Use Tenable Hexa AI via MCP Server

The following is not supported in Tenable FedRAMP Moderate environments. For more information, see the Tenable FedRAMP Product Offering.

Required User Role: Scan Operator, Standard User, Scan Manager, Administrator, or Custom Role with appropriate privileges

The Tenable Hexa AI MCP Server is a Tenable-hosted interface that exposes 90 structured tools from Tenable's Exposure Data Fabric to any MCP-compatible AI client. It acts as a secure, universal adapter between your preferred Large Language Model and Tenable's exposure management platform — transforming exposure intelligence into coordinated action to reduce cyber risk.

With the MCP server, you can connect AI clients such as Claude Desktop, Claude Code, or Cursor directly to your Tenable environment. Your AI assistant can then discover and invoke Tenable tools to search assets, investigate vulnerabilities, create dashboards, tag assets, launch scans, and build custom workflows — all using your actual exposure data.

The MCP server enables you to bring your own LLM while leveraging Tenable's ground truth: structured tools backed by twenty years of vulnerability research and exposure context from over 40,000 customer environments. Your choice of model, our ground truth.

Prerequisites

Before you connect to the Tenable Hexa AI MCP Server, ensure you have the following:

• A Tenable One account with API key access.

• Tenable One Vulnerability Management API Keys (Access Key and Secret Key).

  Tip: To generate or retrieve your API keys, navigate to Settings > My Account > API Keys. See Generate API Keys for more information.

• An MCP-compatible AI client, such as:

  • Claude Desktop

  • Claude Code

  • Cursor

  • Any client that supports the Model Context Protocol over HTTP

Connect to the MCP Server

The Tenable Hexa AI MCP Server is available as an HTTP MCP endpoint. To connect, configure your MCP client with the server URL and your Tenable API credentials.

• Server URL: https://cloud.tenable.com/mcp/

• Authentication: All requests are authenticated using the X-ApiKeys HTTP header with your Tenable One Vulnerability Management Access Key and Secret Key:

  X-ApiKeys: accessKey=<YOUR_ACCESS_KEY>;secretKey=<YOUR_SECRET_KEY>

Claude Desktop

Claude Desktop connects to remote MCP servers using the mcp-remote npm package as a local stdio-to-HTTP bridge.

Prerequisites

You must have Node.js installed:

• macOS: brew install node
• Windows: nodejs.org installer

To add the Tenable Hexa AI MCP server to Claude Desktop:

1. Open your Claude Desktop configuration file:

   • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
   • Windows: %APPDATA%\Claude\claude_desktop_config.json

2. Add the following entry to the mcpServers section:

   Copy

   {
     "mcpServers": {
       "tenable": {
         "command": "npx",
         "args": [
           "mcp-remote",
           "https://cloud.tenable.com/mcp/",
           "--header",
           "X-ApiKeys: accessKey=<YOUR_ACCESS_KEY>;secretKey=<YOUR_SECRET_KEY>"
         ]
       }
     }
   }

   Replace <YOUR_ACCESS_KEY> and <YOUR_SECRET_KEY> with your Tenable One API keys.

3. Restart Claude Desktop (Cmd+Q on macOS or Quit from system tray on Windows — closing the window is not enough).

Claude Desktop discovers the available Tenable tools automatically. You can verify the connection by asking Claude to list your scans or search for assets.

Troubleshooting:

If the connector does not appear on the Settings > Connectors page, ensure you fully quit and relaunched Claude Desktop. Check logs at:

• macOS: ~/Library/Logs/Claude/mcp-server-tenable.log
• Windows: %APPDATA%\Claude\logs\mcp-server-tenable.log

Claude Code

To add the Tenable Hexa AI MCP server to Claude Code:

1. In your terminal, run the following command. Replace <YOUR_ACCESS_KEY> and <YOUR_SECRET_KEY> with your Tenable One API keys:

   Copy

   claude mcp add 
       --transport http tenable https://cloud.tenable.com/mcp 
       --header "X-ApiKeys: accessKey=<YOUR_ACCESS_KEY>;secretKey=<YOUR_SECRET_KEY>"

   Claude Code discovers the available Tenable tools automatically on the next session.

