RiskProof
Agentic vulnerability investigator that turns Tenable/Nessus findings into evidence-backed remediation decisions
Baseline review at submission: an accuracy and overt-behavior check, not a full security audit, and it does not cover later changes to the repository. Learn more about our security review process.
Tools (12)
- import_nessus
Import a .nessus report from the operator-configured import directory and return a KEV-aware triage summary with ranked candidates
- import_tenable
Read-only Tenable Vulnerability Management export via API, with an optional asset-tag filter
- list_tenable_tags
List the tenant's Tenable tag categories and values to build a tag filter
- investigate_finding
Build the evidence record and risk assessment for findings (batches of 25)
- enrich_threat_intel
Fetch EPSS scores and CISA KEV status for CVEs, with provenance
- verify_applicability
Cross-check scanner claims against observed versions and flag suspected false positives
- validate_exposure
Non-destructive connectivity, banner and certificate checks against allowlisted targets only
- analyze_exploit_scenario
Describe exploit prerequisites, exposure, KEV-grounded consequences and explicit uncertainties
- simulate_remediation
Compare fix, restrict and verify options and their expected risk effects
- execute_risk_policy
Apply a P1-P4 decision table and record approval-gated, dry-run-by-default actions
- get_audit_trail
Read the append-only audit trail for a finding or recent activity, including pending actions
- generate_report
Write a self-contained HTML report of investigated findings (owner-only file permissions)
For AI agents: this listing as JSON or Markdown. It is one of 140 listings in the full index.
RiskProof is an MCP server that turns raw scanner output into defensible remediation decisions. It is an investigator, not a scanner and not a generic CVSS calculator: it evaluates what a finding means for your organization and records its reasoning.
What it does
- Imports findings from a Nessus
.nessusreport or from Tenable Vulnerability Management (read-only export, optional tag filter). - Enriches CVEs with FIRST EPSS scores, CISA KEV status and, optionally, GreyNoise exploitation signals. EPSS is always reported as a statistical probability, never as a claim about a specific system.
- Applies operator-supplied asset context (criticality, environment, internet exposure) and flags suspected false positives.
- Runs authorized, non-destructive validation checks (TCP connect, HTTP banner, TLS certificate dates) against targets on an operator-controlled allowlist.
- Produces exploit scenarios, remediation what-ifs and P1-P4 policy decisions, and writes a self-contained HTML report.
How it works
RiskProof runs locally over stdio, one instance per analyst, and stores findings, evidence and an append-only audit trail in SQLite. Scoring follows a documented decision table rather than a black-box score. Remediation actions are dry-run and approval-gated by default, and no remediation executors exist yet, so nothing can change a system. Import and report directories, validation targets and API credentials are operator configuration that tool arguments cannot override.
Outbound network calls go to the EPSS and KEV feeds, to the Tenable VM API (only when import_tenable is used) and to GreyNoise (only when a key is configured), plus the allowlisted validation targets. Tenable and GreyNoise keys are read from the server’s process environment, never from a file or tool input. Setup uses uv sync and uv run riskproof serve. An offline demo on bundled SAMPLE data runs with uv run riskproof demo.