Can AI agents automate Rapid7 Command Platform?

Rapid7 Command Platform vulnerability and asset data is automatable today through the Bulk Export API. This record is that export surface and the Rapid7 MCP server that loads it. It is not Tenable, and it does not cover every Insight module. The API is GraphQL. Calls send the platform API key in the X-Api-Key header. The key must be an Organization key or a user key with Platform Administrator permissions. Regional endpoints include https://us.api.insight.rapid7.com/export/graphql, https://eu.api.insight.rapid7.com/export/graphql, and hosts for Canada, Australia, Japan, and additional United States regions. Mutations create policy, vulnerability, and remediation exports. Results are Parquet files. Download URLs last 15 minutes and can be regenerated for 30 days. Files are retained for 30 days. Data refreshes once a day, and overuse can be throttled. A remediation export date range must be after August 2025, must not be a single day, and must be at most 31 days. Rapid7 publishes github.com/rapid7/rapid7-bulk-export-mcp, which loads those exports into a local DuckDB database for agent queries. The README says support is best effort. A language SDK, a CLI, and connector catalogs were not opened. https://www.rapid7.com/llms.txt is a plain-text index of the marketing site. Computer-use viability is unassessed. The Bulk Export API scores 6 and is the best path. The MCP server scores 4.

Best path today: api · Overall automatability: 6/10