# Supercharged Tenable Identity Exposure MCP Server

> Draft · awaiting review.

> MCP server that exposes the Tenable Identity Exposure API as 133 tools, from Active Directory exposure queries to user and API-key management.

- Badge: `reach 3 · not run yet`
- Type: MCP server; tier: not run yet
- Tasks: Identity attack paths; mission: Defensive; works with: Any MCP client, Claude Code
- Source: https://github.com/taherkaraki/tie-mcp-server, pinned to `3b7f48d` (v0.2.1), licence MIT
- Last checked: 2026-10-21; next check: 2027-01-19; method v0.1, reach-v0.1

## At a glance

- **What it is:** MCP server for the Tenable Identity Exposure (TIE) API. It exposes each of the 131 API operations as its own MCP tool and adds two hand-written discovery tools. An MCP server is a program that gives your AI client extra tools; the client's model decides when to call them.
- **Made for:** Lets Claude interact with Tenable Identity Exposure (TIE) environments. +2 more
- **Runs:** On your machine, started by your AI client. Other modes: Docker over stdio (in a container on your machine).
- **Sends data to:** TIE instance at TIE_BASE_URL (always), npm registry (by default). Other connections not ruled out: read in the documentation and the cited code, not searched in full.
- **Can change things:** Changes, deletes, according to the capabilities read. Partly listed: Infrastructures, Directories, Roles, LDAP and SAML configuration, Email Notifiers, Dashboards, Widgets, License, Lockout Policy, Report Access Token, smaller groups
- **Needs:** Node.js 18 or later · A TIE API key, set in TIE_API_KEY · A Tenable Identity Exposure instance; its URL goes into TIE_BASE_URL · +2 more

Profile read at commit `3b7f48d` on 2026-10-25; every fact cites a file and line at that commit.

## What it does

MCP server for the Tenable Identity Exposure (TIE) API. It exposes each of the 131 API operations as its own MCP tool and adds two hand-written discovery tools. (README.md#L3-8)

Made for (the author says):

- Lets Claude interact with Tenable Identity Exposure (TIE) environments. (PROJECT_PLAN.md#L4)
- Maps every TIE API operation to its own tool so clients can allow or block single operations by tool name. (src/index.ts#L6-9)
- Supports several TIE environments by adding one server instance per environment. (README.md#L100-102)

Documented uses:

- Analyse attacks, deviances and checkers reported by Identity Exposure. [Identity attack paths] (PROJECT_PLAN.md#L15-20)
- Monitor alerts, events and notifications from Identity Exposure. [Alert triage] (PROJECT_PLAN.md#L15-20)
- Update a deviance with update_deviance, as shown in a README code example. [Identity attack paths] (README.md#L290-296)
- Produce reports from exports, dashboards and topology. (PROJECT_PLAN.md#L15-20)

## What it can do

| Group | What it covers | Effect | On by default |
|---|---|---|---|
| Discovery | Hand-written read tools such as get_topology, which returns each forest with its domains and their IDs for use in other tools. (src/custom-tools.ts#L54-63) | reads | yes |
| AD Objects | Lists, searches and fetches Active Directory objects by directory, infrastructure, checker or event, including an object's change history. (API_ENDPOINTS.md#L13-20) | reads | yes |
| Alerts, API Keys | Gets and updates single alerts and alerts per profile; gets the API key and creates an API key. (API_ENDPOINTS.md#L22-30) | reads, changes | yes |
| Attack Types, Attacks (IoA) | Lists and exports attacks per profile, lists attack types and reads or changes attack type configuration and options. (API_ENDPOINTS.md#L36-45) | reads, changes | yes |
| Checkers (IoE) | Lists checkers, exports checker data and reads or creates checker options per profile. (API_ENDPOINTS.md#L51-58) | reads, changes | yes |
| Deviances (IoE) | Lists, searches and updates deviances per directory, checker, AD object or event, including bulk updates per checker. (API_ENDPOINTS.md#L80-89) | reads, changes | yes |
| Events | Searches events and fetches single events by directory or infrastructure, with their reasons. (API_ENDPOINTS.md#L109-113) | reads | yes |
| Profiles | Creates, clones, updates, deletes, commits and unstages profiles and reads profile scores and topology. (API_ENDPOINTS.md#L147-156) | reads, changes, deletes | yes |
| Users | Lists, creates, updates and deletes users, changes passwords and replaces a user's role list. (API_ENDPOINTS.md#L193-201) | reads, changes, deletes | yes |
| Syslogs | Lists, creates, updates and deletes syslog forwarding configurations and sends test messages. (API_ENDPOINTS.md#L184-191) | reads, changes, deletes | yes |

