Use Tenable Hexa AI via MCP Server

Required User Role: Scan Operator, Standard User, Scan Manager, Administrator, or Custom Role with appropriate privileges

The Tenable Hexa AI MCP Server is a Tenable-hosted interface that exposes 90 structured tools from Tenable's Exposure Data Fabric to any MCP-compatible AI client. It acts as a secure, universal adapter between your preferred Large Language Model and Tenable's exposure management platform — transforming exposure intelligence into coordinated action to reduce cyber risk.

With the MCP server, you can connect AI clients such as Claude Desktop, Claude Code, or Cursor directly to your Tenable environment. Your AI assistant can then discover and invoke Tenable tools to search assets, investigate vulnerabilities, create dashboards, tag assets, launch scans, and build custom workflows — all using your actual exposure data.

The MCP server enables you to bring your own LLM while leveraging Tenable's ground truth: structured tools backed by twenty years of vulnerability research and exposure context from over 40,000 customer environments. Your choice of model, our ground truth.

Prerequisites

Before you connect to the Tenable Hexa AI MCP Server, ensure you have the following:

• A Tenable One account with API key access.

• Tenable Vulnerability Management API Keys (Access Key and Secret Key).

  Tip: To generate or retrieve your API keys, navigate to Settings > My Account > API Keys. See Generate API Keys for more information.

• An MCP-compatible AI client, such as:

  • Claude Desktop

  • Claude Code

  • Cursor

  • Any client that supports the Model Context Protocol over HTTP

Connect to the MCP Server

The Tenable Hexa AI MCP Server is available as an HTTP MCP endpoint. To connect, configure your MCP client with the server URL and your Tenable API credentials.

• Server URL: https://cloud.tenable.com/mcp/

• Authentication: All requests are authenticated using the X-ApiKeys HTTP header with your Tenable Vulnerability Management Access Key and Secret Key:

  X-ApiKeys: accessKey=<YOUR_ACCESS_KEY>;secretKey=<YOUR_SECRET_KEY>

Claude Desktop

Claude Desktop connects to remote MCP servers using the mcp-remote npm package as a local stdio-to-HTTP bridge.

Prerequisites

You must have Node.js installed:

• macOS: brew install node
• Windows: nodejs.org installer

To add the Tenable Hexa AI MCP server to Claude Desktop:

1. Open your Claude Desktop configuration file:

   • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
   • Windows: %APPDATA%\Claude\claude_desktop_config.json

2. Add the following entry to the mcpServers section:

   Copy

   {
     "mcpServers": {
       "tenable": {
         "command": "npx",
         "args": [
           "mcp-remote",
           "https://cloud.tenable.com/mcp/",
           "--header",
           "X-ApiKeys: accessKey=<YOUR_ACCESS_KEY>;secretKey=<YOUR_SECRET_KEY>"
         ]
       }
     }
   }

   Replace <YOUR_ACCESS_KEY> and <YOUR_SECRET_KEY> with your Tenable One API keys.

3. Restart Claude Desktop (Cmd+Q on macOS or Quit from system tray on Windows — closing the window is not enough).

Claude Desktop discovers the available Tenable tools automatically. You can verify the connection by asking Claude to list your scans or search for assets.

Troubleshooting:

If the connector does not appear on the Settings > Connectors page, ensure you fully quit and relaunched Claude Desktop. Check logs at:

• macOS: ~/Library/Logs/Claude/mcp-server-tenable.log
• Windows: %APPDATA%\Claude\logs\mcp-server-tenable.log

Claude Code

To add the Tenable Hexa AI MCP server to Claude Code:

1. In your terminal, run the following command. Replace <YOUR_ACCESS_KEY> and <YOUR_SECRET_KEY> with your Tenable One API keys:

   Copy

   claude mcp add 
       --transport http tenable https://cloud.tenable.com/mcp 
       --header "X-ApiKeys: accessKey=<YOUR_ACCESS_KEY>;secretKey=<YOUR_SECRET_KEY>"

   Claude Code discovers the available Tenable tools automatically on the next session.

Cursor

To add the Tenable Hexa AI MCP server to Cursor:

1. Open your Cursor Settings:
   • macOS: Cmd+
   • Windows: Ctrl+,
2. Navigate to MCP Servers > Add Server.

3. Configure the following settings. Replace <YOUR_ACCESS_KEY> and <YOUR_SECRET_KEY> with your Tenable One API keys::

   • Transport: HTTP
   • URL: https://cloud.tenable.com/mcp/
   • Headers: X-ApiKeys: accessKey=<YOUR_ACCESS_KEY>;secretKey=<YOUR_SECRET_KEY>

VS Code / GitHub Copilot

GitHub Copilot in VS Code supports MCP servers via the chat agent mode.

To add the Tenable Hexa AI MCP server to VS Code / GitHub Copilot:

1. Open your VS Code User Settings (JSON):

   • macOS: Cmd+Shift+P
   • Windows: Ctrl+Shift+P,

   and select Preferences: Open User Settings (JSON).

