Nessus MCP Server
The Nessus MCP Server enables AI assistants to interact with the Tenable Nessus vulnerability scanner for vulnerability scanning and analysis. You can:
List available Nessus scan templates:
list_scan_templatesStart new vulnerability scans against specified targets:
start_scanCheck the status of running scans:
get_scan_statusGet the results of completed scans:
get_scan_resultsList all past and current scans:
list_scansSearch for vulnerabilities by keyword:
search_vulnerabilitiesGet detailed information about specific vulnerabilities:
get_vulnerability_detailsOperate in a mock mode for testing without a Nessus API key
Connect to a real Nessus instance using API keys
Required runtime environment to execute the MCP server, supporting the server's execution for vulnerability scanning functionality.
Development language used for building the MCP server, providing type safety for the Nessus vulnerability scanning integration.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Nessus MCP Serverstart a vulnerability scan on 192.168.1.0/24"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Nessus MCP Server
A Model Context Protocol (MCP) server for interacting with the Tenable Nessus vulnerability scanner. This server allows AI assistants to perform vulnerability scanning and analysis through the MCP protocol.
Features
Vulnerability Scanning: Start and monitor vulnerability scans against specified targets
Scan Management: List, track, and retrieve results from vulnerability scans
Vulnerability Analysis: Search for and get detailed information about specific vulnerabilities
Mock Mode: Fully functional mock mode for testing without a Nessus API key
Related MCP server: mcp-nutanix
Tools
The server provides the following tools:
Tool Name | Description |
| List available Nessus scan templates |
| Start a new vulnerability scan against a target |
| Check the status of a running scan |
| Get the results of a completed scan |
| List all scans and their status |
| Get detailed information about a specific vulnerability |
| Search for vulnerabilities by keyword |
Installation
Prerequisites
Node.js 16 or higher
TypeScript (for development)
Building from Source
Clone the repository:
git clone https://github.com/Cyreslab-AI/nessus-mcp-server.git cd nessus-mcp-serverInstall dependencies:
npm installBuild the server:
npm run build
Usage
Running in Mock Mode
By default, the server runs in mock mode, which doesn't require a Nessus API key:
node build/index.jsRunning with Nessus API
To connect to a real Nessus instance, set the following environment variables:
NESSUS_URL=https://your-nessus-instance:8834
NESSUS_ACCESS_KEY=your-access-key
NESSUS_SECRET_KEY=your-secret-keyThen run the server:
node build/index.jsUsing with Claude for Desktop
To use this server with Claude for Desktop:
Edit your Claude for Desktop configuration file:
macOS:
~/Library/Application Support/Claude/claude_desktop_config.jsonWindows:
%APPDATA%\Claude\claude_desktop_config.json
Add the server configuration:
{
"mcpServers": {
"nessus": {
"command": "node",
"args": ["/path/to/nessus-mcp-server/build/index.js"],
"env": {
"NESSUS_URL": "https://your-nessus-instance:8834",
"NESSUS_ACCESS_KEY": "your-access-key",
"NESSUS_SECRET_KEY": "your-secret-key"
}
}
}
}For mock mode, you can omit the env section.
Example Interactions
Starting a Scan
start_scan:
target: 192.168.1.1
scan_type: basic-network-scanGetting Scan Results
get_scan_results:
scan_id: scan-1234567890Searching for Vulnerabilities
search_vulnerabilities:
keyword: log4jDevelopment
Project Structure
src/index.ts: Main server entry pointsrc/nessus-api.ts: Nessus API client with mock fallbacksrc/mock-data.ts: Mock vulnerability data for testingsrc/tools/: Tool implementationssrc/utils/: Utility functions
Adding New Tools
Define the tool schema and handler in the appropriate file in
src/tools/Import and register the tool in
src/index.ts
License
MIT
Disclaimer
This server is not affiliated with or endorsed by Tenable. Nessus is a trademark of Tenable, Inc.
