Rapid7 Bulk Export MCP

AI-powered analysis for Rapid7 Command Platform data using MCP (Model Context Protocol) & AgentSkills.

This tool is a best effort support, due to the bespoke and ever-changing nature of tools and workflows which would utilize this tool we cannot provide support or guidance outside of the MCP Code & AgentSkill Content.

What is This?

This tool exports data from Rapid7 Command Platform, via the Rapid7 Bulk Export API and makes it queryable in GenAI and Agentic workflows.

• MCP Server: Embeds tools which allow the getting, processing and querying of data
• Agent Skill / Kiro Power: Gives additional context, schema knowledge and instructions on how to use the MCP tools
• DuckDB Database: Local file-based database to allow structured rapid querying

Features

• AI-Powered Analysis: Use with Kiro, Claude Desktop, or any MCP-compatible AI assistant
• On-Demand Data Loading: Automatically fetch and load data from Rapid7
• Export Reuse: Automatically reuses exports from the same day to avoid redundant API calls
• Natural Language Queries: Ask questions in plain English
• SQL Query Execution: Run complex SQL queries against vulnerability, asset and other data
• Multiple Export Types: Vulnerabilities (with vulnerability exceptions), policies, remediations, and installed asset software
• Multi-Month Remediation: Request any date range — it is split into ≤31-day windows and loaded for you in the background as a single job
• Schema Exploration: Discover available data fields
• Statistics & Insights: Get instant summaries and distributions
• Security Lockdown: User queries are sandboxed — filesystem and network access disabled at the DuckDB engine level
• Docker Support: Run as a containerized HTTP service for remote or shared deployments

Local vs Remote

You can run the MCP server in two modes depending on your setup:

Local (stdio) — The AI client spawns the server as a child process and communicates over stdin/stdout. This is the default and simplest option. The server runs on your machine, the database lives next to it, and everything stays local. Best for individual use on a workstation or laptop.

Remote (Docker / streamable HTTP) — The server runs as a containerized HTTP service exposing a single /mcp endpoint. Clients connect over the network via URL. Best for shared environments, team use, or when you want the server running on dedicated infrastructure separate from your AI tool. It should be noted that this will make data shareable between all users of the remote mcp, you should authenticate and secure the /mcp endpoint.

Both modes use the same MCP tools and security controls. The only difference is how the client connects.

Quick Start

0. Get Your Rapid7 API Key and Region

Before you begin, you’ll need credentials from your Rapid7 Insight Platform account.

Generate an API Key:

Important: The API key must be generated by a Platform Admin. The bulk export API returns all vulnerability data across the entire platform, so admin-level access is required.

1. Log in to the Rapid7 Insight Platform as a Platform Admin
2. Navigate to Administration → API Key Management
3. Choose the key type:
   • Organization Key (recommended): Full admin permissions (requires Platform Admin role)
   • User Key: Inherits your account permissions — must be created by a Platform Admin to have sufficient access for bulk exports
4. Click “Generate New Admin Key” (or “Generate New User Key” if using a Platform Admin account)
5. Select your organization and provide a name for the key
6. Copy the key immediately - you won’t be able to view it again!

Find Your Region:

Your region determines which API endpoint to use. To find your region:

1. Go to insight.rapid7.com and sign in
2. Look for the “Data Storage Region” tag in the upper right corner below your account name

For more details, see:

• Managing Platform API Keys
• Product APIs and Regions

1. Set Up Your AI Tool

Choose your AI tool below. Each guide walks through installing the MCP server, adding the Agent Skill, and verifying the connection.

Securing your API key: Avoid storing your RAPID7_API_KEY in plaintext on disk. Use a secrets manager to inject the key at runtime — for example, 1Password CLI, Bitwarden CLI, macOS Keychain, Windows Credential Manager, or PowerShell SecretManagement. With 1Password you can set "command": "op" and "args": ["run", "--", "rapid7-mcp-server"] with op:// secret references in the env block — the key is resolved from your vault and never written to config files. Adapt this pattern to whatever password manager you use.

2. Start Analyzing

Note: The first export takes 1-5 minutes depending on org size. Once complete, the data is cached and subsequent loads reuse the same export. You can always ask to refresh the data to get the latest set.

Show me the top 10 critical vulnerabilities with known exploits

What's the severity distribution across my cloud assets?

Tool Reference

start_rapid7_export

Kicks off a new export job on Rapid7’s servers. Returns immediately. Supports four export types: vulnerability, policy, remediation, and asset_software.

