{
  "$schema": "https://readbeforerun.ai/schema/entry.schema.json",
  "entry": {
    "id": "taherkaraki-tie-mcp-server",
    "name": "Supercharged Tenable Identity Exposure MCP Server",
    "summary": "MCP server that exposes the Tenable Identity Exposure API as 133 tools, from Active Directory exposure queries to user and API-key management.",
    "draft": "review",
    "type": "mcp-server",
    "mission": [
      "defensive"
    ],
    "task": [
      "identity-attack-paths"
    ],
    "domain": [
      "identity-access"
    ],
    "runtime": [
      "mcp-generic",
      "claude-code"
    ],
    "tier": "listed",
    "last_checked": "2026-10-21",
    "next_check": "2027-01-19",
    "freshness": "fresh",
    "superseded": false,
    "in_my_kit": null,
    "advice": null,
    "code_shows": "adds autostart, users or keys · Approval: unknown",
    "source": {
      "repo": "https://github.com/taherkaraki/tie-mcp-server",
      "subpath": null,
      "commit": "3b7f48dd4bcd53a35773a9768d357f086adb7d00",
      "version": "v0.2.1",
      "license": "MIT"
    },
    "install": {
      "skills_cli": null,
      "claude_code": null,
      "upstream": "{ \"command\": \"npx\", \"args\": [\"-y\", \"tie-mcp-server\"] }",
      "bundled": false
    },
    "scan": {
      "status": "static scan pending (not run)"
    },
    "reach": {
      "method": "reach-v0.1",
      "level": 3,
      "level_source": "static",
      "level_label": "privileged",
      "unknown_axes": 1,
      "verdict": "not-run",
      "badge": "reach 3 · not run yet",
      "long": "reach 3 from code (privileged); lab: not run yet",
      "declared": {
        "net": 1,
        "cred": 1,
        "persist": 3,
        "hitl": 1
      },
      "static": {
        "level": 3,
        "fs": 1,
        "net": 1,
        "exec": 1,
        "cred": 1,
        "persist": 3,
        "hitl": null,
        "unknown": [
          "hitl"
        ]
      },
      "observed": null,
      "surplus": null,
      "fit": null,
      "exports": {
        "aivss": {
          "fs": 0.5,
          "net": 0.5,
          "exec": 0.5,
          "cred": 0.5,
          "persist": 1,
          "hitl": null
        },
        "usf_risk_tier": "L3"
      }
    },
    "profile": {
      "read_at": "3b7f48dd4bcd53a35773a9768d357f086adb7d00",
      "read_on": "2026-10-25",
      "overview": "MCP server for the Tenable Identity Exposure (TIE) API. It exposes each of the 131 API operations as its own MCP tool and adds two hand-written discovery tools.",
      "purpose": [
        "Lets Claude interact with Tenable Identity Exposure (TIE) environments.",
        "Maps every TIE API operation to its own tool so clients can allow or block single operations by tool name.",
        "Supports several TIE environments by adding one server instance per environment."
