# Tenable MCP Server

A Model Context Protocol (MCP) server for [Tenable Vulnerability Management](https://www.tenable.com/products/tenable-io) and Tenable Security Center.

Exposes Tenable security operations as MCP tools for AI-powered security workflows.

## Quick Start

```bash
uvx tenable-mcp
```

## Environment Variables

| Variable | Required | Default | Description |
|---|---|---|---|
| `TENABLE_ACCESS_KEY` | Yes | — | Tenable API access key |
| `TENABLE_SECRET_KEY` | Yes | — | Tenable API secret key |
| `TENABLE_IO_URL` | No | `https://cloud.tenable.com` | Tenable.io base URL |
| `TENABLE_SC_URL` | No | — | Tenable.sc URL (enables SC support) |
| `TENABLE_VERIFY_SSL` | No | `true` | Set to `false` to disable SSL verification |
| `TENABLE_TIMEOUT` | No | `120` | Connection timeout in seconds |
| `TENABLE_PAGE_SIZE` | No | `100` | Default page size for paginated requests |

## MCP Client Configuration

### OpenCode / Claude Desktop

```json
{
  "mcpServers": {
    "tenable": {
      "command": "uvx",
      "args": ["tenable-mcp"],
      "env": {
        "TENABLE_ACCESS_KEY": "your-access-key",
        "TENABLE_SECRET_KEY": "your-secret-key"
      }
    }
  }
}
```

### VS Code / Cursor

```json
{
  "mcpServers": {
    "tenable": {
      "command": "uv",
      "args": ["run", "tenable-mcp"],
      "env": {
        "TENABLE_ACCESS_KEY": "your-access-key",
        "TENABLE_SECRET_KEY": "your-secret-key"
      }
    }
  }
}
```

## Available Tools

### Assets
| Tool | Description |
|---|---|
| `tenable_list_assets` | List assets with filters (hostname, IP, network, tracking method) |
| `tenable_get_asset` | Get detailed information for a specific asset by UUID |
| `tenable_get_asset_vulnerabilities` | Get vulnerabilities for a specific asset |

### Vulnerabilities
| Tool | Description |
|---|---|
| `tenable_search_vulnerabilities` | Search vulnerabilities across all assets with extensive filters |
| `tenable_get_vulnerability_details` | Get details for a vulnerability finding or plugin |
| `tenable_list_findings` | List vulnerability findings from the workbench |

### Scans
| Tool | Description |
|---|---|
| `tenable_list_scans` | List configured scans |
| `tenable_get_scan` | Get scan details |
| `tenable_launch_scan` | Launch a scan (requires `confirm: true`) |
| `tenable_export_scan` | Export scan results (nessus, csv, html, pdf, db) |

### Plugins
| Tool | Description |
|---|---|
| `tenable_search_plugins` | Search for plugins by name, family, CVE, severity |
| `tenable_get_plugin_details` | Get detailed plugin information including CVSS and CVE |

### Tags
| Tool | Description |
|---|---|
| `tenable_list_tags` | List configured tags with category/value filters |

## Supported Products

- **Tenable Vulnerability Management (Tenable.io)** — Full support
- **Tenable Security Center (Tenable.sc)** — Partial support (requires `TENABLE_SC_URL`)
- **Tenable Nessus** — Not directly supported (use Tenable.io with agents)

## Development

```bash
# Clone and install
git clone https://github.com/your-org/tenable-mcp.git
cd tenable-mcp
uv sync

# Run quality checks
uv run ruff check .
uv run ruff format --check .
uv run pyright .
uv run pytest
```

## License

MIT