Available Tools
7 toolsget_scan_resultsC
Get the results of a completed scan
| Name | Required | Description | Default |
|---|---|---|---|
| scan_id | Yes | ID of the scan to get results for |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It only states that it retrieves results for completed scans, lacking details on permissions, rate limits, error handling, or response format. This is inadequate for a tool that likely returns complex data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that directly states the tool's function without unnecessary words. It's appropriately sized and front-loaded, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of scan results (likely involving vulnerabilities or security data), no annotations, and no output schema, the description is insufficient. It doesn't explain what 'results' include, how they're structured, or any prerequisites, leaving significant gaps for an agent to use the tool effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, clearly documenting the 'scan_id' parameter. The description doesn't add any additional meaning beyond what the schema provides, such as format examples or constraints, so it meets the baseline score of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Get') and resource ('results of a completed scan'), making the purpose understandable. However, it doesn't explicitly differentiate from sibling tools like 'get_scan_status' or 'list_scans', which could cause confusion about when to use each tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides minimal guidance by specifying 'completed scan', which implies it shouldn't be used for ongoing scans. However, it doesn't mention alternatives like 'get_scan_status' for status checks or 'list_scans' for scanning available scans, leaving the agent with little context for tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_scan_statusC
Check the status of a running scan
| Name | Required | Description | Default |
|---|---|---|---|
| scan_id | Yes | ID of the scan to check |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool checks status but doesn't describe what the status includes (e.g., progress percentage, state like 'running'/'completed'), whether it's read-only (implied but not explicit), or any rate limits or authentication needs. This leaves significant gaps for an agent to understand the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the core purpose without unnecessary words. Every part earns its place, making it highly concise and well-structured for quick comprehension.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of a scanning tool with no annotations and no output schema, the description is insufficient. It doesn't explain what status information is returned (e.g., progress, errors) or behavioral aspects like idempotency or error handling, leaving the agent with incomplete context for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, with the 'scan_id' parameter clearly documented. The description adds no additional semantic context beyond implying the scan must be 'running', which is minimal value. Baseline 3 is appropriate as the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('Check') and resource ('status of a running scan'), making it immediately understandable. However, it doesn't explicitly differentiate from sibling tools like 'get_scan_results' or 'list_scans', which could provide similar status information in different contexts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'get_scan_results' or 'list_scans'. It mentions 'running scan' but doesn't clarify prerequisites (e.g., whether the scan must be actively executing) or exclusions (e.g., not for completed scans).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_vulnerability_detailsC
Get detailed information about a specific vulnerability
| Name | Required | Description | Default |
|---|---|---|---|
| vulnerability_id | Yes | ID of the vulnerability (e.g., CVE-2021-44228) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden but offers minimal behavioral insight. It states the tool retrieves 'detailed information' but doesn't specify what details are included, whether it's a read-only operation, if authentication is required, or any rate limits. The description is too vague to inform the agent about operational traits beyond the basic purpose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that directly states the tool's purpose without unnecessary words. It is front-loaded with the core action and resource, making it easy to parse quickly. Every part of the sentence earns its place by conveying essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of vulnerability details (which could include technical data, severity scores, patches, etc.), no annotations, and no output schema, the description is insufficient. It doesn't hint at the type or structure of information returned, leaving the agent unprepared for what to expect from the tool's output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with the parameter 'vulnerability_id' clearly documented in the schema as 'ID of the vulnerability (e.g., CVE-2021-44228)'. The description adds no additional parameter semantics beyond what the schema provides, so it meets the baseline for high schema coverage without compensating value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get detailed information') and target resource ('about a specific vulnerability'), making the purpose immediately understandable. It distinguishes from siblings like 'search_vulnerabilities' (which likely searches multiple) and 'get_scan_results' (which focuses on scan outputs). However, it doesn't explicitly contrast with siblings, keeping it from a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing a vulnerability ID from another source), exclusions (e.g., not for bulk lookups), or direct comparisons to siblings like 'search_vulnerabilities' for broader queries. Usage is implied but not articulated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_scansB
List all scans and their status
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden but only states what the tool does without disclosing behavioral traits like pagination, rate limits, or authentication needs. It's minimal and doesn't add meaningful context beyond the basic operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with zero waste. It's appropriately sized and front-loaded, making it easy to understand quickly without unnecessary details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (0 parameters, no output schema), the description is adequate but has clear gaps. It lacks behavioral context and usage guidelines, which are needed for a tool with siblings, making it minimally viable but incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Since there are 0 parameters and schema description coverage is 100%, the baseline is high. The description doesn't need to compensate for missing param info, and it accurately reflects the lack of inputs by not mentioning any.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('List') and resource ('all scans and their status'), making the purpose unambiguous. However, it doesn't differentiate from sibling tools like 'get_scan_status' or 'list_scan_templates', which prevents a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'get_scan_status' or 'search_vulnerabilities'. It lacks explicit context or exclusions, leaving usage decisions unclear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_scan_templatesB
List available Nessus scan templates