      ],
      "use_cases": [
        {
          "text": "Analyse attacks, deviances and checkers reported by Identity Exposure.",
          "task": "identity-attack-paths"
        },
        {
          "text": "Monitor alerts, events and notifications from Identity Exposure.",
          "task": "alert-triage"
        },
        {
          "text": "Update a deviance with update_deviance, as shown in a README code example.",
          "task": "identity-attack-paths"
        },
        {
          "text": "Produce reports from exports, dashboards and topology.",
          "task": null
        }
      ],
      "maturity": null,
      "capabilities": [
        {
          "name": "Discovery",
          "effects": [
            "reads"
          ],
          "enabled": "default"
        },
        {
          "name": "AD Objects",
          "effects": [
            "reads"
          ],
          "enabled": "default"
        },
        {
          "name": "Alerts, API Keys",
          "effects": [
            "reads",
            "changes"
          ],
          "enabled": "default"
        },
        {
          "name": "Attack Types, Attacks (IoA)",
          "effects": [
            "reads",
            "changes"
          ],
          "enabled": "default"
        },
        {
          "name": "Checkers (IoE)",
          "effects": [
            "reads",
            "changes"
          ],
          "enabled": "default"
        },
        {
          "name": "Deviances (IoE)",
          "effects": [
            "reads",
            "changes"
          ],
          "enabled": "default"
        },
        {
          "name": "Events",
          "effects": [
            "reads"
          ],
          "enabled": "default"
        },
        {
          "name": "Profiles",
          "effects": [
            "reads",
            "changes",
            "deletes"
          ],
          "enabled": "default"
        },
        {
          "name": "Users",
          "effects": [
            "reads",
            "changes",
            "deletes"
          ],
          "enabled": "default"
        },
        {
          "name": "Syslogs",
          "effects": [
            "reads",
            "changes",
            "deletes"
          ],
          "enabled": "default"
        }
      ],
      "effects": [
        "reads",
        "changes",
        "deletes"
      ],
      "runs": "local-process",
      "listens": [],
      "sends_to": [
        {
          "to": "TIE instance at TIE_BASE_URL",
          "kind": "vendor-api",
          "when": "always"
        },
        {
          "to": "npm registry",
          "kind": "download",
          "when": "default"
        }
      ],
      "model": "client",
      "needs": [
        {
          "kind": "runtime",
          "text": "Node.js 18 or later."
        },
        {
          "kind": "credentials",
          "text": "A TIE API key, set in TIE_API_KEY."
        },
        {
          "kind": "account",
          "text": "A Tenable Identity Exposure instance; its URL goes into TIE_BASE_URL."
        },
        {
          "kind": "authorization",
          "text": "The account behind the API key needs the permissions in TIE that the called operations require."
        },
        {
          "kind": "other",
          "text": "Each generated tool records the TIE product licence types its endpoint requires (licenseTypes)."
        }
      ]
    },
    "urls": {
      "page": "/catalog/taherkaraki-tie-mcp-server/",
      "json": "/entries/taherkaraki-tie-mcp-server.json",
      "md": "/catalog/taherkaraki-tie-mcp-server.md",
      "badge": "/badge/taherkaraki-tie-mcp-server.svg"
    }
  },
  "data": {
    "schema_version": "0.5",
    "slug": "taherkaraki-tie-mcp-server",
    "name": "Supercharged Tenable Identity Exposure MCP Server",
    "summary": "MCP server that exposes the Tenable Identity Exposure API as 133 tools, from Active Directory exposure queries to user and API-key management.",
    "draft": "review",
    "in_my_kit": null,
    "type": "mcp-server",
    "mission": [
      "defensive"
    ],
    "task": [
      "identity-attack-paths"
    ],
    "domain": [
      "identity-access"
    ],
    "phase": [
      "def:identify",
      "def:detect"
    ],
    "role": [
      "iam",
      "soc"
    ],
    "runtime": [
      "mcp-generic",
      "claude-code"
    ],
    "auth": "api-key",
    "autonomy": null,
    "addresses": [],
    "frameworks": {
      "owasp_ast": [],
      "owasp_asi": [],
      "attack_tactic": [],
      "atlas": []
    },
