenable-mcp list all assets with hostname containing prod"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol (MCP) server for Tenable Vulnerability Management and Tenable Security Center.
Exposes Tenable security operations as MCP tools for AI-powered security workflows.
uvx tenable-mcpRelated MCP server: GhostMap v2
Variable | Required | Default | Description |
| Yes | — | Tenable API access key |
| Yes | — | Tenable API secret key |
| No |
| Tenable.io base URL |
| No | — | Tenable.sc URL (enables SC support) |
| No |
| Set to |
| No |
| Connection timeout in seconds |
| No |
| Default page size for paginated requests |
{
"mcpServers": {
"tenable": {
"command": "uvx",
"args": ["tenable-mcp"],
"env": {
"TENABLE_ACCESS_KEY": "your-access-key",
"TENABLE_SECRET_KEY": "your-secret-key"
}
}
}
}{
"mcpServers": {
"tenable": {
"command": "uv",
"args": ["run", "tenable-mcp"],
"env": {
"TENABLE_ACCESS_KEY": "your-access-key",
"TENABLE_SECRET_KEY": "your-secret-key"
}
}
}
}Tool | Description |
| List assets with filters (hostname, IP, network, tracking method) |
| Get detailed information for a specific asset by UUID |
| Get vulnerabilities for a specific asset |
Tool | Description |
| Search vulnerabilities across all assets with extensive filters |
| Get details for a vulnerability finding or plugin |
| List vulnerability findings from the workbench |
Tool | Description |
| List configured scans |
| Get scan details |
| Launch a scan (requires |
| Export scan results (nessus, csv, html, pdf, db) |
Tool | Description |
| Search for plugins by name, family, CVE, severity |
| Get detailed plugin information including CVSS and CVE |
Tool | Description |
| List configured tags with category/value filters |
Tenable Vulnerability Management (Tenable.io) — Full support
Tenable Security Center (Tenable.sc) — Partial support (requires TENABLE_SC_URL)
Tenable Nessus — Not directly supported (use Tenable.io with agents)
# Clone and install
git clone https://github.com/your-org/tenable-mcp.git
cd tenable-mcp
uv sync
# Run quality checks
uv run ruff check .
uv run ruff format --check .
uv run pyright .
uv run pytestMIT
Export a scan and save it to a specified file path.
Use this when you need to control where the exported file is saved, rather than using a temporary location.
Example: Input: { "scan_id": 123, "output_path": "/home/user/weekly_scan.csv", "format": "csv" } Output: {"file_path": "/home/user/weekly_scan.csv", "status": "completed"}
Inputs: scan_id (required), output_path (required), format, chapters, +1 more.
Export scan results.
The export is downloaded as a file. Supported formats: nessus, csv, html, pdf, db.
Example: Input: {"scan_id": 123, "format": "csv"} Output: {"file_id": "...", "format": "csv", "status": "ready"}
Inputs: scan_id (required), format, chapters, password.
Get detailed information about a specific asset.
Example: Input: {"uuid": "123e4567-e89b-12d3-a456-426614174000"} Output: {"id": "...", "hostname": "server01", "ipv4": "10.0.0.1", ...}
Inputs: uuid (required).
Get vulnerabilities for a specific asset.
Example: Input: {"uuid": "123e4567-...", "severity": "critical"} Output: {"vulnerabilities": [...], "total": 5}
Inputs: uuid (required), cve, limit, severity, +2 more.
Get detailed information about a specific plugin.
Includes CVSS scores, CVE references, solution, and exploit information.
Example: Input: {"plugin_id": 19506} Output: { "id": 19506, "name": "Apache Log4j ...", "cvss_base_score": 10.0, "cve": ["CVE-2021-44228"], ... }
Inputs: plugin_id (required).
Get detailed information about a specific scan.
Example: Input: {"scan_id": 123} Output: {"id": 123, "name": "Weekly Scan", "status": "completed", ...}
Inputs: scan_id (required).
Get detailed information about a specific vulnerability or plugin.
Provide either vuln_id (finding UUID) or plugin_id (Nessus plugin ID).
