# Supercharged Tenable Identity Exposure MCP Server

> Supercharged Tenable Identity Exposure MCP: AD search, ACL decoding, attack-path analysis and identity 360 view

- Type: MCP server
- Author: taherkaraki
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-07-17
- Source repository: https://github.com/taherkaraki/tie-mcp-server
- Repo state: not archived
- Last push: 2026-07-28T10:47:39Z
- Stars: 17 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: TypeScript
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable
- Domains: identity-access
- Tags: active-directory, identity-security, attack-paths, indicators-of-exposure, mcp, tenable, security, identity-exposure, identity exposure, indicators-of-attack, tie
- Date added: 2026-07-13
- Transport: stdio
- Runtime: node
- Auth method: api-key
- Compatible clients: Claude Desktop, Claude Code, Cursor, Continue
- Tools:
  - `query_ad_objects`: Search all AD objects with a typed filter expression (admincount>0 AND isbreached=true) evaluated in-memory over a cached snapshot; no server-side filter exists in the TIE API.
  - `get_ad_object`: Look up one AD object by DN, SID, or samAccountName; optionally decode its ntSecurityDescriptor into readable ACEs with resolved trustees and named rights.
  - `get_topology`: Discover the environment as a Forest -> Domain tree, returning infrastructure and directory IDs used by other tools.
  - `get_preferred_profile`: Return the user's preferred (default) configuration profile so profile-scoped tools query the right lens.
  - `get_blast_radius`: Control-graph forward reachability: everything a principal can reach by chaining membership, ACL rights, delegation, SID history, GPO, DCSync, and password reuse.
  - `get_control_paths`: Shortest control path between two principals, returned as the explicit edge chain (how X can take over Y).
  - `get_asset_exposure`: Control-graph reverse reachability: every principal that can reach a protected asset or the Tier-0 set, each with its shortest inbound path.
  - `get_tier0`: Compute the derived Tier-0 set: privileged groups plus everyone who can become privileged, each with its escalation path.
  - `get_identity_360`: Every Indicator-of-Exposure deviance concerning one AD object across three layers (filed-on-target, risky-trustee, container-inherited), enriched with severity/remediation bands and Tenable deeplinks, sorted worst-first.
  - `get_identity_360_summary`: Batch per-identity deviance counts by severity band (for report badges); drill into any identity with get_identity_360.
  - `AD object`: List, get, and search Active Directory objects by directory, infrastructure, checker, or event.
  - `Profile`: List, create, get, update, delete, clone, unstage, and commit configuration profiles (analysis lenses).
  - `Deviance`: List, get, export, update, and search Indicator-of-Exposure deviances by directory, checker, event, or AD object.
  - `Checker`: List and get Indicator-of-Exposure checkers (the IOE definitions).
  - `Checker option`: List and create per-profile checker options, including severity (O-CRITICITY) and enablement.
  - `Reason`: List and get deviance reasons (why a checker fired).
  - `Category`: List and get checker categories.
  - `Attack`: List and export Indicators of Attack.
  - `Attack type`: List available attack types.
  - `Attack type configuration`: Get and update attack-type detection configuration.
  - `Attack type option`: List and create per-profile attack-type options.
  - `Directory`: List, create, get, update, and delete directories (domains).
  - `Infrastructure`: List, create, get, update, and delete infrastructures (forests).
  - `Topology`: Get the forest/domain topology graph.
  - `Event`: Get and search directory-change events.
  - `Alert`: List, get, and update alerts.
  - `Dashboard`: List, create, get, update, and delete dashboards.
  - `Widget`: List, create, get, update, delete, and configure dashboard widgets.
  - `User`: List, create, get, update, delete users; change password; login/logout; and set user roles.
  - `Role`: List, create, get, update, delete, clone roles and set role permissions.
  - `Score`: Get security scores.
  - `Metrics`: Get product metrics.
  - `Cloud statistics`: Get cloud statistics.
  - `Email notifier`: List, create, get, update, delete, and test email notifiers.
  - `Syslog`: List, create, get, update, delete, and test syslog outputs.
  - `License`: Get and update the product license.
  - `Lockout policy`: Get and update the account lockout policy.
  - `LDAP configuration`: Get and update LDAP authentication configuration.
  - `SAML configuration`: Get, update, and generate SAML authentication configuration.
  - `Application setting`: Get and update application settings.
  - `Preference`: Get and update user preferences.
  - `API key`: Get and create API keys.
  - `Report access token`: Get and refresh report access tokens.
  - `Relay`: Get relay configuration.
  - `About`: Get product version and build information.
- Listing page: https://exchange.tenable.com/mcp-servers/supercharged-tenable-identity-exposure-mcp-server
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/mcp-servers/supercharged-tenable-identity-exposure-mcp-server.md

The TIE MCP Server exposes Tenable Identity Exposure to AI agents as a set of Model Context Protocol tools. Beyond 1:1 coverage of the TIE API, it adds a query engine, security-descriptor decoding, a cross-object control graph, and a per-identity deviance "360" view — turning raw API responses into something an LLM can actually reason over.

## What it does

- **In-memory AD object search.** TIE has no server-side filter on `/api/ad-objects`; this server scans the directory once, builds a typed index, and answers expression queries (`admincount>0 AND isbreached=true`) in milliseconds — cached and reused across a session.
- **Permission decoding.** Turns the dense `ntSecurityDescriptor` SDDL blob into structured ACEs with trustee SIDs resolved to names, rights named, and object-types resolved via the live schema.
- **Attack-path analysis.** Builds a control graph (group membership, ACL rights, delegation, SID history, GPO, DCSync, password reuse) and answers blast-radius, shortest control-path, asset-exposure, and derived-Tier-0 questions.
- **Identity 360.** For any AD object, returns every Indicator-of-Exposure deviance concerning it across three layers — filed on it, where it is the risky ACE trustee on another object, and inherited from a container — sorted by severity with deeplinks back into the Tenable UI.
- **Full API coverage.** 131 auto-generated tools grouped by resource (Profile, Deviance, Directory, User, Role, …), plus 10 hand-built convenience tools.

## How it works

A single cached snapshot of the directory powers the query engine, the control graph, and the deviance index; all three share a TTL and warm at startup. Tool handlers are transport-agnostic, and the server enforces per-tool safety controls (read / write / destructive) so a client can advertise only the tools it should. Facts, not verdicts: it reports reachability, edges, and Tenable's own findings without re-scoring.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/mcp-servers/supercharged-tenable-identity-exposure-mcp-server.json. The full index and how to read it: https://exchange.tenable.com/llms.txt