Tenable MCP server

What the model can do

Tenable Vulnerability Management (Tenable.io): scans with status and schedule, one scan's hosts and findings by severity, a scan's run history, vulnerabilities across the estate by severity, VPR and CVSS with affected-asset counts, assets with exposure and criticality scores, one asset's vulnerabilities, tags and scanners; when you ask, can launch, stop, pause, resume or delete a scan, create a tag, and add or remove tags on assets. Tenable sets its rate limit by load and answers 429 with Retry-After; workbench reads are capped at 5,000 rows and 450 days.

Reads

• tenable_list_scansTenable scans: id and schedule UUID, name, status (running, completed, paused, canceled…), type, owner, whether scheduled, when last run…
• tenable_get_scanOne Tenable scan's latest run (or a past run by history_id): status, start and end, targets, scanner, host count…
• tenable_scan_historyThe run history of one Tenable scan, newest first: each run's id (for tenable_get_scan's history_id), status, start and end…
• tenable_vulnerabilitiesVulnerabilities across the Tenable estate (the vulnerability workbench), most severe first: plugin, family, severity, state, how many instances, VPR…
• tenable_assetsAssets Tenable knows about (the asset workbench): id, host name, IPs, operating system, last seen, whether it has an agent, sources…
• tenable_asset_vulnerabilitiesThe vulnerabilities on one Tenable asset (by its asset id from tenable_assets or tenable_get_scan), most severe first: plugin, severity, state, VPR…
• tenable_list_tagsTenable asset tags: each value's UUID, category, value, description and whether static or dynamic.
• tenable_list_scannersTenable scanners and agents' scanner groups: id, name, status (on or off), type, platform, engine version, plugin set…

Acts, when you ask

These change something in Tenable. The model is told to use them only when you ask for exactly that, and each one is granted by name: per team on a shared connection, by the owner on a personal one.

• tenable_launch_scanLaunches a Tenable scan now, against its configured targets or against alt_targets for this run only.
• tenable_stop_scanStops a pending, running or resuming Tenable scan; results so far are kept and the run ends as canceled.
• tenable_pause_scanPauses a running Tenable scan until it is resumed.
• tenable_resume_scanResumes a paused Tenable scan, which starts sending scan traffic again.
• tenable_delete_scanPermanently deletes a Tenable scan's configuration and its results; it cannot be undone (findings already on assets stay).
• tenable_create_tagCreates a static tag value in a Tenable category (named, or by UUID); a category given by a name that does not exist is created too.
• tenable_tag_assetsAdds or removes tags (tag value UUIDs) on the Tenable assets named by their UUIDs.

Connect it

First connect Tenable on Dashboard → Connections, then add Memtro to your client once. The Tenable tools appear alongside the tools of everything else you have connected; nothing is configured per connector.

claude plugin marketplace add memtro-org/claude-memtro
claude plugin install memtro@memtro --config api_key=sk-memtro-...

{
  "mcpServers": {
    "memtro": {
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

{
  "mcp": {
    "memtro": {
      "type": "remote",
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

Who may use it

The key identifies the person, and the server offers that person the tools they may use everywhere else in Memtro. A shared Tenable connection is used by the teams an administrator granted it to, tool by tool, on the Permissions page; a personal connection is used by its owner alone, and its tools that act stay off until the owner allows them. See Teams and permissions and Connectors.

Ask it like this

• › Which critical vulnerabilities affect the most assets?
• › Which assets have the highest exposure scores?
• › What did the latest run of the external scan find, by severity?
• › Which scanners are switched off?
• › Pause the weekly internal scan.

Questions

Is this an official Tenable MCP server?

No. It is Memtro's MCP server with Memtro's Tenable connector behind it: the connector reads Tenable through its API with the credentials you connect on Dashboard → Connections, and Tenable publishes nothing here. The same endpoint carries every other system you connect and Memtro's memory tools.

What does it cost?

Nothing on top of Memtro. One price per organisation by its number of users, from $50 a month for up to 10 users after a 7-day free trial, with every connector, the MCP server, jobs and memory included. You bring your own model keys.

Can it change anything in Tenable?

Only when you ask, and only what it has been granted: launch a scan, optionally against other targets (scans the customer's network); stop a running scan; pause a running scan; resume a paused scan; delete a scan with its results (permanent); create a tag value in a category; add or remove tags on assets. Every other tool reads, searches or lists. An administrator grants each acting tool by name per team, and a personal connection acts only after its owner allows it.

Which clients work?

Any MCP client that speaks Streamable HTTP: Claude Code, Cursor, Claude Desktop, OpenCode, Codex, Zed, Windsurf, Cline and the Anthropic and OpenAI SDKs. There is no local process to run; the server is remote and authenticated with your key.

Other MCP servers · Engineering and operations

• GitHub MCP server
• AWS CloudWatch MCP server
• Sentry MCP server
• ServiceNow MCP server
• Okta MCP server
• Twilio MCP server