Tenable One Hexa AI MCP and cloud API

Tenable One is automatable today through the Tenable-hosted Hexa AI MCP server and the cloud.tenable.com APIs that Tenable says include Tenable One. The MCP endpoint is https://cloud.tenable.com/mcp/. Tenable says it exposes 90 tools from the Exposure Data Fabric and that Tenable hosts the server without hosting the model. Use requires a Tenable One Foundation or Advanced license, the Hexa AI MCP toggle, and Vulnerability Management API keys in the X-ApiKeys header. Example workflows search assets, create tickets, tag assets, build dashboards, and launch scans, and write steps are presented for confirmation. The feature is not supported in Tenable FedRAMP Moderate environments. The API basics page says the cloud.tenable.com guidance covers Tenable One, Vulnerability Management, Web App Scanning, and Exposure Management, and does not cover Security Center, Cloud Exposure, Attack Surface Management, or OT Exposure. Requests use X-ApiKeys with an access key and a secret key. This pass did not inventory every API resource, and it did not open an SDK, CLI, or webhook contract. Connector catalogs were not opened. Computer-use viability is unassessed. MCP scores 7 and is the best path because the tool workflows are documented specifically. The API scores 6 because the shared cloud API is real and partial across the Tenable One domains.

Best path today: mcp · Overall automatability: 7/10