• VERIFIED
  • PENDING
  • ACTION
  • HUMAN

How to validate vulnerability remediation with your AI

Connect Rapid7 InsightVM to your agent to automate the verification loop. Once connected, your AI handles the scanning and data retrieval needed to confirm patches worked.

Ask AI about this page

Short answer

How can I use AI to check if my vulnerabilities are actually fixed?

Your AI triggers a fresh scan on specific assets and then pulls the updated vulnerability data. You get a clear confirmation of what is cleared and what still needs work.

The results of your scan

Where your remediation status lands.

The AI moves through these stages to close the loop on your patching efforts.

VERIFIED

Confirmed clean assets

The AI identifies vulnerabilities that no longer appear in the latest scan. You get a list of assets that are officially remediated.

PENDING

Unresolved issues

The agent flags vulnerabilities that still persist despite your patching attempts. This tells you exactly where the fix failed.

ACTION

New scan requests

The AI initiates fresh scans to ensure you aren't looking at stale data. This guarantees the verification is based on current state.

HUMAN

Manual investigation

If a vulnerability persists, you decide whether to re-apply the patch or investigate a deeper configuration issue. The AI provides the data, but you make the call.

The workflow

What your AI does when the remediation request arrives.

Instead of you clicking through the InsightVM console, your agent executes the technical steps to verify the fix.

  1. Refresh asset data

    The AI pulls the current state of the target assets to ensure it has the latest context before starting.

    get_asset

  2. Initiate fresh scan

    To avoid relying on old results, the agent starts a new scan on the specific assets you are targeting.

    trigger_scan

  3. Retrieve findings

    Once the scan finishes, the AI pulls the updated list of vulnerabilities for those assets.

    get_asset_vulnerabilities

  4. Compare and report

    The agent compares the new findings against your target list to see which vulnerabilities have disappeared.

    get_asset_vulnerabilities

Try it

Copy these to start.

Use these prompts to kick off the verification process.

Starting points

Swap out the asset names or vulnerability IDs with your actual data from Rapid7.

Rapid7 InsightVM Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_nmw1NBAd0c7vaxJkPlmlyGDkr9YvNNJBYZZGurqi/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Rapid7 InsightVM capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "rapid7-insightvm-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_nmw1NBAd0c7vaxJkPlmlyGDkr9YvNNJBYZZGurqi/mcp"
    }
  }
}
Copy into chat04

  • Trigger a new scan for asset 'Web-Server-01' and tell me if the Log4j vulnerability is gone.

  • Check the vulnerabilities for asset 'DB-Prod-05' and list anything that hasn't been remediated yet.

  • Run a scan on my production subnet and give me a summary of cleared vulnerabilities.

  • Verify if the recent patch on 'App-Server-Alpha' successfully removed the CVE-2023-XXXX vulnerability.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Rapid7 InsightVM once, then ask.

You only need to link your account once. Your credentials stay encrypted, and you can immediately start asking your agent to run scans or pull vulnerability data.

Connect Rapid7 InsightVM to your AI

FAQ

How this task behaves

  • 01

    Can the AI change my scan configurations?

    No. The AI can only trigger scans and read vulnerability data. It cannot modify your existing scan policies or settings.

  • 02

    Will the AI delete any vulnerabilities from my dashboard?

    No. The AI only reads data. It cannot delete, edit, or suppress vulnerabilities in Rapid7 InsightVM.

  • 03

    Does the AI wait for the scan to finish before responding?

    The AI uses the trigger tool to start the process. You will need to ask it to check the results once the scan is complete.

  • 04

    Can I use this to scan assets that aren't in my InsightVM inventory?

    No. The AI can only interact with assets that are already managed within your Rapid7 InsightVM environment.

  • 05

    How does the AI know if a vulnerability is actually fixed?

    It compares the list of vulnerabilities returned by the scan tool against the specific CVE or vulnerability ID you asked about.

  • More questions about Rapid7 InsightVM? The Connector page answers them. See everything the Rapid7 InsightVM Connector can do

Connect Rapid7 InsightVM to Claude, Cursor, ChatGPT & more