Tenable CTEM MCP
ContributedLocal MCP server delivering 19 CTEM maturity indicators already aggregated, plus MTTR, with evidence per number
Tools (13)
- ctem_discover_tenant
Tag categories and values, asset counts by class, exposure surfaces present, scans with history, agents — in one cached call
- ctem_preflight
Tests every filter the assessment uses live against the tenant, with discriminant pairs, and returns the deny-list with measured proof
- ctem_scoping
Stage 1 indicators S1–S4 over the licensed asset base: tag coverage, criticality and owner coverage, declared crown jewels
- ctem_discovery
Stage 2 indicators D1–D4: time since last assessment, licensed surface coverage, agent coverage, authenticated detection share
- ctem_prioritization
Stage 3 indicators P1–P3 plus the three compared prioritisation queues (CVSS, VPR, overlap)
- ctem_validation
Stage 4 indicators V1–V4: exploit availability, KEV exposure age, recurrence rate, out-of-support software
- ctem_mobilization
Stage 5 indicators M1–M4: assessment cadence, largest gap, fix availability age, and MTTR with the cadence guard applied
- plugin_details_batch
Detail for many plugins in one call, with five fields only — the project's largest token saving
- plugin_census
Sampling frame: every plugin of a severity with detection count, VPR and family. Cached
- scan_cadence
Collapses scan runs into distinct assessment days, and always returns the uncollapsed median alongside for contrast
- mttr_collect
MTTR through the vulnerability export API with polling and chunked download. Never blocks: returns a resumable ticket on timeout
- mttr_cadence_guard
Detects when an MTTR is really measuring the interval between scans rather than time to fix
- ctem_diagnostics
Whether the server can reach the tenant, which role the API key has, and whether the tag catalog is fully visible to it. Separates a missing credential from an invalid one from intercepted TLS. Never prints the key
A local stdio MCP server that moves the aggregation of a CTEM maturity assessment to the server, so the client receives finished numbers instead of raw pages to add up. Every indicator arrives with the literal filter that produced it, the sample size, the collection timestamp and a preflight verdict.
What it does
Returns the 19 indicators of a CTEM maturity assessment across the five stages — Scoping, Discovery, Prioritization, Validation, Mobilization — in roughly seven tool calls. Time-to-fix is included, which the inventory API alone cannot reach: the fields that make MTTR computable live behind an export endpoint with polling and chunked download, wrapped here in a single tool.
A query that fails never becomes a number. It becomes a declared gap with a named cause, and the indicator leaves the calculation. A silent partial number is treated as the central failure mode to prevent, because a wrong number that looks right carries no signal that it happened.
The server is read-only. It issues no write to the tenant, and credentials are read only from the environment — never as a tool parameter, never written to a config file or a log. Certificate verification cannot be disabled; networks that inspect TLS point at their own CA bundle instead.
How it works
Three design decisions carry the project, and each came from a problem measured in a real tenant.
Aggregation on the server. The raw runs of a recurring scan gave a median assessment cadence of 1.42 days; collapsed into distinct assessment days, 21 — two maturity stages apart, with nothing in the output signalling the difference. Logic that lives on the client gets re-implemented slightly differently each time; here it lives in one place and has a regression test.
Only the fields that are used. A plugin’s full detail is ~8,200 characters across 97 attributes; the assessment uses five. Returning five is what makes a census of every critical plugin affordable, and a census removes the confidence interval, the weighting base and the allocation bias a sample forces you to manage.
A filter deny-list with measured proof. The API accepts some filters it does not apply and
returns no error — the query looks filtered and returns the whole corpus. Those are rejected before
the request leaves, each with the discriminant pair that proved it, and ctem_preflight re-tests
everything live rather than trusting a recorded verdict.
Rates over the licensed base, not the whole inventory. Asset-rate indicators divide by the assets
that consume a licence (asset_class combined with is_licensed). The inventory also holds directory
identities, accounts and groups loaded for attack paths; in one production tenant they were 94% of
the corpus and dragged the tagging rate from 100% to 25%. The whole corpus and the per-class
breakdown still travel beside every number.
What the API key needs
A role alone is not enough, and too little permission is dangerous for a quiet reason: a missing
per-object permission does not answer 403, it returns a shorter list. Give the key’s user either the
Administrator role, or Scan Manager plus Can View on all assets and on the scans used, and Can Use on all tags.
ctem_diagnostics reports the role and flags a partially visible tag catalog before any indicator is
collected, and the indicators that depend on the catalog become declared gaps naming the missing
permission instead of numbers. The full endpoint-by-endpoint table, with sources, is in
docs/permissions.md in the repository.