Skip to main content
Activation required. AI access management must be enabled for your tenant before you can use it. To get started, contact the C1 support team for a walkthrough.
The Rapid7 MCP server lets you govern access to Rapid7 InsightVM — assets, vulnerabilities, scans, sites, and reports exposed by the InsightVM Security Console API — as tools your AI clients can call through C1. Rapid7 InsightVM authenticates with a console username and password using HTTP basic auth. A single account authenticates every user, so all tool calls reach InsightVM as one shared identity.

​
How C1 connects to Rapid7

C1 hosts the Rapid7 MCP server, so your users’ AI clients only ever see MCP tools — they never call Rapid7 directly. When an AI client calls one of these tools, C1 makes the matching request to the Rapid7 InsightVM API using the credentials you configure here, then returns the result to the AI client. The credentials you set up below are what C1 uses to call Rapid7 on your users’ behalf.

​
Before you begin

  • AI access management must be enabled for your tenant. See Enable AI access management.
  • An InsightVM Security Console account with the permissions needed to read the assets and vulnerability data you want to govern, and network access to the console’s API port (3780 by default).
If you don’t see Rapid7 in your MCP server catalog, contact the C1 support team to enable it for your tenant.

​
Create a Rapid7 InsightVM API account

The InsightVM API uses Security Console credentials. Create a dedicated console user for C1 so the credential is recognizable and easy to rotate. For more information, see Rapid7’s Managing users and authentication documentation.
1
In the InsightVM Security Console, go to Administration > Users and create a new user with a recognizable name such as C1.
2
Grant the user only the roles and asset-group access needed to read the data you want to govern, such as read access to sites, assets, and vulnerabilities.
3
Note the user’s username and password, and confirm the console host and API port (3780 by default) that C1 will connect to.
For a shared production setup, use a dedicated service account so activity is attributable to C1 rather than a person.

​
How Rapid7 credentials are shared

The console account authenticates every user as one shared InsightVM identity, so InsightVM sees a single identity for all tool calls. C1 still attributes each call to the individual user in the AI tool usage audit log. For a shared setup, create the credential from a dedicated service account so activity is attributable to C1 rather than a person. For how shared and per-user credentials work across MCP servers, see Configure authentication.

​
Register the Rapid7 MCP server in C1

With your console account ready, register the server and provide your credentials.
1
Follow Register an MCP server and select Rapid7 from the catalog.
2
Enter your InsightVM Security Console host (such as nexpose.example.com) and port (such as 3780).
3
When you configure authentication, choose Basic auth and enter the console username and password.
4
Save your changes. C1 starts a sync that discovers the tools the Rapid7 server exposes.

​
Discover and govern tools

After you register the server, C1 runs tool discovery against Rapid7. Discovered tools appear on the server’s Tools tab. Each tool starts as either Pending review or automatically Approved, depending on the option chosen when the server was set up or your tenant’s default tool settings in Settings > AI Connections. See Require tool approval and Default tool classification. Before anyone can call a Rapid7 tool, it must be approved, added to a toolset, and bound to an access profile. Continue to Govern tools and toolsets to set this up.
Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn’t confirm that authentication is working. You confirm your Rapid7 credentials when an approved user successfully calls a Rapid7 tool from their AI client.

​
Manage your Rapid7 credentials

  • Rotate the password on the InsightVM console user, then update the password on the server’s authentication settings in C1.
  • Adjust access by editing the roles and asset-group access granted to the console user in InsightVM.