For remediation, pass a start_date and end_date (YYYY-MM-DD). Rapid7 limits each remediation export to 31 days and allows only one in flight at a time, so a longer range is split into ≤31-day windows and processed sequentially in the background as a single job. The call returns a job ID you poll with check_rapid7_export_status; all windows append into one vulnerability_remediation table.

Start a vulnerability export from Rapid7
Load remediation data from 2026-01-01 to 2026-06-30

check_rapid7_export_status

Reports status once, without blocking. Depending on what the ID names, it returns the Rapid7 platform-side export status, the local download/load progress once you have started loading, or the progress of a multi-window remediation job (which window is loading, and which windows are done). Accepts either an export ID or a remediation job ID.

Check the status of export abc-123

download_rapid7_export

Starts downloading a completed export’s Parquet files and loading them into the local DuckDB database in the background, returning immediately — large exports can take longer than an AI client will wait on a single call. Poll check_rapid7_export_status with the same export ID until it reports the load is complete; that is when the data becomes queryable.

Download and load export abc-123

load_rapid7_parquet

Loads existing Parquet files directly from disk (must be within ~/.rapid7_mcp/imports/). Useful if you already have exported files and want to skip the API call.

Load parquet files from ~/.rapid7_mcp/imports/my-export/

query_rapid7

Executes SQL against the loaded data. The connection is locked down after loading — filesystem reads, writes, and network access are all blocked at the DuckDB engine level.

Available tables (depending on what you have loaded): assets, vulnerabilities, vulnerability_exceptions, policies, vulnerability_remediation, asset_software.

Run: SELECT severity, COUNT(*) FROM vulnerabilities GROUP BY severity

get_rapid7_schema

Returns column names and data types for all loaded tables. Use this to understand what fields are available before writing queries.

Show me the schema of the loaded data

get_rapid7_stats

Returns summary statistics — row counts, severity distributions, CVSS score ranges, exploit counts, and cloud provider breakdowns.

Give me an overview of the vulnerability data

list_rapid7_exports

Shows recent export history with IDs, dates, statuses, and row counts. Useful for finding a previous export to reload.

List my recent exports

purge_rapid7_data

Permanently deletes both the vulnerability database and the export tracking database from disk. Use when you’re done with analysis or before handing off a machine.

Purge all local Rapid7 data

Architecture

graph TB
    subgraph "AI Layer"
        LLM[LLM/AI AssistantCopilot, Kiro, Claude Desktop, etc.]
    end

    subgraph "Rapid7 Bulk Export MCP Tool"
        MCP[MCP Serverrapid7-bulk-export]
        Skill[Agent Skill / Powerrapid7-bulk-export-skill]
    end

    subgraph "Data Layer"
        DB[(DuckDBrapid7_bulk_export.db)]
        Tracker[(Export Trackerrapid7_bulk_export_tracking.db)]
    end

    subgraph "Rapid7 API"
        R7[Rapid7 Bulk Export API/export/graphql ]
    end

    LLM |Model Context Protocol| MCP
    LLM -.->|Enhanced Context| Skill
    MCP -->|SQL Queries| DB
    MCP -->|Track Exports| Tracker
    MCP -->|Fetch Data| R7
    R7 -->|Parquet Files| MCP
    MCP -->|Load Data| DB

    style LLM fill:#e1f5ff
    style MCP fill:#fff4e1
    style Skill fill:#f0e1ff
    style DB fill:#e8f5e9
    style Tracker fill:#e8f5e9
    style R7 fill:#ffe1e1

Development

Changes to the AgentSkill and MCP can be done locally to allow you to tailor to your environment — contributions are welcome back to this repository.

Clone and Install

git clone https://github.com/rapid7/rapid7-bulk-export-mcp.git
cd rapid7-bulk-export-mcp
uv sync

Configure for Development

Create or edit .kiro/settings/mcp.json:

{
  "mcpServers": {
    "rapid7-bulk-export": {
      "command": "/absolute/path/to/rapid7-bulk-export-mcp/.venv/bin/rapid7-mcp-server",
      "args": [],
      "env": {
        "RAPID7_API_KEY": "your-api-key-here",
        "RAPID7_REGION": "your-region",
        "DATA_DIR": "/Users/you/.rapid7-mcp"
      }
    }
  }
}

Note: Point command directly at the venv entry point rather than using uv run with a cwd. Claude Desktop does not guarantee a working directory when launching MCP servers, so uv run may resolve to a cached or system-installed version of the package instead of your local source.

Run Tests

uv run pytest

Environment Variables