Tenable MCP Server

An MCP (Model Context Protocol) server for Tenable Vulnerability Management and the wider Tenable One platform. Connects LLMs like Claude to your Tenable instance for querying assets, vulnerabilities, scans, exposure metrics, attack paths, web app scans, cloud security findings, and more — via natural language.

Built with FastMCP v3 and pyTenable.

Features

• 58 tools across 25 modules: assets, vulnerabilities, scans, exposure scoring, Attack Path Analysis, Web App Scanning (WAS), Attack Surface Management (ASM), Cloud Security (CNAPP), container security, compliance, tags, agents, networks, policies, users/groups, audit log, and patch verification

• Mock mode for demos and development — every result carries a visible simulation banner plus machine-readable simulated: true / authoritative: false metadata

• Honest pagination on list endpoints: filters apply to the complete observed capped sample, caps are reported as partial lower bounds, and no unreachable next offset is advertised beyond a cap

• Markdown output optimized for LLM consumption

• Graceful degradation when licensed features (Lumin/Tenable One, WAS, CNAPP, ASM) are unavailable

• STDIO-only transport so API keys are never exposed through an unauthenticated network listener

• Read-mostly surface: the only write operations are scan launch/stop and tag assign/unassign, all marked with MCP tool annotations

Related MCP server: tenable-mcp

Quick Start

Prerequisites

• Python 3.11+

• uv (recommended) or pip

• Tenable VM API keys (generate here) — or none at all for mock mode

Install

git clone <repo-url> && cd tenable-mcp-server
uv venv && source .venv/bin/activate
uv pip install -e ".[dev]"

Configure

cp .env.example .env
# Edit .env with your Tenable API keys

Or export directly:

export TENABLE_ACCESS_KEY=your-access-key
export TENABLE_SECRET_KEY=your-secret-key

Run

# STDIO transport (default, for Claude Desktop / Claude Code)
tenable-mcp

# Mock mode (no API keys needed)
TENABLE_MOCK=true tenable-mcp

Claude Desktop Integration

Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json):

{
  "mcpServers": {
    "tenable": {
      "command": "uv",
      "args": ["run", "--directory", "/path/to/tenable-mcp-server", "tenable-mcp"],
      "env": {
        "TENABLE_ACCESS_KEY": "your-access-key",
        "TENABLE_SECRET_KEY": "your-secret-key"
      }
    }
  }
}

For mock/demo mode, set "TENABLE_MOCK": "true" in env and omit the API keys. The server prepends SIMULATED TENABLE DATA to every tool response and marks result metadata non-authoritative, so mock output cannot silently pass as live evidence.

Tools Reference

All tools return Markdown. Read-only tools carry readOnlyHint: true annotations.

Assets & Exposure

Vulnerabilities & Plugins

Scans, Scanners & Policies

Attack Path Analysis (Tenable One)

Web App Scanning, ASM, Cloud & Containers

Platform Administration

Configuration

Development

# Run tests (uses mock mode automatically -- no credentials needed)
uv sync --extra dev
uv run pytest tests/ -v

# Lint
uv run ruff check src/ tests/

Architecture

• FastMCP v3 server with lifespan-managed TenableIO client

• All pyTenable calls wrapped in asyncio.to_thread() (pyTenable is synchronous)

• Export iterators use one-record lookahead to detect the safety cap (MAX_EXPORT_CONSUME = 10,000), then paginate the observed sample in memory

• Cloud Security tools use direct GraphQL over httpx (https-only guard) instead of pyTenable's CNAPP client

• Error handling via @handle_tenable_errors decorator mapping API errors to actionable ToolError messages

• Mock client mirrors the pyTenable interface with deterministic UUIDs for consistent test/demo data

Limitations

• License-gated features degrade, not fail: CES/AES/ACR, exposure views, APA, WAS, ASM, CNAPP, and Container Security require the corresponding Tenable licenses; tools return an explanatory message when the feature is unavailable on your instance.

• Tenable VM (cloud) only — Tenable Security Center (on-prem) is not supported; its API differs substantially.

• Export scale: vulnerability/asset exports are capped at TENABLE_MAX_EXPORT records per call to keep responses LLM-sized. This is not a full data-lake export tool.

• Capped totals are lower bounds: a partial-export banner and metadata say when the cap was reached. At the end of the observed sample, has_more is false because no further offset is addressable through that capped call; truncated remains true to show that the source itself contains more data.

• No HTTP transport: credential-bearing operation is deliberately limited to stdio. Run one process per client trust boundary.

• Write surface is minimal by design: scan launch/stop and tag operations only. No remediation, recast, or user-management writes.

• APA country coverage relies on hostname prefixes when asset tags are absent; hostnames that don't encode location won't bucket (they are reported as unmapped rather than guessed).

License

MIT