# Rapid7 InsightVM MCP for AI Agents AI Agent Connect

> Rapid7 InsightVM MCP connects your AI to your vulnerability management platform. It lets your agent pull asset lists, check CVE details, and kick off new scans on demand. It turns your AI into a security analyst that knows your network's health inside out without you having to log into the console every five minutes.

## Overview
- **Category:** fort-knox
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_nmw1NBAd0c7vaxJkPlmlyGDkr9YvNNJBYZZGurqi/ai-agent-connect
- **Tags:** cybersecurity, threat-remediation, risk-management, network-scanning, asset-inventory, security-audit

## Description

Rapid7 InsightVM connects your security platform to your AI agent. Instead of clicking through the dashboard to find out which servers are missing patches or which assets are showing up in a new scan, you can just ask your AI to do the heavy lifting. This Connector puts your security data directly into your workspace. You can pull a full inventory of your network, drill down into specific hardware fingerprints, or look up the exact remediation steps for a high-severity flaw. If you've just pushed a patch and need to know if it actually worked, you can tell your agent to start a new scan on a specific site right then and there. It's about moving from searching for data to getting answers. By adding this to the Vinkius catalog, you're giving your AI the eyes it needs to see your actual security posture in real-time. It handles the boring stuff like listing sites and checking scan statuses so you can focus on fixing the actual problems.

## Tools

### get_site
Get the configuration details for a specific network site. This helps you review scanning scopes quickly.

### get_vulnerability
Pull the full details and advisories for a specific vulnerability ID. Use this to find remediation steps.

### list_assets
Get a full list of all computing assets currently discovered on your network. This builds a clear inventory.

### list_vulnerabilities
View the global definitions for vulnerabilities in your environment. This gives you a broad view of risks.

### trigger_scan
Force an immediate vulnerability scan on a specific network site. This validates your recent fixes.

### get_asset
Retrieve detailed hardware and OS information for a specific asset. Use this to identify old hardware.

### get_asset_vulnerabilities
See every vulnerability found on a specific piece of hardware. This helps you prioritize what to fix first.

### get_scan
Check the current execution status and results of a specific scan. This lets you know when data is ready.

### list_scans
See a chronological list of all assessment scans performed. Use this to track recent activity.

### list_sites
List all the network scan sites currently configured in your console. This helps you audit your coverage.

## Prompt Examples

**Prompt:** 
```
Show me the vulnerabilities on our main web server.
```

**Response:** 
```
I checked the vulnerabilities for the web server (Asset ID 402). It has 3 high-severity issues:

| CVE ID | Severity | Status |
|---|---|---|
| CVE-2023-XXXX | Critical | Unpatched |
| CVE-2023-YYYY | High | Unpatched |
| CVE-2023-ZZZZ | High | Unpatched |

The most urgent is a missing patch for your web server software.
```

**Prompt:** 
```
Did the scan on the London site finish?
```

**Response:** 
```
Yes, the scan for 'London Head Office' (Scan ID 992) finished about 10 minutes ago. It identified 12 new vulnerabilities and 4 assets that were offline during the check.
```

**Prompt:** 
```
Give me the remediation steps for CVE-2023-XXXX.
```

**Response:** 
```
Here are the details for CVE-2023-XXXX:

- **Severity**: Critical
- **Description**: A buffer overflow in the legacy service.
- **Remediation**: Update to version 2.4.1 or disable the service if it's not needed.
```

## Capabilities

### Pull full asset inventories
Get a complete list of every computing asset discovered on your network.

### Check specific CVE details
Read full advisories and remediation steps for specific vulnerability IDs.

### Trigger new vulnerability scans
Start an immediate security assessment on a specific network site.

### View scan execution status
Check if your latest assessment is finished or still running in the background.

### Review site configurations
See the scanning scope and health risks for your configured network sites.

### List vulnerabilities for specific assets
See every flaw found on a single piece of hardware or server.

## Use Cases

### Patch Verification
A DevOps engineer just updated 50 servers. They ask the agent to trigger_scan on the site to see if the high-severity CVEs are gone.

### Rapid Incident Response
A SOC analyst sees a threat and uses get_asset_vulnerabilities to see what's wrong with a specific host in seconds.

### Inventory Audit
A network admin needs a list of all assets with specific OS fingerprints and uses list_assets to export the data.

### Site Health Check
An admin uses list_sites and get_site to double-check that a new office's scanning scope is correctly configured.

## Benefits

- Stop tab-switching by using list_assets to see your entire inventory without opening the Rapid7 console.
- Get instant remediation steps for any CVE by using get_vulnerability to see exactly how to fix a flaw.
- Verify patches immediately by using trigger_scan to start a new assessment right after you deploy a fix.
- Track scan progress in real-time using get_scan to see if your latest assessment is finished or still running.
- Audit your network coverage by using list_sites to ensure every subnet is actually being monitored.
- Drill down into specific hardware health by using get_asset_vulnerabilities to see the exact flaws on a single host.

## How It Works

The bottom line is you get a direct line to your security data without leaving your workspace.

1. Authorize the Connector in your environment.
2. Enter your Rapid7 Security Console URL and your Basic Auth credentials.
3. Ask your AI to check your latest scan results or list your assets.

## Frequently Asked Questions

**How can the Rapid7 InsightVM MCP help my security team?**
It lets your team query vulnerabilities and asset data using natural language. Instead of clicking through a complex dashboard, your team can just ask your AI for specific info like 'what's wrong with this server?'

**Can I use the Rapid7 InsightVM MCP to start new scans?**
Yes, you can tell your AI agent to trigger a new vulnerability scan on a specific site immediately. This is great for verifying that a patch you just deployed actually worked.

**Does the Rapid7 InsightVM MCP work with my existing Nexpose data?**
Yes, it connects directly to your Rapid7 InsightVM platform. It can read your existing asset lists, site configs, and scan histories.

**Can the AI agent see which assets are on my network?**
Yes, it can pull a full inventory of all discovered computing assets. It can even show you specific details like hardware info and operating system fingerprints.

**Is it possible to get remediation steps for specific flaws?**
Yes, you can ask the agent for details on a specific vulnerability. It will pull the full advisory and remediation guidelines directly from your Rapid7 environment.

**How do I connect my Rapid7 InsightVM to my AI client?**
You'll need to provide your Security Console URL and your Basic Auth credentials. Once that's set up, your agent can start querying your security data.

**How do I configure my credentials for Rapid7?**
The integration uses Basic Authentication interacting with the Rapid7 Console API. You must configure the `RAPID7_HOST` (IP or FQDN), `RAPID7_PORT` (usually 3780), along with a dedicated `RAPID7_USER` and `RAPID7_PASSWORD`. We strongly recommend generating a specific service account in your console with restricted scan permissions.

**Is the scanning triggered individually per asset?**
By default, the `trigger_scan` mechanism relies on referencing a defined `site_id`, scanning the preconfigured scope attached to it rather than blindly scanning one unassociated IP.

**Does it report CVSS scores?**
Yes, depending on the response data provided by your installed version of the InsightVM console. Using `get_vulnerability` or checking asset lists brings standard threat metadata and corresponding CVSS vectors directly into your AI interface context.