Partly listed: Infrastructures, Directories, Roles, LDAP and SAML configuration, Email Notifiers, Dashboards, Widgets, License, Lockout Policy, Report Access Token, smaller groups

## How it runs

Tool definitions are generated from the OpenAPI spec into a single data file, and one generic dispatcher turns any descriptor plus arguments into an HTTP request. (README.md#L212-214)

- Starts: On your machine, started by your AI client. The MCP client starts it as a local subprocess and talks to it over stdio. (README.md#L16-17)
- Can also run: In a container on your machine (Docker over stdio, switch `docker run -i --rm`). A Docker image built from the bundled Dockerfile runs the same stdio server; the client launches it with docker run -i. (Dockerfile#L33-35)
- Your AI client: **MCP client configuration**: Holds the TIE credentials, which are configured on the client side and passed to the MCP server process. (AUTHENTICATION.md#L8)
- Your machine: **tie-mcp-server (src/index.ts)**: Routes each tool call: custom tools go to their own handler, all others through the generic descriptor dispatcher. (src/index.ts#L69-74)
- Your machine: **Generated tool descriptors**: 131 descriptors (name, method, path, schema) generated from the OpenAPI spec by scripts/generate-tools.mjs. (README.md#L217-226)
- Your machine: **Generic dispatcher (src/dispatch.ts)**: Fills path parameters, query string and body from the tool arguments and sends one HTTP request per call. (src/dispatch.ts#L4-8)
- Container on your machine: **Docker container (optional)**: Optional image that bundles Node.js and runs the compiled server as the unprivileged node user. (Dockerfile#L26-35)
- Outside your machine: **Tenable Identity Exposure API**: The TIE instance at TIE_BASE_URL, which receives every request with the API key in the x-api-key header. (src/client.ts#L12-18)
- Sends data to TIE instance at TIE_BASE_URL (vendor API, always): Each tool call becomes an HTTP request to the TIE instance with the API key in the x-api-key header. (src/client.ts#L12-19)
- Sends data to npm registry (download, by default): With the recommended npx -y setup, npx fetches the tie-mcp-server package from npm when the client starts the server. (README.md#L19-25)

## What you need

- Runtime: Node.js 18 or later. (SETUP_GUIDE.md#L7)
- Credentials: A TIE API key, set in TIE_API_KEY. (README.md#L79)
- Account: A Tenable Identity Exposure instance; its URL goes into TIE_BASE_URL. (README.md#L78)
- Authorisation: The account behind the API key needs the permissions in TIE that the called operations require. (SETUP_GUIDE.md#L169-173)
- Other: Each generated tool records the TIE product licence types its endpoint requires (licenseTypes). (scripts/generate-tools.mjs#L338)
- Installer: The recommended Option A starts the npm package tie-mcp-server through npx -y without a version pin. (README.md#L19-25)
- Installer: Option B clones the repository and runs npm install, which also builds through the prepare script, then npm run build. (README.md#L30-35)
- Installer: The Docker build runs npm install against a manifest without a lockfile, which the project gitignores. (Dockerfile#L7-10)