Example: Input: {"plugin_id": 19506} Output: {"id": 19506, "name": "Apache Log4j ...", "cve": ["CVE-2021-44228"], ...}
Inputs: vuln_id, plugin_id.
Check connectivity and health of the Tenable.io service.
Verifies that the configured credentials are valid and the API is reachable. Returns server properties and status.
Example: Input: {} Output: { "status": "healthy", "server": {"version": "...", "uuid": "..."}, "license": {...} }
Inputs: no named parameters.
Launch a scan.
WARNING: This is a state-changing operation. Set confirm: true to proceed.
Example: Input: {"scan_id": 123, "confirm": true} Output: {"scan_uuid": "...", "status": "launched"}
Inputs: scan_id (required), confirm, targets.
List assets from Tenable Vulnerability Management.
Returns a paginated list of assets with optional filters for hostname, IP address, tracking method, and network.
Example: Input: {"hostname": "web-server", "limit": 10} Output: {"assets": [...], "total": 10}
Inputs: ipv4, ipv6, limit, hostname, +2 more.
List vulnerability findings using the Tenable exports API.
Uses the modern exports.vulns() API for the most current view of vulnerabilities across your environment.
Example: Input: {"severity": "high", "state": "OPEN", "limit": 100} Output: {"findings": [...], "total": 45}
Inputs: cve, tags, limit, since, +4 more.
List configured scans.
Returns a list of all scans (or filtered by folder/name).
Example: Input: {"limit": 20} Output: {"scans": [...], "total": 5}
Inputs: name, limit, folder_id.
List configured tags.
Tags are key-value pairs used to organize and filter assets (e.g., 'Location:US-East', 'Environment:Production').
Example: Input: {"category": "Location", "limit": 20} Output: {"tags": [...], "total": 5}
Inputs: limit, value, category.
Search for Tenable plugins by name, family, CVE, or other criteria.
Example: Input: {"query": "Apache Log4j", "cve": "CVE-2021-44228", "limit": 10} Output: {"plugins": [...], "total": 3}
Inputs: cve, limit, query, family, +4 more.
Search for vulnerabilities across all assets.
Uses the Tenable exports API with extensive filtering for severity, CVE, exploit availability, port, protocol, tags, and time range.
Example: Input: { "severity": "critical", "exploit_available": true, "since": 1700000000, "limit": 50 } Output: {"vulnerabilities": [...], "total": 12}
Inputs: cve, ipv4, port, tags, +10 more.
Download a Web Application Scanning (WAS) report.
Retrieves the detailed report for a specific WAS scan.
Example: Input: {"scan_uuid": "123e4567-e89b-12d3-a456-426614174000"} Output: {"report": {...}, "scan_uuid": "..."}
Inputs: scan_uuid (required).
Export Web Application Scanning (WAS) findings.
Retrieves web application vulnerability findings with optional date and status filters.
Example: Input: {"scan_status": "completed", "scan_started_after": "2024/01/01"} Output: {"was_findings": [...], "total": 5}
Inputs: limit, scan_status, scan_started_after.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 17 tools
There is notable overlap between tenable_list_findings and tenable_search_vulnerabilities (both list vulnerabilities using exports API) and between tenable_get_vulnerability_details and tenable_get_plugin_details (get_vuln_details also accepts plugin_id). While descriptions help, agents may struggle to choose the correct tool for vulnerability-related queries.
All tools follow a consistent tenable_<verb>_<noun> pattern using snake_case. Verbs are distinct and the pattern is predictable, making it easy for an agent to infer tool functionality from names.
17 tools cover the key areas of a vulnerability management platform (assets, scans, vulnerabilities, plugins, tags, health, and WAS) without being overwhelming. The count feels appropriate for the domain.
The tool set covers most read and export operations comprehensively, including search, details, and list endpoints. However, it lacks create/update/delete for many resources (e.g., assets, tags, scans) and missing scan lifecycle operations like stop/pause, which are minor gaps for a read-centric server.
Find, vet, and run MCP tools through a secure audited gateway with prompt-injection risk scoring
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
Zero-setup MCP gateway securely connecting AI to your tools with authentication and workflows
Your org's AI agents, tasks, runs, search, and brain files as MCP tools and resources.
