nessus-mcp-server - MCP server for Tenable Nessus vulnerability scanni
项目说明
Nessus MCP Server
A Model Context Protocol (MCP) server for interacting with the Tenable Nessus scanner. This ser AI assistants to perform scanning and analysis through the MCP protocol.
It talks to a real Nessus instance over its REST API using API-key authentication. If no NESSUS_URL/NESSUS_ACCESS_KEY/NESSUS_SECRET_KEY are set, it falls back to a self-contained mock mode for local de and testing.
Features
Tools
The ser the following tools:
| Tool Name | Description |
| --------------------------- | ------------------------------------------------------- |
| list_scan_templates | List a Nessus scan templates |
| start_scan | Start a new scan against a target |
| get_scan_status | Check the status of a running scan |
| get_scan_results | Get the results of a completed scan |
| list_scans | List all scans and their status |
| get_ | Get detailed information about a specific |
| search_ | Search for by keyword |
Installation
Prerequisites
Building from Source
1. Clone the repository:
2. Install dependencies:
3. Build the server:
Usage
Running in Mock Mode
By default, the server runs in mock mode, which doesn't require a Nessus API key:
Running with a real Nessus instance
To connect to a real Nessus instance, set the following en :
The server is switched into real mode as soon as all three of these are set; otherwise it runs in mock mode.
Then run the server:
#### Generating an API key pair
In the Nessus web UI: Settings > My Account > API Keys > Generate. Nessus shows the access key and secret key only once at generation time, so store them somewhere safe (e.g. a secrets manager or your MCP client's en) - Nessus itself cannot show them to you again.
Requests authenticate with the X-ApiKeys: accessKey=<key>; secretKey=<key> HTTP header on every call. There is no separate login/session step, and no cookie or token to refresh.
#### Self-signed certificates
Nessus is very commonly deployed with a self-signed TLS certificate. By default this ser certificates strictly and will fail closed against a self-signed instance. To explicitly opt in to skipping certificate (e.g. for an internal instance you trust), set:
Leave this unset (or false) whenever the instance has a certificate issued by a trusted CA. The server logs a warning to stderr on startup whenever this is enabled.
#### Design notes on the real-mode mapping
A few of this server's tools have no exact 1:1 equi in the Nessus REST API, so the following judgment calls were made:
start_scan: scan_type (basic-network-scan / web-app-scan / compliance-scan) is a logical name, not a Nessus template UUID (those are instance-specific and returned by GET /editor/scan/templates). This ser the logical name to a template by matching known template name first, falling back to a fuzzy match against the template name/title. start_scan then creates the scan (POST /scans) and immediately launches it (POST /scans/{id}/launch), since the tool is named "start", not "create".get_scan_results: real scan results are aggregated per-plugin across the whole scan (from GET /scans/{id}'s get_ with a specific plugin_id from the results to drill into full detail for one finding.get_: in mock mode this takes a CVE id. Against a real Nessus instance it must be a numeric Nessus plugin ID instead (e.g. 156327), because the on-prem Nessus REST API has no endpoint that resolves an arbitrary CVE or keyword to a plugin - only GET /plugins/plugin/{id} (lookup by numeric plugin ID) exists. A C input in real mode returns a clear, documented error rather than silently failing.search_: Nessus has no single "search all " endpoint - findings only exist in the context of a scan's results. In real mode this tool accepts an optional scan_id to scope the search to one scan; without it, the search covers the most recently updated completed scans (capped at 10, to bound the number of API calls on instances with many scans). This is a deliberate scoping decision, documented on the tool description itself.Using with Claude for Desktop
To use this server with Claude for Desktop:
1. Edit your Claude for Desktop configuration file:
- macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
- Windows: %APPDATA%\Claude\claude_desktop_config.json
2. Add the ser:
For mock mode, you can omit the env section.
Example Interactions
Starting a Scan
Getting Scan Results
Searching for
Against a real Nessus instance, optionally scope the search to one scan:
De
Project Structure
src/index.ts: Main ser pointsrc/nessus-api.ts: Nessus API client with mock fallbacksrc/mock-data.ts: Mock data for testingsrc/tools/: Tool implementationssrc/utils/: Utility functionsAdding New Tools
1. Define the tool schema and handler in the appropriate file in src/tools/
2. Import and register the tool in src/index.ts
status
Real-mode requests are implemented directly against the documented Tenable Nessus REST API contract (endpoints, request bodies, and response shapes). They have been by:
npm run build).NESSUS_URL (e.g. isError response with a descripti (connection refused, TLS, timeout, etc.) instead of crashing or silently falling back to mock data.They have not been against a li instance, since none was a in the en this was built in. If you connect this to a real instance and something doesn't match (e.g. a template name your instance doesn't have, or a response field that differs by Nessus ), please open an issue.
License
MIT
Disclaimer
This server is not affiliated with or endorsed by Tenable. Nessus is a trademark of Tenable, Inc.
项目信息
开发语言：TypeScript
Star 数：16
技术要点
该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕MCP server for Tenable Nessus vulnerability scanning.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包，解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证，避免影响生产系统。
免责声明
本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。
| 资源标题 | nessus-mcp-server - MCP server for Tenable Nessus vulnerability scanni |
| 所属分类 | 安全软件 |
| 发布作者 | admin |
| 发布时间 | 2026-10-05 22:56:57 |
| 下载权限 | 免费下载 |
| 附件数量 | 2 个下载链接 |
| 浏览次数 | 327 |
| 讨论数量 | 0 |
| 主题状态 | 正常讨论中 |