About Tenable Activity MCP
Tenable Activity MCP is an MCP server in the Security category: mCP server exposing the Tenable Vulnerability Management audit log as analysis tools: per-actor baselines, API-key usage attribution, and explained anomaly detection.
Install
git clone https://github.com/brendanong95/tenable-activity-mcpThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (6)
check_permission_prereqsPass/fail on whether the configured keys can actually read the audit log, with remediation text.
Parameters not published.
detect_anomaliesCompares a window against each actor's stored baseline. Flags new actors, volume spikes, unseen source IPs, failed-event bursts, sustained failure rates, off-hours spikes and never-before-seen actions - each with evidence and a reasoning sentence.
Parameters not published.
get_actor_profileOne actor's full picture: role (best effort), all-time action breakdown, access types, every source IP seen.
Parameters not published.
get_api_key_usageAPI-key-driven activity only, grouped by actor: action breakdown, distinct source IPs, first/last seen.
Parameters not published.
list_activity_eventsEvent feed for a window, with actor/action filters. Pagination is followed automatically; returns a resumable `next_token` if a safety cap is hit.
Parameters not published.
summarize_activityDeterministic rollup for a window: counts by actor, action, CRUD type and access type, plus failure/anonymous rates.
Parameters not published.
Ask AI
Ask AI about Tenable Activity MCP
Powered by Claude · Grounded in docs
Security checks
6 checks have not been run yet.