Tenable will inspect MCP servers before you run them

An MCP server is code you install and hand a token to. Somewhere between "npm install" and "here is my production database connection string," the industry skipped the review step. Tenable just announced a service to put it back — and the fact that a vulnerability-management company thinks this is a product tells you where agent tooling sits on the risk curve.

What actually happened

At OpenAI's Intelligence at Work: Cyber Summit on September 3, Tenable unveiled the CyberAgents Exchange AI Inspector — a security review process for AI agents, skills, MCP servers, and multi-agent playbooks published to its Exchange. It runs three passes: a frontier assessment using OpenAI GPT cyber models, a skills inspection powered by Tenable One AI Exposure, and expert review from Tenable's own researchers. Availability is expected in September.

The CyberAgents Exchange itself launched in August as a cybersecurity-native registry for this class of component. Tenable says it holds more than 100 community-submitted AI components. It is vendor-neutral — the listed assets are meant to work with any stack, not only Tenable products — and every asset links to its source repository with no bundled binaries.

Eric Doerr, Tenable's Chief Product Officer, framed the bet plainly: agentic AI only lands in the enterprise if security teams can trust what gets introduced into their environments.

Why MCP server review matters for your business

Your team is already running MCP servers you have not read. That is not an accusation; it is arithmetic. The install path is a JSON block in a config file, the payoff is immediate, and the review that would have happened for a new production dependency does not happen for a thing that "just gives Claude access to Notion."

The threat model is not exotic. An MCP server sits inside the agent's trust boundary. Its tool descriptions are text the model reads and acts on, which makes the manifest itself an injection surface. It holds whatever credential you gave it, and it can usually reach whatever your laptop can reach. A registry with a real inspection pass in front of it is a genuine improvement over a GitHub README and a star count.

Do not wait for someone else's registry, though. You can run the boring version this week. Inventory every MCP server configured across your team's machines and CI — most orgs find several nobody remembers adding. For each one, answer three questions: what credential does it hold, what network can it reach, and who wrote it. Pin versions instead of tracking latest, so an upstream change cannot land on your laptop unreviewed. Prefer servers whose source you can read, and read the tool descriptions, not just the code — that is where prompt injection hides. Then give each server its own scoped credential rather than the admin key you had lying around.

Tenable is selling review because review is missing. Doing it yourself is free.

Sources: Tenable press release, CyberAgents Exchange.