{"id":"c29995a0-8665-4bd6-ab62-e547e2f0f53d","slug":"tenable-sc-mcp-server","kind":"mcp","name":"tenable-sc-mcp-server","summary":"Production-ready MCP server for Tenable Security Center with intelligent caching. 90% token savings, 1000x faster responses.","owner":"ABMJ","repoUrl":"https://github.com/ABMJ/tenable-sc-mcp-server","license":"GPL-3.0","licenseTier":"strong-copyleft","trust":"community","stars":8,"match":null,"fewStars":false,"format":"mcp","createdAt":"2026-04-28T10:13:23.000Z","addedAt":"2026-10-21T06:01:01.254Z","logoUrl":"https://avatars.githubusercontent.com/u/4349991?v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["cloud-infra","databases","memory-knowledge"],"tags":["ai","api-wrapper","automation","caching","docker","enterprise","llm","python"],"runtime":"python","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-21T06:01:22.109Z","sample":false,"url":"https://conduits.dev/tools/tenable-sc-mcp-server","language":"Python","transports":["stdio"],"install":{"pypi":"tenable-sc-mcp"},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# Tenable.sc MCP Server\n\n[![Release](https://img.shields.io/github/v/release/ABMJ/tenable-sc-mcp-server)](https://github.com/ABMJ/tenable-sc-mcp-server/releases)\n[![CI](https://img.shields.io/github/actions/workflow/status/ABMJ/tenable-sc-mcp-server/ci.yml)](https://github.com/ABMJ/tenable-sc-mcp-server/actions/workflows/ci.yml)\n[![License: GPL v3](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://choosealicense.com/licenses/gpl-3.0/)\n[![Python](https://img.shields.io/badge/python-3.11%2B-blue)](https://www.python.org/)\n\n**This tool is not an officially supported Tenable project.**\n\nProduction-ready Model Context Protocol (MCP) server for Tenable Security Center Plus. Features intelligent caching for **90% token savings** and **1000x faster responses**.\n\n**Latest**: [v1.3.1](https://github.com/ABMJ/tenable-sc-mcp-server/releases/tag/v1.3.1) (2026-06-24) - Patch Management Tool | **Status**: ✅ Production Ready\n\n---\n\n## What's New in v1.3.1\n\n- **Tool 6: `tsc_list_missing_patches`** - Comprehensive patch gap analysis\n  - Universal mode: All OS types + third-party software (Chrome, Office, VMware, etc.)\n  - Windows mode: KB articles and legacy MS bulletins\n  - Smart parsing: Extracts KB IDs, vulnerability counts, third-party updates\n  - Repository name auto-resolution (e.g., \"Default\" → ID 9)\n  - Token efficient: 700-20,000 tokens depending on scope\n  - 6 critical bugs fixed during implementation\n\nSee [CHANGELOG.md](CHANGELOG.md) for complete release notes.\n\n---\n\n## Quick Start\n\n```bash\n# 1. Create .env file\ncd tenable-sc-mcp-server\ncp .env.example .env\nnano .env  # Add your Tenable.sc credentials\n\n# 2. Build and start\ndocker build -t tenable-sc-mcp:latest .\ndocker-compose up -d\n\n# Server running at: http://localhost:8000/mcp\n```\n\n**Required `.env` configuration:**\n```bash\nTSC_URL=https://your-sc-server.com\nTSC_ACCESS_KEY=your-access-key\nTSC_SECRET_KEY=your-secret-key\nTSC_VERIFY_SSL=true\n```\n\n---\n\n## Features\n\n- **90% token savings** - Intelligent Redis caching\n- **1000x faster** - <1ms cached responses vs 200-500ms API calls\n- **100+ resources** - Full Tenable.sc REST API coverage\n- **Zero storage** - Stateless proxy with optional cache\n- **RBAC enforced** - Respects all Tenable.sc permissions\n- **Production ready** - Docker Compose with health checks\n\n---\n\n## Available Tools\n\n### High-Level Tools (Optimized for LLMs)\n\n**See [USER_GUIDE.md](USER_GUIDE.md) for complete documentation and examples.