# ThreatCorralling

> Correlates results from Checkmarx with Tenable WAS via a JSON glue file.

- Type: MCP server
- Author: giraldomauricio
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-08-20
- Source repository: https://github.com/giraldomauricio/threatcorraling
- Repo state: not archived
- Last push: 2026-08-20T01:44:53Z
- Stars: 0 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable, Checkmarx One, SecurityScorecard
- Domains: application-security, vulnerability-management
- Tags: Checkmarx, SAST, WAS, Tenable, CxOne
- Date added: 2026-08-05
- Transport: stdio
- Runtime: python
- Auth method: api-key
- Compatible clients: Claude Desktop, Claude Code
- Tools:
  - `get_checkmarx_sast_for_scoped_projects`: Get Checkmarx Projects selected from the JSON.
  - `get_tenable_was_for_scoped_domains`: Get Tenable WAS results selected from the JSON.
  - `get_compliance_mapping`: Matched Compliance metrics with the results from the correlation
  - `get_approved_remediation_pattern`: Suggest remediation patterns where the code or the finding allows it based in the correlations
  - `generate_regression_test_template`: Suggest regression tests that can be shared with developers to proff the code against the finding.
  - `get_security_scorecard_findings`: Gets data from Security Scorecard to add to TenableWAS findings.
- Listing page: https://exchange.tenable.com/mcp-servers/cxone-tenablewas-correlation
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/mcp-servers/cxone-tenablewas-correlation.md

ThreatCorraling connects CheckmarxOne vulnerabilities (SAST, SCA, KICS) with results from TenableWAS (Formerly Ermetic) for a deep analysis of the risk from Left (Code) to Right (Deployment)

## What it does

ThreatCorralling is an intelligent, extensible Vulnerability Correlation Agent and Model Context Protocol (MCP) server. It bridges the gap between disparate security tools by analyzing scoped assets across platforms like Checkmarx SAST and Tenable WAS.

## How it works

Using FastMCP wrapper, the file sits in the background and waits for an external AI to ask for a correlation between CxOne Projets and Tenable WAS targets. It then executes the tools locally and passes the data back to the AI. For performance, the server caches the results for further use. This feature can be replaced by a database or any other better persistence method.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/mcp-servers/cxone-tenablewas-correlation.json. The full index and how to read it: https://exchange.tenable.com/llms.txt