# Tenable MCP for AI Agents AI Agent Connect > Tenable MCP lets you pull vulnerability data, manage scans, and audit assets directly through your AI agent. It cuts out the need to jump between dashboards to find critical CVEs or check scanner health. It connects your Tenable.io environment to tools like Cursor or Claude so you can triage risk in real-time. ## Overview - **Category:** fort-knox - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_U8b0LdAyMaNtCec1v5eI306Cug5XlI4Il4xcKPtc/ai-agent-connect - **Tags:** cybersecurity, exposure-management, asset-intelligence, cve-triage, vulnerability-assessment, cloud-security ## Description Managing enterprise security usually means digging through endless dashboards and clicking through nested menus just to find out why a specific server is flagged. You have to jump from one tab to another to cross-reference asset tags with network topology, then flip over to a different screen to check if your scanners are even online. It's a lot of context switching that slows down your response time. This Connector changes that by bringing your Tenable.io data directly into your workspace. Instead of hunting for information, you can just ask your agent to pull the latest CVEs for a specific host or check the status of your scanning fleet. It puts the intelligence you need right where you're already working. When you connect this through the Vinkius catalog, you get a direct line to your vulnerability data, letting you focus on fixing problems rather than finding them. You can quickly see how your network spaces overlap, verify that your host tags are accurate, and trigger immediate scans on new infrastructure without ever leaving your chat or editor. It turns a manual search process into a simple conversation. ## Tools ### get_asset_details Retrieves metadata, networking info, and risk profiles for a specific asset. Use this to see exactly what's running on a host and its associated tags. ### get_asset_vulnerabilities Retrieves explicit security findings and Workbench data for a specific asset. This is your go-to for triaging specific CVEs on a target host. ### get_scan_results Pulls runtime analytics and vulnerability summaries for a specific scan. It lets you see the results of a completed assessment without clicking through the UI. ### launch_scan Triggers an immediate execution of a configured scan and returns a run ID. This is perfect for getting a fresh look at a new piece of infrastructure. ### list_assets Lists all host and cloud assets discovered in your Tenable.io environment. This helps you get a quick overview of everything currently being monitored. ### list_scan_folders Lists your operational scan folders like PCI Quarters or My Scans. It helps you organize and navigate your scan history. ### list_logical_networks Lists the logical routing networks in your Tenable environment. Use this to understand how your network spaces are structured. ### list_scans Lists all vulnerability assessment scans from your Tenable.io account. This gives you a high-level view of all scheduled and past scans. ### list_asset_tags Lists the organizational tags mapped to your assets. It's the easiest way to see how your inventory is categorized. ### list_scanners Lists the Nessus scanners managed by your Tenable.io instance. Use this to verify that your scanning fleet is online and active. ## Prompt Examples **Prompt:** ``` What are the critical vulnerabilities on host 1383da-xxx? ``` **Response:** ``` I've pulled the security findings for asset **1383da-xxx**. Here are the critical issues: | Severity | Plugin ID | Description | | :--- | :--- | :--- | | **Critical** | 104743 | Windows OTD exploit | | **Critical** | 51192 | OpenSSL RCE **Summary:** * The host is missing 4 months of standard OS patches. * Both issues are exploitable via network vectors. Would you like the exact CVE payloads for these? ``` **Prompt:** ``` Check if our Nessus scanners are online. ``` **Response:** ``` I've checked the status of your managed scanners: * **Scanner_01**: Online (Active) * **Scanner_02**: Online (Active) * **Scanner_03**: **Offline** (Check plugin health) Scanner_03 appears to be having issues with its latest plugin update. Should I pull more details on its health? ``` **Prompt:** ``` Launch the PCI scan now. ``` **Response:** ``` I've commanded the **PCI Quarters** scan to start immediately. * **Job Run ID**: `c2f90a1-xxxxx` * **Status**: Pushed to scanner queues It will evaluate all tied network zones independently. I'll let you know when the results are ready for review. ``` ## Capabilities ### Pull asset metadata Get deep telemetry like OS fingerprints and tags for any host. ### Trigger manual scans Start immediate evaluations of your infrastructure on demand. ### Triage CVE findings Identify specific security issues on assets without navigating dashboards. ### Audit scanner health Check the operational status and plugin health of your scanning fleet. ### Map network topology See how different network spaces and logical folders overlap. ### Review scan analytics Get clear summaries and runtime data for past assessments. ## Use Cases ### Rapid Triage A security analyst asks the agent to pull all extreme vulnerabilities for a specific host ID to see if a known exploit is active. ### DevSecOps Deployment An engineer asks the agent to launch a scan on a new production zone immediately after a deployment to verify security. ### Scanner Audit An IT admin asks the agent to check the health of all Nessus scanners to ensure the entire fleet is reporting correctly. ### Tag Validation A manager asks the agent to list asset tags to see if the Production tag is correctly applied across the cloud inventory. ## Benefits - Cut out dashboard fatigue by pulling asset metadata and CVE findings directly into your chat or editor. - Speed up incident response by using get_asset_vulnerabilities to pinpoint critical issues in seconds. - Maintain better visibility into your scanning fleet by checking list_scanners status on demand. - Audit your network topology and folder structure using list_logical_networks to ensure consistent tagging. - Trigger immediate infrastructure checks with launch_scan as soon as you deploy new code or resources. - Get clear summaries of past assessments using get_scan_results to track remediation progress over time. ## How It Works The bottom line is you get instant access to your entire vulnerability management lifecycle through a natural conversation. 1. Subscribe to this Connector and provide your Tenable Access Key and Secret Key. 2. Connect your preferred AI client to the Vinkius platform. 3. Ask your agent to list assets, check vulnerabilities, or launch scans. ## Frequently Asked Questions **Can Tenable MCP help me find CVEs faster?** Yes. It lets you ask your agent to pull specific security findings for any asset instantly, so you don't have to hunt through the Tenable Workbench. **How does Tenable MCP help with cloud assets?** It gives your agent visibility into your cloud inventory, allowing you to pull metadata, networking info, and risk profiles for any cloud host. **Can I trigger scans with Tenable MCP?** Absolutely. You can tell your agent to launch a configured scan immediately, and it will provide you with the new run ID for tracking. **Does Tenable MCP work with my current scanner fleet?** Yes, it can list your managed scanners and check their operational status and plugin health to ensure your fleet is running correctly. **Can I use Tenable MCP to check my network tags?** Yes. You can ask the agent to list your organizational tags or check how your logical networks overlap to verify your topology. **Is Tenable MCP good for security audits?** It's great for audits because it allows you to quickly pull summaries of past scans and audit scanner health without manual navigation. **Can my AI agent trigger vulnerability scans directly?** Yes! You can ask your agent to list all mapped scan profiles. Once you copy the ID for something like 'External Perimeter Quick Scan', you can tell the agent to seamlessly launch that specific scan ID out of standard bounds. **How easy is it to investigate an alert about a single compromised asset?** Extremely fast. If an IP triggers an alert downstream, ask your agent to retrieve asset details tracking that IP, obtain its specific Asset ID, and immediately pull vulnerabilities. You will instantly get a markdown table of CVEs missing on the endpoint without complex GUI clicking. **Can the agent interact with scanner appliances (Nessus)?** Yes. It can fetch your entire scanner inventory across Tenable.io. This includes the internal Nessus agents linked to the account, their connection status, license states, and underlying software versions so you know if your fleet is healthy.