{
  "type": "mcp-server",
  "slug": "tenable-activity-mcp",
  "name": "Tenable Activity MCP",
  "author": "brendanong95",
  "description": "Turns the Tenable VM audit log into answered questions — per-actor baselines, API-key usage attribution, and explained anomaly findings computed in Python rather than raw events handed to the model.",
  "github_url": "https://github.com/brendanong95/tenable-activity-mcp",
  "license": "MIT",
  "tier": "contributed",
  "tags": [
    "audit-log",
    "anomaly-detection",
    "insider-threat",
    "api-key-monitoring",
    "detection-engineering",
    "baselining"
  ],
  "integrations": [
    "Tenable"
  ],
  "domains": [
    "security-operations"
  ],
  "date_added": "2026-08-19",
  "last_reviewed": "2026-08-19",
  "works_with_tenable_hexa_mcp": false,
  "transport": "stdio",
  "runtime": "python",
  "auth_method": "api-key",
  "compatible_clients": [
    "Claude Code",
    "Claude Desktop"
  ],
  "tools_exposed": [
    {
      "name": "list_activity_events",
      "description": "Event feed for a date window with actor/action filters; follows the pagination cursor automatically and returns a resumable next_token if the safety cap is hit."
    },
    {
      "name": "summarize_activity",
      "description": "Deterministic rollup for a window: counts by actor, action, CRUD type and access type, plus failure and anonymous rates."
    },
    {
      "name": "get_api_key_usage",
      "description": "API-key-driven activity only, grouped by actor: action breakdown, distinct source IPs, and first/last seen timestamps."
    },
    {
      "name": "detect_anomalies",
      "description": "Compares a window against each actor's stored baseline: new actors, volume spikes, unseen source IPs, failed-event bursts, sustained failure rates, off-hours spikes and never-before-seen actions, each with evidence and a reasoning sentence."
    },
    {
      "name": "get_actor_profile",
      "description": "One actor's full picture: best-effort role, all-time action breakdown, access types, and every source IP seen."
    },
    {
      "name": "check_permission_prereqs",
      "description": "Pass/fail on whether the configured API keys can actually read the audit log, with plain-language remediation text."
    }
  ],
  "resources_exposed": [],
  "prompts_exposed": [],
  "repo": {
    "found": true,
    "archived": false,
    "pushed_at": "2026-08-19T16:34:01Z",
    "stars": 0,
    "forks": 0,
    "open_issues": 0,
    "owner_type": "user",
    "language": "Python",
    "checked_at": "2026-11-05T20:35:15.821Z"
  },
  "url": "https://exchange.tenable.com/mcp-servers/tenable-activity-mcp",
  "json_url": "https://exchange.tenable.com/api/mcp-servers/tenable-activity-mcp.json",
  "markdown_url": "https://exchange.tenable.com/mcp-servers/tenable-activity-mcp.md",
  "source_url": "https://github.com/tenable/cyberagents-exchange/blob/main/mcp-servers/tenable-activity-mcp.md"
}