Tenable.sc MCP Server

This tool is not an officially supported Tenable project.

Production-ready Model Context Protocol (MCP) server for Tenable Security Center Plus. Features intelligent caching for 90% token savings and 1000x faster responses.

Latest: v1.3.1 (2026-06-24) - Patch Management Tool | Status: ✅ Production Ready

What's New in v1.3.1

• Tool 6: tsc_list_missing_patches - Comprehensive patch gap analysis
  • Universal mode: All OS types + third-party software (Chrome, Office, VMware, etc.)
  • Windows mode: KB articles and legacy MS bulletins
  • Smart parsing: Extracts KB IDs, vulnerability counts, third-party updates
  • Repository name auto-resolution (e.g., "Default" → ID 9)
  • Token efficient: 700-20,000 tokens depending on scope
  • 6 critical bugs fixed during implementation

See CHANGELOG.md for complete release notes.

Quick Start

# 1. Create .env file
cd tenable-sc-mcp-server
cp .env.example .env
nano .env  # Add your Tenable.sc credentials

# 2. Build and start
docker build -t tenable-sc-mcp:latest .
docker-compose up -d

# Server running at: http://localhost:8000/mcp

Required .env configuration:

TSC_URL=https://your-sc-server.com
TSC_ACCESS_KEY=your-access-key
TSC_SECRET_KEY=your-secret-key
TSC_VERIFY_SSL=true

Features

• 90% token savings - Intelligent Redis caching
• 1000x faster - <1ms cached responses vs 200-500ms API calls
• 100+ resources - Full Tenable.sc REST API coverage
• Zero storage - Stateless proxy with optional cache
• RBAC enforced - Respects all Tenable.sc permissions
• Production ready - Docker Compose with health checks

Available Tools

High-Level Tools (Optimized for LLMs)

See USER_GUIDE.md for complete documentation and examples.

Core API Tools

• tsc_resource_action - Unified CRUD for all resources (list, get, create, update, delete)
• tsc_catalog - Browse 100+ available resources
• tsc_current_user - Verify API identity and permissions
• tsc_analyze - Run analysis queries (cached)
• tsc_cache_stats / tsc_cache_clear - Cache management

See docs/TOOLS.md for complete tool reference.

Configuration

OpenCode

Add to opencode.json:

{
  "mcp": {
    "tenable-sc": {
      "type": "remote",
      "url": "http://localhost:8000/mcp",
      "enabled": true
    }
  }
}

Claude Desktop

Add to MCP settings:

{
  "mcpServers": {
    "tenable-sc": {
      "command": "docker",
      "args": ["run", "--rm", "-i",
        "-e", "TSC_URL=https://your-sc-server.com",
        "-e", "TSC_ACCESS_KEY=your-key",
        "-e", "TSC_SECRET_KEY=your-secret",
        "tenable-sc-mcp:latest"]
    }
  }
}

Architecture

MCP Client (OpenCode/Claude)
        ↓
tenable-sc-mcp server
        ↓
Redis Cache (90% hit rate)
        ↓
Tenable.sc REST API

Key Principles (see DESIGN_PRINCIPLES.md):

• Unified filters dict parameter (55+ filters)
• Smart caching with data-type-specific TTLs
• Token optimization (80%+ reduction target)
• Comprehensive error handling

Filter System

New in v1.2.0: All tools use unified filters dict parameter.

# Example: Find critical assets with CVE
tsc_list_vulns_by_cve("CVE-2021-44228", filters={
    "asset_criticality": "7-10",    # Range format required
    "severity": "critical",
    "exploit_available": "Yes"
})

Important Rules:

• Scoring filters use range format: "7-10" NOT ">7"
• Applies to: asset_criticality, vpr_score, aes_score, cvss_v3_base_score, epss_score
• Common filters: severity, exploit_available, cve, plugin_id, port, protocol

Documentation:

• Complete reference: FILTER_FORMAT_REFERENCE.md
• MCP resource: tenable-sc://filters/format-reference
• Examples: USER_GUIDE.md

Deployment Options

Docker Compose (Recommended)

docker build -t tenable-sc-mcp:latest .
docker-compose up -d

Standalone Docker

docker run -d --name tenable-sc-mcp \
  -p 8000:8000 \
  -v ~/.tenable-sc-mcp.env:/config/tsc.env:ro \
  tenable-sc-mcp:latest \
  --transport streamable-http \
  --host 0.0.0.0 --port 8000 \
  --env-file /config/tsc.env

Local Python

python3 -m venv .venv
source .venv/bin/activate
pip install .
export TSC_URL="https://sc.example.com"
export TSC_ACCESS_KEY="key"
export TSC_SECRET_KEY="secret"
tenable-sc-mcp --transport stdio

Troubleshooting

Containers won't start:

docker compose logs tenable-sc-mcp
# Check: Missing .env, invalid TSC_URL, firewall

Can't reach Tenable.sc:

curl -k https://your-sc-server.com/rest/currentUser
# Expected: "invalid token" (endpoint reachable)

Cache not working:

docker ps --filter "name=redis"  # Should show (healthy)
# Ask MCP: "show me cache statistics"

Remote clients can't connect:

docker ps --filter "name=tenable-sc-mcp"  # Should show 0.0.0.0:8000
curl http://your-server-ip:8000/mcp

See SUPPORT.md for more help.

Security

• RBAC enforced - Uses your Tenable.sc API keys, all permissions apply
• No credential storage - Environment variables only
• SSL/TLS support - Set TSC_VERIFY_SSL=true in production
• No built-in auth - Bind to trusted networks only (127.0.0.1 for local)

Best practices:

• ❌ Never commit API keys to git
• ✅ Use env files with mode 0600
• ✅ Create dedicated least-privilege API user in Tenable.sc
• ✅ Use firewall rules or SSH tunnels for remote access

See SECURITY.md for vulnerability reporting.

Documentation

User Docs

• USER_GUIDE.md - Complete tool usage guide
• FILTER_FORMAT_REFERENCE.md - Filter system reference
• CACHING_DEEP_DIVE.md - Cache behavior and performance
• TEST_PROMPTS.md - Ready-to-use test queries

Developer Docs

• ARCHITECTURE.md - System design
• DESIGN_PRINCIPLES.md - Tool development patterns
• TOOLS_ROADMAP.md - Feature roadmap and pending tools
• HANDOFF.md - LLM-friendly development handoff

Project

• CONTRIBUTING.md - Contribution guidelines
• SECURITY.md - Security policy
• SUPPORT.md - Support resources

Compatibility

Contributing

Contributions welcome! See CONTRIBUTING.md for guidelines.

Quick links:

• Report a bug
• Request a feature
• View issues

License

GNU GPL v3.0 - See LICENSE

Need help? Check SUPPORT.md or open an issue.