{
  "type": "mcp-server",
  "slug": "tenable-patch-management-logs-mcp",
  "name": "Tenable Patch Management Logs MCP",
  "author": "brendanong95",
  "description": "Answers 'why did patching fail?' from Tenable Patch Management SaaS logs — a server bundle and client logs become ranked issues, symptom verdicts and anomaly findings computed in Python, with no credentials and no network access.",
  "github_url": "https://github.com/brendanong95/tenable-patch-management-logs-mcp",
  "license": "MIT",
  "tier": "contributed",
  "tags": [
    "patch-management",
    "log-analysis",
    "troubleshooting",
    "root-cause-analysis",
    "anomaly-detection",
    "offline"
  ],
  "integrations": [
    "Tenable"
  ],
  "domains": [
    "platform-operations",
    "vulnerability-management"
  ],
  "date_added": "2026-10-02",
  "last_reviewed": "2026-10-05",
  "works_with_tenable_hexa_mcp": false,
  "transport": "stdio",
  "runtime": "python",
  "auth_method": "none",
  "compatible_clients": [
    "Claude Code",
    "Claude Desktop"
  ],
  "tools_exposed": [
    {
      "name": "check_log_sources",
      "description": "First call: which logs are readable, the devices and roles inside them, the period each one covers, TPM versions with version advisories, files whose format was not recognised, and a flag on anything that does not look like a SaaS tenant's logs."
    },
    {
      "name": "summarize_errors",
      "description": "Every warning and error in a window grouped into distinct issues and ranked: counts, first and last seen, affected devices, decoded error codes, root causes from stack traces, the latest example with file and line, and a fix where the signature is recognised."
    },
    {
      "name": "diagnose",
      "description": "Runs one of ten symptom playbooks (patch install failures, content download, client connectivity, Tenable VM integration, feeds, content publication, service health, database, client upgrade, feature-update readiness) and returns a verdict with the evidence behind it."
    },
    {
      "name": "search_logs",
      "description": "Literal or regex search across every log, matching whole entries including multi-line messages and stack traces, de-duplicated, with context lines and paging."
    },
    {
      "name": "build_timeline",
      "description": "Merges server and client logs into one chronological sequence around a moment or across a window, with consecutive repeats collapsed and WARN-and-above always kept when rows are sampled."
    },
    {
      "name": "compare_devices",
      "description": "What a failing device has in its logs that a healthy one does not, plus the signatures that are merely far more frequent on the failing one."
    },
    {
      "name": "detect_log_anomalies",
      "description": "Compares a recent window with the days before it: error signatures that are new, error rates above the spike threshold, repeated service starts and logs that went quiet, each with evidence, the threshold crossed and a reasoning sentence."
    },
    {
      "name": "record_baseline_snapshot",
      "description": "Writes the current per-day error counts to a local SQLite file so anomaly detection keeps a baseline after TPM rotates the logs away. The only tool that writes anything."
    },
    {
      "name": "list_log_files",
      "description": "Every log file with its device, role, documented purpose, size and the period it covers, counted by device, role and log name."
    },
    {
      "name": "explain",
      "description": "What a given log file records, what an error code means (Win32, MSI, HRESULT, Windows Update, CBS, HTTP), or what a symptom or known issue covers."
    },
    {
      "name": "add_log_source",
      "description": "Registers a folder, UNC path, single log file or .zip/.tar.gz bundle to analyse, with an optional time zone for the machine that wrote it; remembered between sessions."
    },
    {
      "name": "remove_log_source",
      "description": "Unregisters a source and deletes the server's extracted copy of a bundle, leaving the original untouched."
    }
  ],
  "resources_exposed": [],
  "prompts_exposed": [],
  "repo": {
    "found": true,
    "archived": false,
    "pushed_at": "2026-10-02T03:31:41Z",
    "stars": 0,
    "forks": 0,
    "open_issues": 0,
    "owner_type": "user",
    "language": "Python",
    "checked_at": "2026-11-05T20:35:15.821Z"
  },
  "url": "https://exchange.tenable.com/mcp-servers/tenable-patch-management-logs-mcp",
  "json_url": "https://exchange.tenable.com/api/mcp-servers/tenable-patch-management-logs-mcp.json",
  "markdown_url": "https://exchange.tenable.com/mcp-servers/tenable-patch-management-logs-mcp.md",
  "source_url": "https://github.com/tenable/cyberagents-exchange/blob/main/mcp-servers/tenable-patch-management-logs-mcp.md"
}