    "source": {
      "repo": "https://github.com/taherkaraki/tie-mcp-server",
      "commit": "3b7f48dd4bcd53a35773a9768d357f086adb7d00",
      "version": "v0.2.1",
      "license": "MIT",
      "manifest": "package.json",
      "also_listed": {
        "tenable-cyberagents-exchange": "https://github.com/tenable/cyberagents-exchange/blob/9d0ddf1fe8dc9651a0c461a2a27d33cb8a160a2c/mcp-servers/supercharged-tenable-identity-exposure-mcp-server.md"
      }
    },
    "upstream": {
      "checked_at": "2026-10-21",
      "updated_at": "2026-07-28",
      "current_release": "v0.2.1",
      "archived": false,
      "stars": 17,
      "commit_history": {},
      "releases_since_pin": 0
    },
    "install": {
      "upstream": "{ \"command\": \"npx\", \"args\": [\"-y\", \"tie-mcp-server\"] }",
      "upstream_evidence": "README.md#L19-25",
      "bundled": false
    },
    "scan": [
      {
        "tool": "cisco-skill-scanner",
        "version": "not-run",
        "llm_judge": false,
        "date": "2026-10-21",
        "result": "pending"
      }
    ],
    "privileges": {
      "method": "reach-v0.1",
      "declared": {
        "axes": {
          "net": 1,
          "cred": 1,
          "persist": 3,
          "hitl": 1
        },
        "evidence": {
          "net": "README.md#L78 the author names the user's Identity Exposure instance URL as the only endpoint",
          "cred": "README.md#L79 the author declares one API key passed by the user",
          "persist": "API_ENDPOINTS.md#L195 the author's endpoint reference lists user creation and every endpoint becomes one tool, so creating users on the target is declared",
          "hitl": "README.md#L175 the author's example client configuration pre-approves only the read-tool name patterns"
        }
      },
      "static": {
        "level": 3,
        "axes": {
          "fs": 1,
          "net": 1,
          "exec": 1,
          "cred": 1,
          "persist": 3,
          "hitl": null
        },
        "evidence": {
          "fs": "scripts/generate-tools.mjs#L395-396 only the build-time generator writes files, inside the repository, and the server code has no file access",
          "net": "src/client.ts#L12-19 one HTTP client is bound to the configured Identity Exposure URL, and tool arguments cannot change the host",
          "exec": "package.json#L21 npm install runs the build automatically through the prepare script, and the server itself starts no processes",
          "cred": "src/config.ts#L18 reads exactly one secret, TIE_API_KEY, from a named environment variable",
          "persist": "src/generated/tools.ts#L5501-5506 create_user, together with set_user_roles and create_api_key, lets the agent create accounts, grant roles and mint API keys on the target",
          "hitl": "no evidence: the code sets no approvals, but the search patterns for approvals match several lines, so a zero cannot be written"
        },
        "unknown": [
          "hitl"
        ]
      },
      "min_config": {
        "status": "derived",
        "note": "derived from the code, not tested in the lab; set TIE_ALLOWED_SAFETY=read, use the API key of a read-only Identity Exposure profile, keep in mind that get_api_key stays available in read mode, and build from a clone at the pinned release instead of npx -y"
      },
      "override": null,
      "reviews": []
    },
    "status": {
      "tier": "listed",
      "last_checked": "2026-10-21",
      "next_check": "2027-01-19",
      "freshness": "fresh",
      "superseded": false,
      "superseded_by": null,
      "added": "2026-10-21",
      "added_by": "scout"
    },
    "evidence": {
      "runs": [],
      "badge": "/badge/taherkaraki-tie-mcp-server.svg"
    },
    "changes": []
  },
  "profile": {
    "schema_version": "0.1",
    "entry": "taherkaraki-tie-mcp-server",
    "draft": "review",
    "commit": "3b7f48dd4bcd53a35773a9768d357f086adb7d00",
    "read_on": "2026-10-25",
    "check": {
      "date": "2026-10-25",
      "facts": 50,
      "confirmed": 50,
      "verified": 47
    },
    "overview": {
      "text": "MCP server for the Tenable Identity Exposure (TIE) API. It exposes each of the 131 API operations as its own MCP tool and adds two hand-written discovery tools.",
      "ev": "README.md#L3-8 author's description and feature list"
    },
    "purpose": [
      {
        "text": "Lets Claude interact with Tenable Identity Exposure (TIE) environments.",
        "ev": "PROJECT_PLAN.md#L4 project overview"
      },
      {
