{
  "type": "mcp-server",
  "slug": "exposure-case-builder",
  "name": "Exposure Case Builder",
  "author": "SpookyFox9",
  "description": "Ranks Tenable VM findings into cases and engineer-ready fix packages, with Claude-written cited narratives and a human-recorded decision.",
  "github_url": "https://github.com/SpookyFox9/exposure-case-builder",
  "license": "MIT",
  "tier": "contributed",
  "tags": [
    "triage",
    "prioritization",
    "remediation",
    "mcp",
    "tenable-vm",
    "case-management"
  ],
  "integrations": [
    "Tenable"
  ],
  "domains": [
    "vulnerability-management"
  ],
  "date_added": "2026-11-03",
  "last_reviewed": "2026-11-04",
  "works_with_tenable_hexa_mcp": false,
  "transport": "stdio",
  "runtime": "python",
  "auth_method": "none",
  "compatible_clients": [
    "Claude Code"
  ],
  "tools_exposed": [
    {
      "name": "fleet_summary",
      "description": "Totals for the loaded export: hosts, active findings by severity, case and fix-package counts, CISA KEV count, data-quality notes."
    },
    {
      "name": "case_queue",
      "description": "Ranked cases as two lists, single-vulnerability threats and patch backlogs, each row explaining why it ranks where it does."
    },
    {
      "name": "fix_queue",
      "description": "Ranked fix packages (a product plus a kind of fix) with what each contains and how many distinct actions it spans. order=coverage lists them in a greedy, heuristic order by hosts newly brought to zero urgent findings; the score rank is unchanged."
    },
    {
      "name": "case_file",
      "description": "One case: score breakdown, facts, the fix packages that address it, top vulnerabilities with CVEs, hosts, timeline, limitations and any recorded disposition."
    },
    {
      "name": "fix_package",
      "description": "One fix package: Tenable's fix actions with what each clears, contained impact, hosts, CVEs and advisories, and the cases it relieves."
    },
    {
      "name": "findings",
      "description": "The real finding records behind a case or package, paged, so a narrative can cite genuine finding ids."
    },
    {
      "name": "trend_diff",
      "description": "Compare with an earlier saved export (set EXPOSURE_CASE_BASELINE): counts per category, host overlap, data-quality counters, or a page of finding ids. A finding missing from the later export is never reported as fixed."
    },
    {
      "name": "export",
      "description": "Render a case or package as Markdown or CSV for a ticket; with write=true and confirm=true, save all formats to a fixed local directory."
    },
    {
      "name": "record_disposition",
      "description": "Record the analyst's decision (assigned, risk-accepted, false-positive, needs-info) as one appended line in a local log; needs confirm=true."
    }
  ],
  "resources_exposed": [],
  "prompts_exposed": [],
  "repo": {
    "found": true,
    "archived": false,
    "pushed_at": "2026-11-04T23:37:16Z",
    "stars": 0,
    "forks": 0,
    "open_issues": 0,
    "owner_type": "user",
    "language": "Python",
    "checked_at": "2026-11-05T20:35:15.821Z"
  },
  "url": "https://exchange.tenable.com/mcp-servers/exposure-case-builder",
  "json_url": "https://exchange.tenable.com/api/mcp-servers/exposure-case-builder.json",
  "markdown_url": "https://exchange.tenable.com/mcp-servers/exposure-case-builder.md",
  "source_url": "https://github.com/tenable/cyberagents-exchange/blob/main/mcp-servers/exposure-case-builder.md"
}