Qualys MCP server

<!-- mcp-name: io.github.rijul170/qualys-mcp -->

Qualys MCP

A Model Context Protocol server for full Qualys portal management — expose VMDR, Policy Compliance, WAS, Cloud Agent, Container Security, TotalCloud, Patch Management, CSAM/GAV, EASM and administration to any MCP‑capable client (Claude, and other MCP hosts).

One process per Qualys console (run as many as you have subscriptions). Built on FastMCP, with a single client that speaks all three Qualys API families, a strict read / write / destructive safety model, and credentials that never touch chat or plaintext.

Highlights

portal: VMDR, PC, WAS, Cloud Agent, Container Security, TotalCloud/CloudView, Patch Management, CSAM/GAV, EASM, FIM, EDR, PCRS, and administration.

• Broad coverage — 59 auto‑discovered feature modules spanning the whole

searchwasfindings, listknowledgebase, getcsimagevulnerabilities, and hundreds more, each mapped 1:1 to a documented Qualys API operation.

• ~400 tools — listhosts, listhostdetections, launchscan,

API, and the JWT‑authenticated Gateway are all handled behind self.fo / self.qps / self._gateway.

• Three API regimes, one client — the classic "FO" XML API, the QPS REST

or destructive. Destructive tools (delete / purge / deactivate) are not even registered unless you opt in per console, and still require a per‑call confirmation token.

• Safety tiers are load‑bearing — every tool is annotated read‑only, write,

fully offline with no credentials.

• Lazy auth — no network calls at import or construction; --check runs

blobs; on any OS you can supply them via environment variables. Nothing is ever written to the repo.

• Secrets stay secret — on Windows, credentials live only in DPAPI‑encrypted

The three API regimes

Architecture

qualys_mcp/
  server.py     FastMCP server; lazy auth; --check offline validation
  registry.py   auto-discovers modules/*.py
  client.py     one client, three API regimes (FO / QPS / Gateway-JWT)
  config.py     per-console config + platform (POD) -> URL map
  common/       auth (HTTP mw), errors, logging, rate_limit, utils, xml
  modules/      base.py + one file per feature module (the bulk of the surface)

Adding a capability is just dropping a file in qualysmcp/modules/ — see docs/MODULEBUILD_GUIDE.md.

Quick start

1. Install

python -m venv .venv
# Windows:      .\.venv\Scripts\pip install -e .
# macOS/Linux:  ./.venv/bin/pip install -e .

2. Offline sanity check (no credentials required)

python -m qualys_mcp --check

Lists every discovered module with its tool count and exits — a good first smoke test.

3. Provide credentials

You need a Qualys API user and your platform/POD code (e.g. US1, US2, EU1; find it under your console URL or Help → About).

Any OS — environment variables:

Shortened. The full README is on GitHub.