        "text": "Maps every TIE API operation to its own tool so clients can allow or block single operations by tool name.",
        "ev": "src/index.ts#L6-9 header comment on the one-tool-per-endpoint design"
      },
      {
        "text": "Supports several TIE environments by adding one server instance per environment.",
        "ev": "README.md#L100-102 multiple environments setup"
      }
    ],
    "use_cases": [
      {
        "text": "Analyse attacks, deviances and checkers reported by Identity Exposure.",
        "task": "identity-attack-paths",
        "ev": "PROJECT_PLAN.md#L15-20 listed use cases"
      },
      {
        "text": "Monitor alerts, events and notifications from Identity Exposure.",
        "task": "alert-triage",
        "ev": "PROJECT_PLAN.md#L15-20 listed use cases"
      },
      {
        "text": "Update a deviance with update_deviance, as shown in a README code example.",
        "task": "identity-attack-paths",
        "ev": "README.md#L290-296 generated tool example"
      },
      {
        "text": "Produce reports from exports, dashboards and topology.",
        "task": null,
        "ev": "PROJECT_PLAN.md#L15-20 listed use cases"
      }
    ],
    "not_for": [],
    "capabilities": {
      "coverage": "partial",
      "missing": "Infrastructures, Directories, Roles, LDAP and SAML configuration, Email Notifiers, Dashboards, Widgets, License, Lockout Policy, Report Access Token, smaller groups",
      "count": {
        "n": 133,
        "unit": "tools",
        "by": "author",
        "text": "The author states 133 tools: 131 generated from the API spec and 2 custom tools.",
        "ev": "README.md#L251-253 tool total"
      },
      "groups": [
        {
          "name": "Discovery",
          "does": "Hand-written read tools such as get_topology, which returns each forest with its domains and their IDs for use in other tools.",
          "effects": [
            "reads"
          ],
          "enabled": "default",
          "ev": "src/custom-tools.ts#L54-63 get_topology definition, category Discovery"
        },
        {
          "name": "AD Objects",
          "does": "Lists, searches and fetches Active Directory objects by directory, infrastructure, checker or event, including an object's change history.",
          "effects": [
            "reads"
          ],
          "enabled": "default",
          "ev": "API_ENDPOINTS.md#L13-20 AD Objects endpoints"
        },
        {
          "name": "Alerts, API Keys",
          "does": "Gets and updates single alerts and alerts per profile; gets the API key and creates an API key.",
          "effects": [
            "reads",
            "changes"
          ],
          "enabled": "default",
          "ev": "API_ENDPOINTS.md#L22-30 Alerts and API Keys endpoints"
        },
        {
          "name": "Attack Types, Attacks (IoA)",
          "does": "Lists and exports attacks per profile, lists attack types and reads or changes attack type configuration and options.",
          "effects": [
            "reads",
            "changes"
          ],
          "enabled": "default",
          "ev": "API_ENDPOINTS.md#L36-45 Attack Types and Attacks endpoints"
        },
        {
          "name": "Checkers (IoE)",
          "does": "Lists checkers, exports checker data and reads or creates checker options per profile.",
          "effects": [
            "reads",
            "changes"
          ],
          "enabled": "default",
          "ev": "API_ENDPOINTS.md#L51-58 Checkers endpoints"
        },
        {
          "name": "Deviances (IoE)",
          "does": "Lists, searches and updates deviances per directory, checker, AD object or event, including bulk updates per checker.",
          "effects": [
            "reads",
            "changes"
          ],
          "enabled": "default",
          "ev": "API_ENDPOINTS.md#L80-89 Deviances endpoints"
        },
        {
          "name": "Events",
          "does": "Searches events and fetches single events by directory or infrastructure, with their reasons.",
          "effects": [
            "reads"
          ],
          "enabled": "default",
          "ev": "API_ENDPOINTS.md#L109-113 Events endpoints"
        },
        {
          "name": "Profiles",
          "does": "Creates, clones, updates, deletes, commits and unstages profiles and reads profile scores and topology.",
          "effects": [
            "reads",
            "changes",
            "deletes"
          ],
          "enabled": "default",
          "ev": "API_ENDPOINTS.md#L147-156 Profiles endpoints"
        },
        {
