Tenable VPR MCP
Read-only Tenable.io / Tenable One MCP server with a VPR re-prioritization comparison tool, CISA KEV / EPSS exploitation cross-check, and pentest re-test scan-delta reporting.
Baseline review at submission: an accuracy and overt-behavior check, not a full security audit, and it does not cover later changes to the repository. Learn more about our security review process.
Tools (11)
- list_scans
List scans visible to the authenticated API key, optionally filtered by folder ID.
- get_scan_details
Latest results for a single scan: hosts scanned, per-plugin findings, severity counts.
- list_assets
List assets known to the tenant (hostname, IPs, UUID, last seen, sources).
- get_asset_details
Full detail for a single asset by UUID, including tags and exposure scores if licensed.
- search_vulnerabilities
Search current findings via the vulnerability workbench, filterable by severity and plugin family.
- get_plugin_details
Full plugin detail: description, solution, CVSS vectors, CVEs, and VPR drivers.
- list_tags
List asset tag categories and values configured in the tenant.
- list_agents
List Nessus Agents with status, platform, and last connect / last scanned timestamps.
- compare_vpr_reprioritization
Before/after comparison of CVSS-based severity vs. VPR-based severity per finding, flagged as escalated / downgraded / unchanged / unrated.
- check_kev_epss_exposure
Cross-references findings' CVEs against the CISA KEV catalog and FIRST.org EPSS scores, independent of Tenable's proprietary VPR.
- scan_delta
Compares a baseline scan against a re-test scan by plugin ID: fixed, still_open, and new_since_baseline, with a remediation-rate percentage.
What it does
See which findings VPR actually escalates — and back it with CISA KEV, not vendor trust.
Tenable VPR MCP exposes read-only Tenable.io / Tenable One vulnerability management data (scans, assets, findings, plugins, tags, agents) as MCP tools, plus three tools built specifically for exposure-management and pentest reporting workflows rather than raw API access:
compare_vpr_reprioritizationbuilds a before/after table showing how VPR re-ranks findings against their static CVSS severity, flagging escalations and downgrades. This is the exact comparison used in Tenable One CTEM proof-of-concept deliverables, where a client needs to see concretely what VPR changes about their existing scan data.check_kev_epss_exposurebacks that re-prioritization with two independent, publicly sourced signals instead of relying on a single vendor score: CISA’s Known Exploited Vulnerabilities catalog and FIRST.org’s Exploit Prediction Scoring System.scan_deltacompares a baseline scan to a re-test scan and buckets findings into fixed / still-open / new, with a remediation-rate percentage, for the re-test report every pentest engagement produces.
How it works
Built on pyTenable for the Tenable.io API and FastMCP for the MCP server layer. CVE cross-referencing pulls live data from CISA’s public KEV JSON feed and the FIRST.org EPSS API; both calls are isolated from the comparison logic so the re-prioritization and delta-building functions are independently unit tested without live network access. The server is read-only: no scan launch, edit, or delete operations are exposed, so it’s safe to point at a production Tenable.io / Tenable One tenant.
Authentication is via TIO_ACCESS_KEY / TIO_SECRET_KEY environment
variables only (never CLI arguments), generated in Tenable.io / Tenable
One under Settings > My Account > API Keys.
Known limitations
check_kev_epss_exposureissues one additional Tenable API call per distinct plugin to resolve CVEs, solimitshould stay modest for interactive use.search_vulnerabilitiesandcompare_vpr_reprioritizationread from the vulnerability workbench (tenant-wide, not scan-scoped); useget_scan_details/scan_deltafor scan-specific views.- No write operations (scan launch/configure, tag assignment, asset deletion) are implemented by design.