How do I use tenable-mcp-server?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@tenable-mcp-server list assets with high severity vulnerabilities" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

tenable-mcp-server

by tarhou

Overview Schema Related Servers Score Discussions

Python

Remote

Tenable MCP Server

An MCP (Model Context Protocol) server for Tenable Vulnerability Management and the wider Tenable One platform. Connects LLMs like Claude to your Tenable instance for querying assets, vulnerabilities, scans, exposure metrics, attack paths, web app scans, cloud security findings, and more — via natural language.

Built with FastMCP v3 and pyTenable.

Features

58 tools across 25 modules: assets, vulnerabilities, scans, exposure scoring, Attack Path Analysis, Web App Scanning (WAS), Attack Surface Management (ASM), Cloud Security (CNAPP), container security, compliance, tags, agents, networks, policies, users/groups, audit log, and patch verification
Mock mode for demos and development — full test suite and every tool works with zero credentials
Pagination on all list endpoints with safety caps for large exports
Markdown output optimized for LLM consumption
Graceful degradation when licensed features (Lumin/Tenable One, WAS, CNAPP, ASM) are unavailable
STDIO and HTTP transports supported
Read-mostly surface: the only write operations are scan launch/stop and tag assign/unassign, all marked with MCP tool annotations

Related MCP server: Qualys MCP Server

Quick Start

Prerequisites

Python 3.11+
uv (recommended) or pip
Tenable VM API keys (generate here) — or none at all for mock mode

Install

git clone <repo-url> && cd tenable-mcp-server
uv venv && source .venv/bin/activate
uv pip install -e ".[dev]"

Configure

cp .env.example .env
# Edit .env with your Tenable API keys

Or export directly:

export TENABLE_ACCESS_KEY=your-access-key
export TENABLE_SECRET_KEY=your-secret-key

Run

# STDIO transport (default, for Claude Desktop / Claude Code)
tenable-mcp

# Mock mode (no API keys needed)
TENABLE_MOCK=true tenable-mcp

# HTTP/SSE transport (binds 127.0.0.1 by default)
tenable-mcp --transport http --port 8000

Claude Desktop Integration

Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json):

{
  "mcpServers": {
    "tenable": {
      "command": "uv",
      "args": ["run", "--directory", "/path/to/tenable-mcp-server", "tenable-mcp"],
      "env": {
        "TENABLE_ACCESS_KEY": "your-access-key",
        "TENABLE_SECRET_KEY": "your-secret-key"
      }
    }
  }
}

For mock/demo mode, set "TENABLE_MOCK": "true" in env and omit the API keys.

Tools Reference

All tools return Markdown. Read-only tools carry readOnlyHint: true annotations.

Assets & Exposure

Tool	Description
`tenable_list_assets`	List assets with hostname/IP/OS filters and pagination
`tenable_get_asset_details`	Full asset detail by UUID (hostname, IPs, OS, AES, ACR, tags)
`tenable_get_exposure_score`	Cyber Exposure Score (CES) from Tenable One
`tenable_get_asset_exposure`	Per-asset AES (0-1000) and ACR (1-10)
`tenable_get_severity_summary`	Open vulnerability counts by severity
`tenable_list_exposure_views` / `tenable_get_exposure_view`	Tenable One exposure view cards with CES trend series

Vulnerabilities & Plugins

Tool	Description
`tenable_list_vulnerabilities`	List vulns with severity/VPR/CVE/state filters
`tenable_get_vulnerability_details`	Full plugin details (description, solution, references)
`tenable_get_asset_vulnerabilities`	Per-asset vulnerability list
`tenable_list_plugin_families` / `tenable_get_plugin_details`	Plugin family and plugin metadata
`tenable_verify_patched_assets`	Before/after verification that CVEs/plugins are fixed on given assets
`tenable_search_recast_rules`	Recast/accept rule search

Scans, Scanners & Policies

Tool	Description
`tenable_list_scans` / `tenable_get_scan_results` / `tenable_get_scan_history`	Scan inventory, results, run history
`tenable_launch_scan` / `tenable_stop_scan`	Scan lifecycle (write operations)
`tenable_list_scanners` / `tenable_get_scanner_details`	Scanner fleet
`tenable_list_policies` / `tenable_get_policy_details`	Scan policies
`tenable_list_folders` / `tenable_list_exclusions` / `tenable_get_exclusion_details`	Folders and scan exclusions