2. Add the following to your settings.json. Replace <YOUR_ACCESS_KEY> and <YOUR_SECRET_KEY> with your Tenable One API keys:

   Copy

   {
     "mcp": {
       "servers": {
         "tenable": {
           "type": "http",
           "url": "https://cloud.tenable.com/mcp/",
           "headers": {
             "X-ApiKeys": "accessKey=<YOUR_ACCESS_KEY>;secretKey=<YOUR_SECRET_KEY>"
           }
         }
       }
     }
   }

3. Alternatively, create or edit an .vscode/mcp.json file in your workspace root:

   Copy

   {
     "servers": {
       "tenable": {
         "type": "http",
         "url": "https://cloud.tenable.com/mcp/",
         "headers": {
           "X-ApiKeys": "${input:tenableApiKeys}"
         }
       }
     },
     "inputs": [
       {
         "id": "tenableApiKeys",
         "type": "promptString",
         "description": "Tenable API Keys (format: accessKey=...;secretKey=...)",
         "password": true
       }
     ]
   }

   Tip: The .vscode/mcp.json approach uses VS Code input variables to prompt for credentials at runtime, avoiding hardcoded secrets. Add .vscode/mcp.json to your .gitignore if you prefer not to share the configuration.

4. To use the tools, open the Copilot chat panel (Ctrl+Shift+I / Cmd+Shift+I), switch to Agent mode, and ask Copilot to interact with Tenable. For example: "List my recent scans in Tenable."

   Note: Ensure you are running VS Code 1.99 or later and have the GitHub Copilot extension installed. MCP support requires Agent mode — it is not available in inline or edit mode.

Other MCP Clients

To add any other MCP-compatible client that supports HTTP transport:

1. Add a new MCP server with the following settings. Replace <YOUR_ACCESS_KEY> and <YOUR_SECRET_KEY> with your Tenable One API keys:

   • Transport type: HTTP

   • URL: https://cloud.tenable.com/mcp/

   • Headers: X-ApiKeys: accessKey=<YOUR_ACCESS_KEY>;secretKey=<YOUR_SECRET_KEY>

Example Workflows

The following examples illustrate common tasks you can accomplish by interacting with your AI client after connecting to the Tenable Hexa AI MCP server.

Tag All Windows Devices

Ask your AI client:

"Find all Windows devices in my environment and tag them with the category 'Operating System' and value 'Windows'."

The AI uses tenable_one_search_assets to find Windows assets, tagging_create_tag to create the tag if needed, and tagging_add_tags_assets to apply the tag, presenting each write action for your confirmation before execution.

Build a Risk Dashboard

Ask your AI client:

"Create a dashboard called 'Current Risk Overview' using the Vulnerability Management Overview template."

The AI uses dashboard_list_dashboard_templates to find the appropriate template and dashboard_create_dashboard_from_template to create it. You can then ask it to add additional widgets or apply context filters.

Investigate Critical Vulnerabilities

Ask your AI client:

"Show me all vulnerabilities with a critical severity in my environment, and list the affected assets."

The AI uses workbenches_list_vulnerabilities with severity filters, then workbenches_list_assets_with_vulnerabilities to identify affected hosts, providing a consolidated view of your highest-risk exposures.

Launch a Targeted Scan

Ask your AI client:

"Create and launch a scan called 'Weekly Perimeter Check' targeting 10.0.1.0/24 using the Basic Network Scan template."

The AI uses scan_create with the specified targets and template, then scan_launch to start the scan; each step requires your explicit confirmation.

Trust, Safety & Governance

The Tenable Hexa AI MCP Server is designed to give you complete control and transparency over all actions.

Control	Description
Authentication	All API calls are authenticated using your existing Tenable One API keys. Credentials are transmitted securely via the X-ApiKeys HTTP header.
RBAC & Permissions	All actions are performed on behalf of the authenticated user using their existing Tenable permissions. The MCP server does not have elevated privileges. Requests are routed through the same permission validation as standard Tenable API requests.
Data Flow	Your external AI client sends tool invocation requests to the Tenable Hexa AI MCP server. The MCP server executes the request against Tenable's API and returns structured results. Your data traverses to the external LLM as part of this flow — this is under your control based on your choice of LLM provider.

Custom Roles

The MCP server respects Tenable's role-based access control. The actions available to your AI client depend on the permissions of the API key used to authenticate. For more information about role-based access control, see Access Control.

Privilege Level	MCP Capabilities
Read	Search and retrieve assets, vulnerabilities, scan results, dashboards, plugins, and reports.
Write	All Read capabilities, plus: launch scans, add tags to assets, add widgets to dashboards, and modify scan schedules.
Manage	All Write capabilities, plus: create and delete scans, dashboards, policies, tags, and reports. Configure scan policies and agent settings.