# Tenable SC AI Analyst

> An MCP server that turns Tenable Security Center into a conversational vulnerability analyst — query exposure, top risks, remediation, hosts, plugins and feed health in plain language.

- Type: MCP server
- Author: ayuksel-tenb
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Source repository: https://github.com/ayuksel-tenb/tenablesc-ai-analyst
- Repo state: not archived
- Last push: 2026-06-17T21:18:51Z
- Stars: 6 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable
- Domains: vulnerability-management
- Tags: tenable, security-center, vulnerability-management, vulnerability-analysis, mcp
- Date added: 2026-06-18
- Transport: stdio
- Runtime: python
- Auth method: api-key
- Compatible clients: Claude Code, Claude Desktop, Cursor, Windsurf, VS Code Copilot
- Tools:
  - `sc_list_vulnerabilities`: List vulnerability findings (listvuln, or vulndetails for full detail).
  - `sc_vuln_summary_by_host`: Vulnerability counts grouped by host/IP (sumip).
  - `sc_vuln_summary_by_plugin`: Vulnerability counts grouped by plugin (sumid).
  - `sc_vuln_summary_by_severity`: Vulnerability counts grouped by severity (sumseverity).
  - `sc_vuln_summary_by_cve`: Vulnerability counts grouped by CVE (sumcve).
  - `sc_remediation_summary`: Remediation rollup — the fixes that clear the most risk (sumremediation).
  - `sc_vuln_trend`: Vulnerability trend over time (trend).
  - `sc_analysis_query`: Escape hatch: run an arbitrary /rest/analysis query (raw type/tool/filters).
  - `sc_list_assets`: List asset lists/groups.
  - `sc_get_asset`: Get one asset list by ID.
  - `sc_list_repositories`: List repositories.
  - `sc_list_solutions`: List solutions via the remediation analysis.
  - `sc_get_solution`: Get the remediation/solution text for a plugin.
  - `sc_search_plugins`: Search the plugin catalog by name keyword.
  - `sc_get_plugin`: Get full detail for one plugin.
  - `sc_list_queries`: List saved queries.
  - `sc_run_query`: Run a saved query by ID.
  - `sc_list_scan_results`: List scan results.
  - `sc_get_scan_result`: Get one scan result by ID.
  - `sc_feed_status`: Report plugin/feed freshness — when each feed was last updated.
  - `sc_list_scanners`: List Nessus scanners and their status.
  - `sc_create_accept_risk_rule`: Write (gated by SC_ENABLE_WRITES): create an Accept Risk rule. Persistent change.
  - `sc_create_recast_risk_rule`: Write (gated by SC_ENABLE_WRITES): create a Recast Risk rule. Persistent change.
  - `sc_create_ticket`: Write (gated by SC_ENABLE_WRITES): create a remediation ticket. Persistent change.
  - `sc_launch_scan`: Write (gated by SC_ENABLE_WRITES): launch a scan. Persistent change.
- Listing page: https://exchange.tenable.com/mcp-servers/tenablesc-ai-analyst
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/mcp-servers/tenablesc-ai-analyst.md

Connect an AI assistant (Claude Code, OpenCode, or any MCP client) directly to **Tenable Security Center (Tenable.sc)** and investigate your exposure in plain language — the agent calls the right Security Center analysis and answers from live data, no clicking through the console.

## What it does

- Answers natural-language questions via the right `/rest/analysis` query: severity / host / plugin / CVE / remediation summaries, vulnerability trends, or a raw analysis query.
- Surfaces context on demand: assets, repositories, solutions, plugins, saved queries, scan results, scanners, and plugin-feed freshness.
- Authenticates with API keys via the `x-apikey` header (read from the environment) — no session token is ever created.
- Keeps side-effecting actions (accept/recast risk rules, tickets, launch scan) **off by default** behind an explicit `SC_ENABLE_WRITES` flag, each clearly marked as a persistent change.
- Never touches Token / SAML / LDAP / User / Role / Director endpoints.

## How it works

Built on the official MCP SDK's FastMCP (Python 3.12), the server wraps the Tenable.sc REST API — primarily `/rest/analysis` — behind a small set of read-focused tools that share one reusable filter set (severity, plugin, IP, repository, last-seen, exploit-available, CVE) with offset pagination. A single async HTTP client handles auth and error handling for every request. Read tools are always available; the isolated write tools are registered only when writes are explicitly enabled.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/mcp-servers/tenablesc-ai-analyst.json. The full index and how to read it: https://exchange.tenable.com/llms.txt