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden but only states the basic action without disclosing behavioral traits. It doesn't mention if this is a read-only operation, what the output format might be, or any constraints like rate limits, leaving significant gaps in understanding how the tool behaves.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no wasted words, making it highly efficient and front-loaded. It directly communicates the core purpose without unnecessary elaboration, which is ideal for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (0 parameters, no annotations, no output schema), the description is minimal but incomplete. It doesn't explain what 'scan templates' entail or provide context about the return values, leaving the agent with insufficient information to fully understand the tool's role in the Nessus ecosystem.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters, and the input schema has 100% coverage with no properties. The description doesn't need to add parameter details, so it appropriately avoids redundancy. A baseline of 4 is applied since no parameters exist, and the description doesn't mislead about inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List') and target resource ('available Nessus scan templates'), making the purpose immediately understandable. It doesn't differentiate from sibling tools like 'list_scans', which might list actual scans rather than templates, so it misses full sibling distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'list_scans' or 'start_scan'. It lacks context about prerequisites, such as whether authentication is needed or if this is for planning scans, leaving the agent with no usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_vulnerabilitiesC
Search for vulnerabilities by keyword
| Name | Required | Description | Default |
|---|---|---|---|
| keyword | Yes | Keyword to search for in vulnerability names and descriptions |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the tool searches vulnerabilities but doesn't describe behavioral traits such as whether it's read-only (implied by 'search'), potential rate limits, authentication needs, or what the search returns (e.g., list of matches, error handling). The description is minimal and lacks critical context for safe and effective use.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with a single sentence: 'Search for vulnerabilities by keyword'. It is front-loaded and wastes no words, making it easy to parse. Every part of the sentence contributes directly to the tool's purpose, earning its place efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (a search operation with no output schema) and lack of annotations, the description is incomplete. It doesn't explain what the search returns, how results are formatted, or any limitations (e.g., partial matches, case sensitivity). For a tool that likely returns a list of vulnerabilities, more context is needed to guide the agent effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, with the 'keyword' parameter fully documented in the schema. The description adds no additional meaning beyond what the schema provides—it mentions 'keyword' but doesn't elaborate on syntax, examples, or search behavior. With high schema coverage, the baseline is 3, as the description doesn't compensate but also doesn't detract.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool's purpose as 'Search for vulnerabilities by keyword', which is clear but vague. It specifies the action (search) and resource (vulnerabilities) but lacks specificity about scope or differentiation from siblings like 'get_vulnerability_details' or 'list_scans'. It doesn't mention what aspects of vulnerabilities are searched (e.g., names, descriptions as implied by schema).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention sibling tools like 'get_vulnerability_details' for specific vulnerability info or 'list_scans' for broader scan results, nor does it specify contexts like preliminary investigation versus detailed analysis. Usage is implied only by the action 'search', with no exclusions or prerequisites stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_scanC
Start a new vulnerability scan against a target
| Name | Required | Description | Default |
|---|---|---|---|
| scan_type | Yes | Type of scan to run (basic-network-scan, web-app-scan, compliance-scan) | |
| target | Yes | Target IP address or hostname to scan |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool initiates a scan but lacks details on permissions required, whether it's asynchronous, rate limits, or what happens if a scan is already running. This is inadequate for a mutation tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that directly states the tool's purpose without any fluff or redundancy. It is front-loaded and appropriately sized for the task.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of starting a scan (a mutation operation) and the lack of annotations and output schema, the description is incomplete. It does not explain what the tool returns (e.g., a scan ID, status), error conditions, or behavioral traits, leaving significant gaps for the agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, so the input schema already documents both parameters ('scan_type' and 'target') thoroughly. The description adds no additional meaning beyond implying these parameters are used to start the scan, meeting the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Start a new vulnerability scan') and the target ('against a target'), which is specific and unambiguous. However, it does not explicitly differentiate from sibling tools like 'list_scans' or 'get_scan_results', which are read-only operations, though this is implied by the verb 'Start'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites (e.g., needing a target configured), exclusions, or comparisons to siblings like 'list_scan_templates' or 'search_vulnerabilities', leaving the agent to infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
7 tool updates
v1.0.0- First observed
get_scan_results - First observed
get_scan_status - First observed
get_vulnerability_details - First observed
list_scan_templates - First observed
list_scans - First observed
search_vulnerabilities - First observed
start_scan
TDQS
Every tool has a clearly distinct purpose with no ambiguity. For example, get_scan_results retrieves completed scan data, while get_scan_status checks ongoing scan progress, and list_scans provides an overview of all scans. The separation between vulnerability-focused tools (get_vulnerability_details, search_vulnerabilities) and scan-focused tools is also well-defined.
All tools follow a consistent verb_noun pattern using snake_case throughout. The naming convention is perfectly uniform with clear action-object pairs like get_scan_results, list_scans, start_scan, and search_vulnerabilities. There are no deviations in style or structure across the tool set.
With 7 tools, the count is well-scoped for a Nessus vulnerability scanning server. Each tool earns its place by covering essential operations such as scan management (start, list, check status), result retrieval, and vulnerability lookup, without being overly sparse or bloated.
The tool surface provides strong coverage for core vulnerability scanning workflows, including scan initiation, monitoring, result access, and vulnerability details. A minor gap exists in the lack of tools for modifying or deleting scans, which might limit full lifecycle management, but agents can still perform key operations effectively.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
MCP server for Support & Service Management
Related MCP Servers
- Apache 2.0
- AlicenseNot gradedqualityFmaintenanceMCP Server for Nutanix Prism Central14MIT
- MIT
- MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Cyreslab-AI/nessus-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server