navi-mcp
MCP server exposing the Tenable navi CLI (Tenable VM / Tenable One) as 19 tools, plus companion Claude skills.
Baseline review at submission: an accuracy and overt-behavior check, not a full security audit, and it does not cover later changes to the repository. Learn more about our security review process.
Tools (19)
- navi_config_update
Sync navi.db from Tenable (assets, vulns, WAS, etc.).
- navi_config
Read or set navi configuration values.
- navi_explore_query
Run a raw SQL query against navi.db.
- navi_explore_data
Explore navi data (CVE, exploit, software, ports, routes, assets, and more).
- navi_explore_info
List environment info (users, scanners, scans, policies, tags, agents, etc.).
- navi_explore_api
Call an arbitrary Tenable API endpoint.
- navi_enrich_tag
Tag assets by plugin, CVE, CPE, CISA KEV, port, route, group, or query.
- navi_enrich_acr
Adjust Asset Criticality Rating (set/inc/dec) with a change reason.
- navi_enrich_add
Add assets to Tenable from an external source.
- navi_export
Export data to CSV (assets, vulns, compliance, by-tag with ACR/AES, and more).
- navi_scan
Create, start, stop, or evaluate scans.
- navi_was
Work with Tenable WAS (web application scanning / DAST) data.
- navi_action_delete
Delete tags, users, scans, assets, agents, or exclusions.
- navi_action_rotate
Rotate a user's API keys.
- navi_action_cancel
Cancel a running export.
- navi_action_encrypt
Encrypt a file.
- navi_action_decrypt
Decrypt a file.
- navi_action_mail
Email a report or file (Resend or SMTP).
- navi_action_push
Push a shell command or file to a remote Linux host (double-gated).
Resources (3)
- navi://workdir
The navi working directory and database location.
- navi://schema/assets
Schema for a navi.db table (templated by table name).
- navi://skill/navi-core
A bundled navi skill's content (templated by skill name).
Prompts (1)
- navi_workflow
Guided prompt that suggests a navi workflow for a described task.
navi-mcp is a Model Context Protocol server that exposes the Tenable navi
CLI (Tenable Vulnerability Management / Tenable One)
to AI assistants. It ships alongside 13 companion Claude skills that document how to drive
it well, the result of a full audit and rebuild verified against an authoritative recursive
navi --help capture.
What it does
The server surfaces 19 tools spanning navi’s full workflow — config/sync, data exploration
and raw SQL, asset tagging, ACR calibration, CSV export, scan control, WAS/DAST, and gated
actions (delete, key rotation, encrypt/decrypt, email, remote push). It also exposes navi
schema, working directory, and skill content as MCP resources, plus a workflow prompt.
Write and high-risk actions are gated (e.g. NAVI_MCP_ALLOW_WRITES=1, plus a second gate
for remote execution and email).
How it works
Built on FastMCP (Python), the server runs over stdio by default (Claude Desktop / Claude
Code) or streamable HTTP with --http. The MCP layer itself requires no auth; navi
authenticates to Tenable out-of-band with API keys. The repo bundles the server, the
13 corrected skills (in NAVI_SKILL_DIR layout and as packaged .skill files), an install
config generator, and step-by-step install docs.