Tenable MSSP MCP Server

- Tenable MSSP Portal API keys with Administrator privileges.
- Tenable child containers licensed withhexato use Tenable Hexa AI MCP Server tools.
- Tenable child containers licensed withvmto use thebulk_vm_cve_querytool.
- Python 3.14 or newer.
- uvorpipfor local installation.
- An MCP client capable of launching STDIO MCP servers (Codex, Claude, Gemini CLI, etc.).

git clone https://github.com/andrewspearson/tenable-mcp-mssp.git

TENABLE_MSSP_PORTAL_ACCESS_KEY=replace-with-your-access-key TENABLE_MSSP_PORTAL_SECRET_KEY=replace-with-your-secret-key # Optional: path to a plain-text child container UUID allowlist. # TENABLE_MCP_MSSP_CHILD_CONTAINER_SCOPE_FILE=scopes/allowed-child-containers.txt # Optional: DEBUG, INFO, WARNING, ERROR, or CRITICAL # TENABLE_MCP_MSSP_LOG_LEVEL=WARNING

Attach Codex / Claude / Gemini CLI / etc. to tenable-mcp-mssp as a STDIO server:

codex mcp add tenable-mcp-mssp -- /path/to/tenable-mcp-mssp/.venv/bin/python -m tenable_mcp_mssp.server

claude mcp add tenable-mcp-mssp -- /path/to/tenable-mcp-mssp/.venv/bin/python -m tenable_mcp_mssp.server

gemini mcp add tenable-mcp-mssp /path/to/tenable-mcp-mssp/.venv/bin/python -m tenable_mcp_mssp.server

Your prompt must explicitly say to use the bulk_vm_cve_query tool. Example: "Use the bulk_vm_cve_query tool to find all child containers and assets with CVE-2026-31431".

SetTENABLE_MCP_MSSP_CHILD_CONTAINER_SCOPE_FILEto restrict child-container action tools to an explicit positive allowlist. If this value is unset or blank, all otherwise eligible child containers are allowed.

The scope file is plain text with one child container UUID per line. Blank lines and full-line comments starting with#are ignored.

# production batch 1 75e2d005-946b-46fe-8e73-7887d310de33 b210fe55-741b-49b4-ac3d-cafec153006f

Relative scope paths are resolved from the MCP server's configured working directory. The allowlist is checked before other eligibility gates, but it does not override existing exclusions: expired containers, malformed expiration data, missing child accounts, andlicenseType: "ao"containers are still blocked from action.

SetTENABLE_MCP_MSSP_LOG_LEVELtoDEBUG,INFO,WARNING(default),ERROR, orCRITICAL. All logs are sent tostderr.

codex mcp add --env TENABLE_MCP_MSSP_LOG_LEVEL=DEBUG tenable-mcp-mssp -- /bin/sh -c 'exec /path/to/tenable-mcp-mssp/.venv/bin/python -m tenable_mcp_mssp.server 2>> /path/to/logs/tenable-mcp-mssp.log'

- list_mssp_child_accounts: List raw MSSP child account objects returned by Tenable, including license data.
- list_available_tenable_mcp_tools: Discover the Tenable Hexa AI MCP Server tool catalog for one child container licensed forhexa.
- get_child_container_scope: Show the configured child container allowlist scope for action tools.
- run_tenable_mcp_tool_for_child: Run one Tenable Hexa AI MCP Server tool on one child container licensed forhexa.
- run_tenable_mcp_recipe_for_child: Validate a known sequence of Tenable Hexa AI MCP Server tool calls on one child container licensed forhexa.
- run_tenable_mcp_recipe_across_child_containers: Run a known working recipe across multiple child containers licensed forhexawith controlled fan-out.
- bulk_vm_cve_query: Start a curated direct pyTenable VM export for CVEs across eligible child containers licensed forvm. This tool should be used only when explicitly requested by name.
- get_bulk_vm_cve_query_status: Check status for a server-managedbulk_vm_cve_queryrun.
- get_bulk_vm_cve_query_result: Read final summary and artifact paths for a server-managedbulk_vm_cve_queryrun.

Zero-setup MCP gateway securely connecting AI to your tools with authentication and workflows

Manage web application security through the Fastly NGWAF API using natural language.

MCP server for the xAI Management API — API keys, ACLs, audit logs, and billing

Securely manage secrets and policies in HashiCorp Vault through an MCP interface.

Interact with LicenseSpring's License API and Management API.

Securely access secrets from Doppler's secret management platform using a Doppler API token.

A RESTful API to programmatically interact with the Opal Security platform.

Threatlocker-mcp is a Model Context Protocol server that connects AI assistants such as Claude Desktop and Claude Code with the ThreatLocker Portal API.

A secure MCP gateway that acts as a proxy, providing authentication, tool discovery, caching, and guardrail enforcement.