Qualys MCP Server

Standalone MCP server for Qualys vulnerability management and compliance platform.

Installation

npm install -g qualys-mcp-server

Configuration

| Variable | Required | Description | Default | |---|---|---|---| | QUALYS_MCP_USERNAME | Yes | Qualys platform username | — | | QUALYS_MCP_PASSWORD | Yes | Qualys platform password | — | | QUALYS_MCP_POD | Yes | Platform POD (US1-4, EU1-3, IN1, CA1, AE1, UK1, AU1, KSA1) | — | | QUALYS_MCP_BASE_URL | No | Override auto-derived API URL | (from POD) | | QUALYS_MCP_GATEWAY_URL | No | Override auto-derived gateway URL | (from POD) | | QUALYS_MCP_SSL_VERIFY | No | TLS verification | true | | QUALYS_MCP_TIMEOUT_MS | No | Request timeout | 60000 | | QUALYS_MCP_CACHE_TTL_MS | No | Cache TTL | 300000 |

Client Configurations

VS Code (settings.json)

{
  "mcp": {
    "servers": {
      "qualys": {
        "command": "npx",
        "args": ["-y", "qualys-mcp-server"],
        "env": {
          "QUALYS_MCP_USERNAME": "your-username",
          "QUALYS_MCP_PASSWORD": "your-password",
          "QUALYS_MCP_POD": "US1"
        }
      }
    }
  }
}

Claude Desktop

{
  "mcpServers": {
    "qualys": {
      "command": "npx",
      "args": ["-y", "qualys-mcp-server"],
      "env": {
        "QUALYS_MCP_USERNAME": "your-username",
        "QUALYS_MCP_PASSWORD": "your-password",
        "QUALYS_MCP_POD": "US1"
      }
    }
  }
}

Tools

qualys_investigate

Deep-dive any CVE, threat actor, hostname, IP, or free-text topic across Qualys modules.

Parameters:

• target (string, required) — CVE ID, hostname, IP, or search term
• depth (enum: quick/standard/deep) — Investigation depth
• scope (enum: all/vulns/threats/assets/edr/fim) — Module scope

qualys_assess_risk

Cross-domain risk assessment across VMs, cloud, web apps, certificates, and assets.

Parameters:

• scope (enum: all/cloud/containers/web/certs/assets) — Risk domain
• tag (string) — Filter by asset tag
• provider (enum: aws/azure/gcp) — Cloud provider filter
• assetId (string) — Single asset deep-dive

qualys_check_compliance

Compliance posture checking for regulatory frameworks.

Parameters:

• framework (enum: PCI/HIPAA/CIS/NIST/SOC2) — Framework to check
• includeExceptions (boolean) — Include exception details

qualys_plan_remediation

Patch priorities, deployment status, and mitigation coverage.

Parameters:

• scope (enum: all/patches/mitigations/program) — Remediation scope
• severity (enum: critical/high/moderate) — Severity filter
• cves (string[]) — Specific CVEs to check
• qids (number[]) — Qualys QIDs to check

qualys_security_overview

Daily/weekly/monthly security briefing.

Parameters:

• period (enum: today/week/month) — Time period
• quick (boolean) — Fast snapshot vs full briefing

qualys_reports

Report management.

Parameters:

• action (enum: list/generate/download/status) — Action
• reportId (string) — Report ID
• reportType (string) — Report type for generation
• format (enum: pdf/csv/xml) — Output format

qualys_cache_status

View or clear the API response cache.

Parameters:

• action (enum: view/clear) — Cache action
• module (string) — Module cache to clear

Supported PODs

US1, US2, US3, US4, EU1, EU2, EU3, IN1, CA1, AE1, UK1, AU1, KSA1

License

MIT