# curb

> Enumerates the Tenable Hexa AI MCP tool surface, classifies each tool's privilege tier, and emits the minimum tool set, Tenable role, and MCP client config a described workflow needs.

- Type: Agent
- Author: amcdonnell-dot
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-08-13
- Source repository: https://github.com/amcdonnell-dot/CURB
- Repo state: not archived
- Last push: 2026-08-06T14:25:11Z
- Stars: 0 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable, Tenable Hexa AI MCP
- Domains: ai-security, identity-access
- Tags: mcp, least-privilege, api-key-scoping, governance, tenable-one
- Date added: 2026-08-06
- Works with the Tenable Hexa AI MCP server: yes
- Listing page: https://exchange.tenable.com/agents/curb
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/agents/curb.md

## What it does

curb enumerates the tool surface of the Tenable Hexa AI MCP server on a Tenable One Foundation or Advanced tenant, classifies each tool by the privilege tier it requires (Read, Write, or Manage), and turns a plain-English description of one real workflow into the smallest tool set that workflow needs -- plus a Tenable custom role recommendation and ready-to-paste MCP client config fragments for Claude Code, Claude Desktop, VS Code, and Cursor. It also diffs two tool-surface snapshots to catch drift between runs.

## How it works

curb never sits in an agent's runtime path and never proxies a tool call -- it runs at design time, offline except for one documented request. curb enumerate makes a single `tools/list` call against the Hexa AI MCP endpoint using your own Tenable API keys and writes the result to a surface file. Every other command -- map, scope, diff -- reads that file locally and never touches the network, calls a Tenable tool, or holds a credential. Classification is a verb-signal heuristic over tool names and descriptions, never a model call, producing a privilege tier and confidence score per tool, with unknown returned instead of a guess whenever the signal is genuinely absent. scope maps a workflow's plain-English intents onto the classified tool set and reports an ambiguity rather than resolving it when more than one tool could satisfy an intent. curb never creates or modifies anything in a Tenable tenant, and has no telemetry -- every recommendation is applied by hand, in the Tenable UI.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/agents/curb.json. The full index and how to read it: https://exchange.tenable.com/llms.txt