# navi-mcp

> MCP server exposing the Tenable navi CLI (Tenable VM / Tenable One) as 19 tools, plus companion Claude skills.

- Type: MCP server
- Author: packetchaos
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-07-17
- Source repository: https://github.com/packetchaos/navi-mcp
- Repo state: not archived
- Last push: 2026-09-02T22:07:42Z
- Stars: 0 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable, Anthropic
- Domains: platform-operations
- Tags: tenable, navi, mcp, vulnerability-management, exposure-management, asset-tagging, fastmcp
- Date added: 2026-07-15
- Transport: both
- Runtime: python
- Auth method: none
- Compatible clients: Claude Desktop, Claude Code, Cursor
- Tools:
  - `navi_config_update`: Sync navi.db from Tenable (assets, vulns, WAS, etc.).
  - `navi_config`: Read or set navi configuration values.
  - `navi_explore_query`: Run a raw SQL query against navi.db.
  - `navi_explore_data`: Explore navi data (CVE, exploit, software, ports, routes, assets, and more).
  - `navi_explore_info`: List environment info (users, scanners, scans, policies, tags, agents, etc.).
  - `navi_explore_api`: Call an arbitrary Tenable API endpoint.
  - `navi_enrich_tag`: Tag assets by plugin, CVE, CPE, CISA KEV, port, route, group, or query.
  - `navi_enrich_acr`: Adjust Asset Criticality Rating (set/inc/dec) with a change reason.
  - `navi_enrich_add`: Add assets to Tenable from an external source.
  - `navi_export`: Export data to CSV (assets, vulns, compliance, by-tag with ACR/AES, and more).
  - `navi_scan`: Create, start, stop, or evaluate scans.
  - `navi_was`: Work with Tenable WAS (web application scanning / DAST) data.
  - `navi_action_delete`: Delete tags, users, scans, assets, agents, or exclusions.
  - `navi_action_rotate`: Rotate a user's API keys.
  - `navi_action_cancel`: Cancel a running export.
  - `navi_action_encrypt`: Encrypt a file.
  - `navi_action_decrypt`: Decrypt a file.
  - `navi_action_mail`: Email a report or file (Resend or SMTP).
  - `navi_action_push`: Push a shell command or file to a remote Linux host (double-gated).
- Resources:
  - `navi://workdir`: The navi working directory and database location.
  - `navi://schema/assets`: Schema for a navi.db table (templated by table name).
  - `navi://skill/navi-core`: A bundled navi skill's content (templated by skill name).
- Prompts:
  - `navi_workflow`: Guided prompt that suggests a navi workflow for a described task.
- Listing page: https://exchange.tenable.com/mcp-servers/navi-mcp
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/mcp-servers/navi-mcp.md

navi-mcp is a Model Context Protocol server that exposes the [Tenable **navi**
CLI](https://github.com/packetchaos/navi) (Tenable Vulnerability Management / Tenable One)
to AI assistants. It ships alongside 13 companion Claude skills that document how to drive
it well, the result of a full audit and rebuild verified against an authoritative recursive
`navi --help` capture.

## What it does

The server surfaces 19 tools spanning navi's full workflow — config/sync, data exploration
and raw SQL, asset tagging, ACR calibration, CSV export, scan control, WAS/DAST, and gated
actions (delete, key rotation, encrypt/decrypt, email, remote push). It also exposes navi
schema, working directory, and skill content as MCP resources, plus a workflow prompt.
Write and high-risk actions are gated (e.g. `NAVI_MCP_ALLOW_WRITES=1`, plus a second gate
for remote execution and email).

## How it works

Built on FastMCP (Python), the server runs over stdio by default (Claude Desktop / Claude
Code) or streamable HTTP with `--http`. The MCP layer itself requires no auth; navi
authenticates to Tenable out-of-band with API keys. The repo bundles the server, the
13 corrected skills (in `NAVI_SKILL_DIR` layout and as packaged `.skill` files), an install
config generator, and step-by-step install docs.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/mcp-servers/navi-mcp.json. The full index and how to read it: https://exchange.tenable.com/llms.txt