## Limits and risks

- Without TIE_ALLOWED_SAFETY the server offers every tool, including write and destructive ones; a value such as read or read,write narrows the set. (src/index.ts#L32-37)
- The generator derives the safety tier from the tool-name prefix: get, list, search and export are read, delete and unstage are destructive, everything else is write. (scripts/generate-tools.mjs#L283-288)
- get_api_key, which returns the API key of the current user, is in the read tier and stays available when TIE_ALLOWED_SAFETY is read. (src/generated/tools.ts#L570-575)
- get_report_access_token, which returns the token used to pull data from Tenable Cloud, is in the read tier. (src/generated/tools.ts#L4194-4198)
- The update_ldap_configuration body accepts url, searchUserDN and searchUserPassword, so a write-tier call can change how the TIE instance binds to LDAP. (src/generated/tools.ts#L3500-3509)
- The syslog creation body requires ip, port, protocol and tls, so a write-tier call can make the TIE instance forward events to a host given in the call. (src/generated/tools.ts#L4779-4788)
- The author states that a shared, centrally hosted instance would need the HTTP/SSE transport and a listening port, and that this is not implemented. (README.md#L305-311)
- A troubleshooting note offers npm config set strict-ssl false, which turns off npm's certificate check, as a quick fix behind Netskope, with a warning. (NETSKOPE_NPM_FIX.md#L8-13)
- The SAML configuration update body accepts enabled, providerLoginUrl and signatureCertificate, so a call can switch SAML sign-in to the TIE instance on and set its identity provider. (src/generated/tools.ts#L4577-4586)
- The deviance update body (PATCH /ad-object-deviance-history/:id) takes one field, ignoreUntil, a date-time, and sets additionalProperties to false. (src/generated/tools.ts#L1789-1798)
- The author's session handoff notes state that the Docker image was not build-verified. (SESSION_HANDOFF.md#L19)

## Rights in plain language

- Declared: network 1 (talks only to declared hosts), secrets 1 (uses one scoped token), persistence 3 (adds autostart, users or keys), approval 1 (has narrow pre-approvals).
- Code: reach 3 (privileged): persistence 3 (adds autostart, users or keys); unknown: approval.
- Lab: not run yet.

Why three columns? Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

## Privilege Reach

Reach level 3 (privileged).

| Right | Declared | Code | Lab |
|---|---|---|---|
| Files: where does it read and write? | not declared | 1 reads outside the project | not run yet |
| Network: whom does it talk to? | 1 talks only to declared hosts | 1 talks only to declared hosts | not run yet |
| Execution: what does it run? | not declared | 1 runs only declared programs | not run yet |
| Secrets: which credentials does it touch? | 1 uses one scoped token | 1 uses one scoped token | not run yet |
| Persistence: what survives the run? | 3 adds autostart, users or keys | 3 adds autostart, users or keys | not run yet |
| Approval: does it ask before acting? | 1 has narrow pre-approvals | ? unknown | not run yet |

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe

## Install

### Upstream

Quoted from `README.md#L19-25` at the pinned commit (not a command to copy): `{ "command": "npx", "args": ["-y", "tie-mcp-server"] }`


### Run it with least privilege

- note: `derived from the code, not tested in the lab; set TIE_ALLOWED_SAFETY=read, use the API key of a read-only Identity Exposure profile, keep in mind that get_api_key stays available in read mode, and build from a clone at the pinned release instead of npx -y`

- derived, not tested: proposed from the code analysis

## Lab runs

Not run yet.

## Questions and answers

**Why compare declared, code and lab?**

Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

**What rights does Supercharged Tenable Identity Exposure MCP Server declare?**

network 1 (talks only to declared hosts), secrets 1 (uses one scoped token), persistence 3 (adds autostart, users or keys), approval 1 (has narrow pre-approvals).

**What does its code suggest?**

reach 3 (privileged): persistence 3 (adds autostart, users or keys); unknown: approval.

**What did it use when it ran in the lab?**

not run yet.

**Was it tried, and when?**

Not yet (tier listed).

**What changed since the last check?**

Upstream last pushed 2026-07-28; 0 release(s) since the pinned version.

**How do I run it with least privilege?**

Derived, not tested: note: derived from the code, not tested in the lab; set TIE_ALLOWED_SAFETY=read, use the API key of a read-only Identity Exposure profile, keep in mind that get_api_key stays available in read mode, and build from a clone at the pinned release instead of npx -y

Method: https://readbeforerun.ai/method/