Cursor

To add the Tenable Hexa AI MCP server to Cursor:

1. Open your Cursor Settings:
   • macOS: Cmd+
   • Windows: Ctrl+,
2. Navigate to MCP Servers > Add Server.

3. Configure the following settings. Replace <YOUR_ACCESS_KEY> and <YOUR_SECRET_KEY> with your Tenable One API keys::

   • Transport: HTTP
   • URL: https://cloud.tenable.com/mcp/
   • Headers: X-ApiKeys: accessKey=<YOUR_ACCESS_KEY>;secretKey=<YOUR_SECRET_KEY>

VS Code / GitHub Copilot

GitHub Copilot in VS Code supports MCP servers via the chat agent mode.

To add the Tenable Hexa AI MCP server to VS Code / GitHub Copilot:

1. Open your VS Code User Settings (JSON):

   • macOS: Cmd+Shift+P
   • Windows: Ctrl+Shift+P,

   and select Preferences: Open User Settings (JSON).

2. Add the following to your settings.json. Replace <YOUR_ACCESS_KEY> and <YOUR_SECRET_KEY> with your Tenable One API keys:

   Copy

   {
     "mcp": {
       "servers": {
         "tenable": {
           "type": "http",
           "url": "https://cloud.tenable.com/mcp/",
           "headers": {
             "X-ApiKeys": "accessKey=<YOUR_ACCESS_KEY>;secretKey=<YOUR_SECRET_KEY>"
           }
         }
       }
     }
   }

3. Alternatively, create or edit an .vscode/mcp.json file in your workspace root:

   Copy

   {
     "servers": {
       "tenable": {
         "type": "http",
         "url": "https://cloud.tenable.com/mcp/",
         "headers": {
           "X-ApiKeys": "${input:tenableApiKeys}"
         }
       }
     },
     "inputs": [
       {
         "id": "tenableApiKeys",
         "type": "promptString",
         "description": "Tenable API Keys (format: accessKey=...;secretKey=...)",
         "password": true
       }
     ]
   }

   Tip: The .vscode/mcp.json approach uses VS Code input variables to prompt for credentials at runtime, avoiding hardcoded secrets. Add .vscode/mcp.json to your .gitignore if you prefer not to share the configuration.

4. To use the tools, open the Copilot chat panel (Ctrl+Shift+I / Cmd+Shift+I), switch to Agent mode, and ask Copilot to interact with Tenable. For example: "List my recent scans in Tenable."

   Note: Ensure you are running VS Code 1.99 or later and have the GitHub Copilot extension installed. MCP support requires Agent mode — it is not available in inline or edit mode.

Other MCP Clients

To add any other MCP-compatible client that supports HTTP transport:

1. Add a new MCP server with the following settings. Replace <YOUR_ACCESS_KEY> and <YOUR_SECRET_KEY> with your Tenable One API keys:

   • Transport type: HTTP

   • URL: https://cloud.tenable.com/mcp/

   • Headers: X-ApiKeys: accessKey=<YOUR_ACCESS_KEY>;secretKey=<YOUR_SECRET_KEY>

Example Workflows

The following examples illustrate common tasks you can accomplish by interacting with your AI client after connecting to the Tenable Hexa AI MCP server.

Create a Ticket using Tenable Hexa AI

Ask your AI client:

"Create jira tickets based on my top 10 most critical findings."

The AI uses asset_search to identify the affected web servers, ticket_create_issue to generate the ticket with the appropriate priority and assignment, and ticket_notify_assignees to alert the responsible parties, presenting each write action for your confirmation before execution.

Tag All Windows Devices

Ask your AI client:

"Find all Windows devices in my environment and tag them with the category 'Operating System' and value 'Windows'."

The AI uses tenable_one_search_assets to find Windows assets, tagging_create_tag to create the tag if needed, and tagging_add_tags_assets to apply the tag, presenting each write action for your confirmation before execution.