**\n\n| Tool | Purpose | Token Savings | Cache TTL |\n|------|---------|---------------|-----------|\n| `tsc_profile_ip_efficient` | Complete IP security assessment | 83% (2.5K vs 15K) | 180-300s |\n| `tsc_list_vulns_by_ip_summary` | Quick vulnerability counts | 88% (700 vs 6K) | 180s |\n| `tsc_list_vulns_by_ip_full` | Detailed vulnerability records | 58% (5K vs 12K) | 180s |\n| `tsc_list_ips` | IP discovery with 55+ filters | 400-3.7K tokens | 120s |\n| `tsc_list_vulns_by_cve` | CVE outbreak response | 85% (1-2K vs 10K) | 240s |\n| `tsc_list_missing_patches` | Patch gap analysis (all OS + third-party) | 60-70% (0.7-20K) | 240s |\n\n### Core API Tools\n\n- `tsc_resource_action` - Unified CRUD for all resources (`list`, `get`, `create`, `update`, `delete`)\n- `tsc_catalog` - Browse 100+ available resources\n- `tsc_current_user` - Verify API identity and permissions\n- `tsc_analyze` - Run analysis queries (cached)\n- `tsc_cache_stats` / `tsc_cache_clear` - Cache management\n\n**See [docs/TOOLS.md](docs/TOOLS.md) for complete tool reference.**\n\n---\n\n## Configuration\n\n### OpenCode\n\nAdd to `opencode.json`:\n\n```json\n{\n  \"mcp\": {\n    \"tenable-sc\": {\n      \"type\": \"remote\",\n      \"url\": \"http://localhost:8000/mcp\",\n      \"enabled\": true\n    }\n  }\n}\n```\n\n### Claude Desktop\n\nAdd to MCP settings:\n\n```json\n{\n  \"mcpServers\": {\n    \"tenable-sc\": {\n      \"command\": \"docker\",\n      \"args\": [\"run\", \"--rm\", \"-i\",\n        \"-e\", \"TSC_URL=https://your-sc-server.com\",\n        \"-e\", \"TSC_ACCESS_KEY=your-key\",\n        \"-e\", \"TSC_SECRET_KEY=your-secret\",\n        \"tenable-sc-mcp:latest\"]\n    }\n  }\n}\n```\n\n---\n\n## Architecture\n\n```\nMCP Client (OpenCode/Claude)\n        ↓\ntenable-sc-mcp server\n        ↓\nRedis Cache (90% hit rate)\n        ↓\nTenable.sc REST API\n```\n\n**Key Principles** (see [DESIGN_PRINCIPLES.md](DESIGN_PRINCIPLES.md)):\n- Unified `filters` dict parameter (55+ filters)\n- Smart caching with data-type-specific TTLs\n- Token optimization (80%+ reduction target)\n- Comprehensive error handling\n\n---\n\n## Filter System\n\n**New in v1.2.0**: All tools use unified `filters` dict parameter.\n\n```python\n# Example: Find critical assets with CVE\ntsc_list_vulns_by_cve(\"CVE-2021-44228\", filters={\n    \"asset_criticality\": \"7-10\",    # Range format required\n    \"severity\": \"critical\",\n    \"exploit_available\": \"Yes\"\n})\n```\n\n**Important Rules:**\n- Scoring filters use **range format**: `\"7-10\"` NOT `\">7\"`\n- Applies to: `asset_criticality`, `vpr_score`, `aes_score`, `cvss_v3_base_score`, `epss_score`\n- Common filters: `severity`, `exploit_available`, `cve`, `plugin_id`, `port`, `protocol`\n\n**Documentation:**\n- Complete reference: [FILTER_FORMAT_REFERENCE.md](FILTER_FORMAT_REFERENCE.md)\n- MCP resource: `tenable-sc://filters/format-reference`\n- Examples: [USER_GUIDE.md](USER_GUIDE.md)\n\n---\n\n## Deployment Options\n\n### Docker Compose (Recommended)\n```bash\ndocker build -t tenable-sc-mcp:latest .