Supercharged Tenable Identity Exposure MCP Server
ContributedSupercharged Tenable Identity Exposure MCP: AD search, ACL decoding, attack-path analysis and identity 360 view
Tools (45)
- query_ad_objects
Search all AD objects with a typed filter expression (admincount>0 AND isbreached=true) evaluated in-memory over a cached snapshot; no server-side filter exists in the TIE API.
- get_ad_object
Look up one AD object by DN, SID, or samAccountName; optionally decode its ntSecurityDescriptor into readable ACEs with resolved trustees and named rights.
- get_topology
Discover the environment as a Forest -> Domain tree, returning infrastructure and directory IDs used by other tools.
- get_preferred_profile
Return the user's preferred (default) configuration profile so profile-scoped tools query the right lens.
- get_blast_radius
Control-graph forward reachability: everything a principal can reach by chaining membership, ACL rights, delegation, SID history, GPO, DCSync, and password reuse.
- get_control_paths
Shortest control path between two principals, returned as the explicit edge chain (how X can take over Y).
- get_asset_exposure
Control-graph reverse reachability: every principal that can reach a protected asset or the Tier-0 set, each with its shortest inbound path.
- get_tier0
Compute the derived Tier-0 set: privileged groups plus everyone who can become privileged, each with its escalation path.
- get_identity_360
Every Indicator-of-Exposure deviance concerning one AD object across three layers (filed-on-target, risky-trustee, container-inherited), enriched with severity/remediation bands and Tenable deeplinks, sorted worst-first.
- get_identity_360_summary
Batch per-identity deviance counts by severity band (for report badges); drill into any identity with get_identity_360.
- AD object
List, get, and search Active Directory objects by directory, infrastructure, checker, or event.
- Profile
List, create, get, update, delete, clone, unstage, and commit configuration profiles (analysis lenses).
- Deviance
List, get, export, update, and search Indicator-of-Exposure deviances by directory, checker, event, or AD object.
- Checker
List and get Indicator-of-Exposure checkers (the IOE definitions).
- Checker option
List and create per-profile checker options, including severity (O-CRITICITY) and enablement.
- Reason
List and get deviance reasons (why a checker fired).
- Category
List and get checker categories.
- Attack
List and export Indicators of Attack.
- Attack type
List available attack types.
- Attack type configuration
Get and update attack-type detection configuration.
- Attack type option
List and create per-profile attack-type options.
- Directory
List, create, get, update, and delete directories (domains).
- Infrastructure
List, create, get, update, and delete infrastructures (forests).
- Topology
Get the forest/domain topology graph.
- Event
Get and search directory-change events.
- Alert
List, get, and update alerts.
- Dashboard
List, create, get, update, and delete dashboards.
- Widget
List, create, get, update, delete, and configure dashboard widgets.
- User
List, create, get, update, delete users; change password; login/logout; and set user roles.
- Role
List, create, get, update, delete, clone roles and set role permissions.
- Score
Get security scores.
- Metrics
Get product metrics.
- Cloud statistics
Get cloud statistics.
- Email notifier
List, create, get, update, delete, and test email notifiers.
- Syslog
List, create, get, update, delete, and test syslog outputs.
- License
Get and update the product license.
- Lockout policy
Get and update the account lockout policy.
- LDAP configuration
Get and update LDAP authentication configuration.
- SAML configuration
Get, update, and generate SAML authentication configuration.
- Application setting
Get and update application settings.
- Preference
Get and update user preferences.
- API key
Get and create API keys.
- Report access token
Get and refresh report access tokens.
- Relay
Get relay configuration.
- About
Get product version and build information.
The TIE MCP Server exposes Tenable Identity Exposure to AI agents as a set of Model Context Protocol tools. Beyond 1:1 coverage of the TIE API, it adds a query engine, security-descriptor decoding, a cross-object control graph, and a per-identity deviance “360” view — turning raw API responses into something an LLM can actually reason over.
What it does
- In-memory AD object search. TIE has no server-side filter on
/api/ad-objects; this server scans the directory once, builds a typed index, and answers expression queries (admincount>0 AND isbreached=true) in milliseconds — cached and reused across a session. - Permission decoding. Turns the dense
ntSecurityDescriptorSDDL blob into structured ACEs with trustee SIDs resolved to names, rights named, and object-types resolved via the live schema. - Attack-path analysis. Builds a control graph (group membership, ACL rights, delegation, SID history, GPO, DCSync, password reuse) and answers blast-radius, shortest control-path, asset-exposure, and derived-Tier-0 questions.
- Identity 360. For any AD object, returns every Indicator-of-Exposure deviance concerning it across three layers — filed on it, where it is the risky ACE trustee on another object, and inherited from a container — sorted by severity with deeplinks back into the Tenable UI.
- Full API coverage. 131 auto-generated tools grouped by resource (Profile, Deviance, Directory, User, Role, …), plus 10 hand-built convenience tools.
How it works
A single cached snapshot of the directory powers the query engine, the control graph, and the deviance index; all three share a TTL and warm at startup. Tool handlers are transport-agnostic, and the server enforces per-tool safety controls (read / write / destructive) so a client can advertise only the tools it should. Facts, not verdicts: it reports reachability, edges, and Tenable’s own findings without re-scoring.