          "name": "Users",
          "does": "Lists, creates, updates and deletes users, changes passwords and replaces a user's role list.",
          "effects": [
            "reads",
            "changes",
            "deletes"
          ],
          "enabled": "default",
          "ev": "API_ENDPOINTS.md#L193-201 Users endpoints"
        },
        {
          "name": "Syslogs",
          "does": "Lists, creates, updates and deletes syslog forwarding configurations and sends test messages.",
          "effects": [
            "reads",
            "changes",
            "deletes"
          ],
          "enabled": "default",
          "ev": "API_ENDPOINTS.md#L184-191 Syslogs endpoints"
        }
      ]
    },
    "architecture": {
      "summary": {
        "text": "Tool definitions are generated from the OpenAPI spec into a single data file, and one generic dispatcher turns any descriptor plus arguments into an HTTP request.",
        "ev": "README.md#L212-214 architecture description"
      },
      "runs": {
        "where": "local-process",
        "text": "The MCP client starts it as a local subprocess and talks to it over stdio.",
        "ev": "README.md#L16-17 installation intro"
      },
      "modes": [
        {
          "where": "container",
          "mode": "Docker over stdio",
          "switch": "docker run -i --rm",
          "text": "A Docker image built from the bundled Dockerfile runs the same stdio server; the client launches it with docker run -i.",
          "ev": "Dockerfile#L33-35 run instruction and entrypoint"
        }
      ],
      "parts": [
        {
          "name": "MCP client configuration",
          "zone": "client",
          "does": "Holds the TIE credentials, which are configured on the client side and passed to the MCP server process.",
          "ev": "AUTHENTICATION.md#L8 credential flow"
        },
        {
          "name": "tie-mcp-server (src/index.ts)",
          "zone": "machine",
          "does": "Routes each tool call: custom tools go to their own handler, all others through the generic descriptor dispatcher.",
          "ev": "src/index.ts#L69-74 call routing"
        },
        {
          "name": "Generated tool descriptors",
          "zone": "machine",
          "does": "131 descriptors (name, method, path, schema) generated from the OpenAPI spec by scripts/generate-tools.mjs.",
          "ev": "README.md#L217-226 source layout"
        },
        {
          "name": "Generic dispatcher (src/dispatch.ts)",
          "zone": "machine",
          "does": "Fills path parameters, query string and body from the tool arguments and sends one HTTP request per call.",
          "ev": "src/dispatch.ts#L4-8 dispatcher description"
        },
        {
          "name": "Tenable Identity Exposure API",
          "zone": "outside",
          "does": "The TIE instance at TIE_BASE_URL, which receives every request with the API key in the x-api-key header.",
          "ev": "src/client.ts#L12-18 axios client with base URL and key header"
        },
        {
          "name": "Docker container (optional)",
          "zone": "container",
          "does": "Optional image that bundles Node.js and runs the compiled server as the unprivileged node user.",
          "ev": "Dockerfile#L26-35 runtime stage"
        }
      ],
      "listens": [],
      "connections": [
        {
          "to": "TIE instance at TIE_BASE_URL",
          "kind": "vendor-api",
          "when": "always",
          "what": "Each tool call becomes an HTTP request to the TIE instance with the API key in the x-api-key header.",
          "ev": "src/client.ts#L12-19 axios base URL and headers"
        },
        {
          "to": "npm registry",
          "kind": "download",
          "when": "default",
          "what": "With the recommended npx -y setup, npx fetches the tie-mcp-server package from npm when the client starts the server.",
          "ev": "README.md#L19-25 Option A npx config"
        }
      ],
      "model": {
        "who": "client",
        "text": "The AI client's model, for example Claude, calls the tools.",
        "ev": "AUTHENTICATION.md#L94 usage note"
      }
    },
    "needs": [
      {
        "kind": "runtime",
        "text": "Node.js 18 or later.",
        "ev": "SETUP_GUIDE.md#L7 prerequisite"
      },
      {
        "kind": "credentials",
        "text": "A TIE API key, set in TIE_API_KEY.",
        "ev": "README.md#L79 required environment variable"
      },
      {
        "kind": "account",
        "text": "A Tenable Identity Exposure instance; its URL goes into TIE_BASE_URL.",