\ndocker-compose up -d\n```\n\n### Standalone Docker\n```bash\ndocker run -d --name tenable-sc-mcp \\\n  -p 8000:8000 \\\n  -v ~/.tenable-sc-mcp.env:/config/tsc.env:ro \\\n  tenable-sc-mcp:latest \\\n  --transport streamable-http \\\n  --host 0.0.0.0 --port 8000 \\\n  --env-file /config/tsc.env\n```\n\n### Local Python\n```bash\npython3 -m venv .venv\nsource .venv/bin/activate\npip install .\nexport TSC_URL=\"https://sc.example.com\"\nexport TSC_ACCESS_KEY=\"key\"\nexport TSC_SECRET_KEY=\"secret\"\ntenable-sc-mcp --transport stdio\n```\n\n---\n\n## Troubleshooting\n\n**Containers won't start:**\n```bash\ndocker compose logs tenable-sc-mcp\n# Check: Missing .env, invalid TSC_URL, firewall\n```\n\n**Can't reach Tenable.sc:**\n```bash\ncurl -k https://your-sc-server.com/rest/currentUser\n# Expected: \"invalid token\" (endpoint reachable)\n```\n\n**Cache not working:**\n```bash\ndocker ps --filter \"name=redis\"  # Should show (healthy)\n# Ask MCP: \"show me cache statistics\"\n```\n\n**Remote clients can't connect:**\n```bash\ndocker ps --filter \"name=tenable-sc-mcp\"  # Should show 0.0.0.0:8000\ncurl http://your-server-ip:8000/mcp\n```\n\nSee [SUPPORT.md](SUPPORT.md) for more help.\n\n---\n\n## Security\n\n- **RBAC enforced** - Uses your Tenable.sc API keys, all permissions apply\n- **No credential storage** - Environment variables only\n- **SSL/TLS support** - Set `TSC_VERIFY_SSL=true` in production\n- **No built-in auth** - Bind to trusted networks only (127.0.0.1 for local)\n\n**Best practices:**\n- ❌ Never commit API keys to git\n- ✅ Use env files with mode `0600`\n- ✅ Create dedicated least-privilege API user in Tenable.sc\n- ✅ Use firewall rules or SSH tunnels for remote access\n\nSee [SECURITY.md](SECURITY.md) for vulnerability reporting.\n\n---\n\n## Documentation\n\n### User Docs\n- [USER_GUIDE.md](USER_GUIDE.md) - Complete tool usage guide\n- [FILTER_FORMAT_REFERENCE.md](FILTER_FORMAT_REFERENCE.md) - Filter system reference\n- [CACHING_DEEP_DIVE.md](CACHING_DEEP_DIVE.md) - Cache behavior and performance\n- [TEST_PROMPTS.md](TEST_PROMPTS.md) - Ready-to-use test queries\n\n### Developer Docs\n- [ARCHITECTURE.md](ARCHITECTURE.md) - System design\n- [DESIGN_PRINCIPLES.md](DESIGN_PRINCIPLES.md) - Tool development patterns\n- [TOOLS_ROADMAP.md](TOOLS_ROADMAP.md) - Feature roadmap and pending tools\n- [HANDOFF.md](HANDOFF.md) - LLM-friendly development handoff\n\n### Project\n- [CONTRIBUTING.md](CONTRIBUTING.md) - Contribution guidelines\n- [SECURITY.md](SECURITY.md) - Security policy\n- [SUPPORT.md](SUPPORT.md) - Support resources\n\n---\n\n## Compatibility\n\n| Component | Version |\n|-----------|---------|\n| Python | 3.11+ |\n| Tenable.sc | Current API versions |\n| Docker | 20.10+ (Compose v2) |\n| Redis | 7+ |\n\n---\n\n## Contributing\n\nContributions welcome! See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.\n\n**Quick links:**\n- [Report a bug](https://github.com/ABMJ/tenable-sc-mcp-server/issues/new?template=bug_report.yml)\n- [Request a feature](https://github.com/ABMJ/tenable-sc-mcp-server/issues/new?template=feature_request.yml)\n- [View issues](https://github.com/ABMJ/tenable-sc-mcp-server/issues)\n\n---\n\n## License\n\nGNU GPL v3.0 - See [LICENSE](LICENSE)\n\n---\n\n**Need help?** Check [SUPPORT.md](SUPPORT.md) or [open an issue](https://github.com/ABMJ/tenable-sc-mcp-server/issues).\n"}