Build a Risk Dashboard

Ask your AI client:

"Create a dashboard called 'Current Risk Overview' using the Vulnerability Management Overview template."

The AI uses dashboard_list_dashboard_templates to find the appropriate template and dashboard_create_dashboard_from_template to create it. You can then ask it to add additional widgets or apply context filters.

Investigate Critical Vulnerabilities

Ask your AI client:

"Show me all vulnerabilities with a critical severity in my environment, and list the affected assets."

The AI uses workbenches_list_vulnerabilities with severity filters, then workbenches_list_assets_with_vulnerabilities to identify affected hosts, providing a consolidated view of your highest-risk exposures.

Launch a Targeted Scan

Ask your AI client:

"Create and launch a scan called 'Weekly Perimeter Check' targeting 10.0.1.0/24 using the Basic Network Scan template."

The AI uses scan_create with the specified targets and template, then scan_launch to start the scan; each step requires your explicit confirmation.

Trust, Safety & Governance

The Tenable Hexa AI MCP Server is designed to give you complete control and transparency over all actions.

Control	Description
Authentication	All API calls are authenticated using your existing Tenable One API keys. Credentials are transmitted securely via the X-ApiKeys HTTP header.
RBAC & Permissions	All actions are performed on behalf of the authenticated user using their existing Tenable permissions. The MCP server does not have elevated privileges. Requests are routed through the same permission validation as standard Tenable API requests.
Data Flow	Your external AI client sends tool invocation requests to the Tenable Hexa AI MCP server. The MCP server executes the request against Tenable's API and returns structured results. Your data traverses to the external LLM as part of this flow — this is under your control based on your choice of LLM provider.

API Rate Limiting

Tenable Hexa AI enforces rate limits at the API gateway level to ensure service stability. Rate limiting applies across all API requests and is independent of your token allocation. If you exceed the rate limit, the API returns a 429 (Too Many Requests) response. This indicates you've exceeded the maximum request frequency for your account tier.

Best Practices:

• Implement exponential backoff in your integrations to automatically retry failed requests

• Space out API calls rather than sending requests in rapid bursts

• Monitor API response codes to detect rate limit conditions early

For most legitimate use cases, rate limiting is not encountered during normal operations. If you consistently receive 429 responses, contact Tenable Support to discuss your account tier and usage patterns.

Data Handling FAQ

The following answers common questions about how data is used, stored, and transmitted when you use the Tenable Hexa AI MCP server.

Data Sources

Tenable Hexa AI operates on your organization's own Tenable Exposure Data Fabric — the vulnerability, asset, identity, configuration, and AI-system data your Tenable products have already collected — plus whatever you provide directly in your prompts. No customer data is used to train the underlying models.

Data Transmission

Tenable Hexa AI's orchestration and platform layer run inside Tenable's SaaS environment. Because the MCP server uses a Bring Your Own LLM model (see Data Flow in the table above), the reasoning step is handled by the LLM provider you configure rather than a Tenable-selected provider. Where and how that provider transmits, processes, or retains your data depends on your agreement with that provider.

Data Residency

Because the MCP server uses a Bring Your Own LLM model, the processing region depends entirely on the LLM provider you configure — Tenable does not control or guarantee a region for this step.

File Uploads

File upload support is currently limited to CSV files for creating asset tags. Other file types and upload workflows are not yet supported.

Custom Roles

The MCP server respects Tenable's role-based access control. The actions available to your AI client depend on the permissions of the API key used to authenticate. For more information about role-based access control, see Access Control.

Privilege Level	MCP Capabilities
Read	Search and retrieve assets, vulnerabilities, scan results, dashboards, plugins, and reports.
Write	All Read capabilities, plus: launch scans, add tags to assets, add widgets to dashboards, and modify scan schedules.
Manage	All Write capabilities, plus: create and delete scans, dashboards, policies, tags, and reports. Configure scan policies and agent settings.