        "ev": "README.md#L78 required environment variable"
      },
      {
        "kind": "authorization",
        "text": "The account behind the API key needs the permissions in TIE that the called operations require.",
        "ev": "SETUP_GUIDE.md#L169-173 troubleshooting authentication errors"
      },
      {
        "kind": "other",
        "text": "Each generated tool records the TIE product licence types its endpoint requires (licenseTypes).",
        "ev": "scripts/generate-tools.mjs#L338 licence types copied from the spec"
      }
    ],
    "installer": [
      {
        "text": "The recommended Option A starts the npm package tie-mcp-server through npx -y without a version pin.",
        "ev": "README.md#L19-25 Option A"
      },
      {
        "text": "Option B clones the repository and runs npm install, which also builds through the prepare script, then npm run build.",
        "ev": "README.md#L30-35 Option B from source"
      },
      {
        "text": "The Docker build runs npm install against a manifest without a lockfile, which the project gitignores.",
        "ev": "Dockerfile#L7-10 builder stage dependency install"
      }
    ],
    "limits": [
      {
        "text": "Without TIE_ALLOWED_SAFETY the server offers every tool, including write and destructive ones; a value such as read or read,write narrows the set.",
        "ev": "src/index.ts#L32-37 filterTools"
      },
      {
        "text": "The generator derives the safety tier from the tool-name prefix: get, list, search and export are read, delete and unstage are destructive, everything else is write.",
        "ev": "scripts/generate-tools.mjs#L283-288 safetyTier"
      },
      {
        "text": "get_api_key, which returns the API key of the current user, is in the read tier and stays available when TIE_ALLOWED_SAFETY is read.",
        "ev": "src/generated/tools.ts#L570-575 get_api_key descriptor"
      },
      {
        "text": "get_report_access_token, which returns the token used to pull data from Tenable Cloud, is in the read tier.",
        "ev": "src/generated/tools.ts#L4194-4198 get_report_access_token descriptor"
      },
      {
        "text": "The update_ldap_configuration body accepts url, searchUserDN and searchUserPassword, so a write-tier call can change how the TIE instance binds to LDAP.",
        "ev": "src/generated/tools.ts#L3500-3509 LDAP configuration body fields"
      },
      {
        "text": "The syslog creation body requires ip, port, protocol and tls, so a write-tier call can make the TIE instance forward events to a host given in the call.",
        "ev": "src/generated/tools.ts#L4779-4788 create_syslog required body fields"
      },
      {
        "text": "The author states that a shared, centrally hosted instance would need the HTTP/SSE transport and a listening port, and that this is not implemented.",
        "ev": "README.md#L305-311 hosting as a shared service"
      },
      {
        "text": "A troubleshooting note offers npm config set strict-ssl false, which turns off npm's certificate check, as a quick fix behind Netskope, with a warning.",
        "ev": "NETSKOPE_NPM_FIX.md#L8-13 option 1"
      },
      {
        "text": "The SAML configuration update body accepts enabled, providerLoginUrl and signatureCertificate, so a call can switch SAML sign-in to the TIE instance on and set its identity provider.",
        "ev": "src/generated/tools.ts#L4577-4586 update_saml_configuration body fields"
      },
      {
        "text": "The deviance update body (PATCH /ad-object-deviance-history/:id) takes one field, ignoreUntil, a date-time, and sets additionalProperties to false.",
        "ev": "src/generated/tools.ts#L1789-1798 update_deviance body schema"
      },
      {
        "text": "The author's session handoff notes state that the Docker image was not build-verified.",
        "ev": "SESSION_HANDOFF.md#L19 packaging status"
      }
    ],
    "not_found": [
      {
        "field": "maturity",
        "searched": "README.md, CHANGELOG.md, package.json, CURRENT_STATUS.md for preview, experimental, alpha, beta, stable, deprecated"
      },
      {
        "field": "not_for",
        "searched": "README.md, AUTHENTICATION.md, SETUP_GUIDE.md, PROJECT_PLAN.md for out-of-scope or authorised-use statements"
      },
      {
        "field": "listen",
        "searched": "src/index.ts (StdioServerTransport only), README.md, Dockerfile for host, port, bind, EXPOSE, HTTP/SSE transport"
      }
    ]
  },
  "verdict": null,
  "runs": []
}