Tenable publishes 107 APIs on the network with a composite of 58.2 — strong — and an agent-readiness score of 59.2 (agent-ready). Its agentic-access contract enumerates 553 operations, 272 acting, 29 human-in-the-loop.
Agent readiness above composite is an unusual shape, and it is the reason to look closely.
Eight documents, 107 entries
Tenable’s developer platform exposes eight OpenAPI 3 REST APIs on cloud.tenable.com: Vulnerability Management, Web App Scanning, Exposure Management, Platform & Settings, PCI ASV, MSSP, Identity Exposure, and Downloads. All authenticate with X-ApiKeys access and secret keys. There is an official pyTenable SDK and a Tenable-hosted Hexa AI MCP server.
Those eight documents become 107 catalog entries once split by resource — About, Access Control across API, Groups, Permissions, Roles and Users, Access Groups v1 and v2, Account Groups, Accounts, Activity Log, AD Object, Agent Config, Agent Exclusions, Agent Groups, Agent Tasks, Agents, Alerts, API Keys, Applications, Asset Attributes, Assets, and 86 more.
Publishing eight coherent documents and letting the catalog do the decomposition is a better posture than publishing 107 hand-maintained fragments. The consistency you get for free is real, and it shows up in the score.
The facet spread
| Facet | Score |
|---|---|
| Discoverability | 83.3 |
| Developer ergonomics | 69.0 |
| Contract quality | 61.5 |
| Commercial clarity | 60.5 |
| Operational transparency | 55.3 |
| Governance | 11.5 |
Governance at 11.5, at a security company. That is the finding.
Tenable’s product is telling other organisations where their controls are weak. Its own published evidence of how it governs its API estate — style rules, review process, a machine-readable ruleset, versioning policy across eight documents and 553 operations — is nearly absent.
I do not read that as hypocrisy; the eight documents are visibly consistent with each other, so the practice exists. I read it as the standard failure of internal-facing discipline: the rules live in a wiki and a code review culture, and nothing publishes them. For a vendor whose customers are auditors and security teams, that is a strange thing to leave unstated.
Why agent readiness leads
59.2 agent readiness against a 58.2 composite is rare. Most providers score notably lower on the agent layer, because it grades specific things — verified idempotency, error semantics in the contract, a rate-limit signal, auth clarity — that good documentation does not automatically supply.
Tenable clears them largely because of the two assets in its description: a first-party MCP server and a maintained SDK. Those are commitments, not conveniences. An MCP server the vendor hosts is a vendor taking a position on how agents should reach it, and the score grades first-party authorship differently from a server derived on a provider’s behalf.
Takeaway
107 entries from eight well-formed documents, a first-party MCP server, agent readiness edging out composite — and governance at 11.5 on a company that sells governance findings. The practice is clearly there; nothing about it is published, and that is the cheapest twenty points on this profile.
See the full profile at apis.io/providers/tenable/.