Attack Path Analysis (Tenable One)

Tool	Description
`tenable_list_attack_paths`	Prioritized attack paths with source/target and techniques
`tenable_list_attack_findings`	Attack path findings
`tenable_list_attack_techniques`	MITRE ATT&CK technique inventory
`tenable_apa_country_coverage`	Per-country APA coverage map bucketed by hostname prefix (ISO 3166-1 defaults, configurable)

Web App Scanning, ASM, Cloud & Containers

Tool	Description
`tenable_was_list_configs` / `tenable_was_get_scan_details` / `tenable_was_list_vulnerabilities`	Web App Scanning configs, scans, findings
`tenable_asm_list_assets` / `tenable_asm_get_asset_details`	Attack Surface Management inventory
`tenable_cloud_list_resources` / `tenable_cloud_list_findings`	CNAPP cloud resources and misconfigurations
`tenable_cloud_list_vm_vulns` / `tenable_cloud_list_container_image_vulns`	CNAPP VM and container image vulnerabilities
`tenable_list_container_images` / `tenable_list_container_repos` / `tenable_get_container_report`	Container Security

Platform Administration

Tool	Description
`tenable_list_tags` / `tenable_create_tag_value` / `tenable_assign_tags` / `tenable_unassign_tags` / `tenable_get_asset_tags`	Tag management
`tenable_list_agents` / `tenable_get_agent_details` / `tenable_list_agent_groups` / `tenable_get_agent_group_details`	Nessus agent fleet
`tenable_list_networks` / `tenable_get_network_details`	Network objects
`tenable_list_users` / `tenable_list_groups`	Users and groups
`tenable_list_audit_events`	Platform audit log
`tenable_list_compliance_findings` / `tenable_get_compliance_summary`	Compliance/audit findings

Configuration

Environment Variable	Default	Description
`TENABLE_ACCESS_KEY`	(required)	Tenable API access key
`TENABLE_SECRET_KEY`	(required)	Tenable API secret key
`TENABLE_URL`	`https://cloud.tenable.com`	Tenable cloud URL
`TENABLE_MOCK`	`false`	Enable mock mode for demo/testing
`TENABLE_MAX_EXPORT`	`10000`	Safety cap for export consumption
`TENABLE_DEFAULT_LIMIT`	`50`	Default pagination limit
`TENABLE_CLOUD_SECURITY_API_KEY`	(optional)	Tenable Cloud Security (CNAPP) API key
`TENABLE_ASM_API_KEY`	(optional)	Attack Surface Management API key
`TENABLE_HOSTNAME_COUNTRY_MAP`	(optional)	JSON map of hostname prefixes to country labels for APA coverage bucketing (defaults to ISO 3166-1 alpha-2)

Development

# Run tests (uses mock mode automatically -- no credentials needed)
pytest tests/ -v

# Lint
ruff check src/ tests/

Architecture

FastMCP v3 server with lifespan-managed TenableIO client
All pyTenable calls wrapped in asyncio.to_thread() (pyTenable is synchronous)
Export iterators consumed with safety cap (MAX_EXPORT_CONSUME = 10,000) then paginated in-memory
Cloud Security tools use direct GraphQL over httpx (https-only guard) instead of pyTenable's CNAPP client
Error handling via @handle_tenable_errors decorator mapping API errors to actionable ToolError messages
Mock client mirrors the pyTenable interface with deterministic UUIDs for consistent test/demo data

Limitations

License-gated features degrade, not fail: CES/AES/ACR, exposure views, APA, WAS, ASM, CNAPP, and Container Security require the corresponding Tenable licenses; tools return an explanatory message when the feature is unavailable on your instance.
Tenable VM (cloud) only — Tenable Security Center (on-prem) is not supported; its API differs substantially.
Export scale: vulnerability/asset exports are capped at TENABLE_MAX_EXPORT records per call to keep responses LLM-sized. This is not a full data-lake export tool.
Write surface is minimal by design: scan launch/stop and tag operations only. No remediation, recast, or user-management writes.
APA country coverage relies on hostname prefixes when asset tags are absent; hostnames that don't encode location won't bucket (they are reported as unmapped rather than guessed).

License

MIT

This server cannot be installed

license - permissive license

quality - not tested

maintenance

How are these scores calculated?

Maintenance

–Maintainers

–Response time

–Release cycle

–Releases (12mo)

Commit activity

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/tarhou/tenable-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server