runZero MCP

Pivot from a single CVE to its blast radius: every locally-synced asset with a matching vulnerability finding, joined to that asset's services and criticality. Matching is a case-insensitive substring, so 'CVE-2024-3094' and '2024-3094' both work. Reads the local store; run 'inventory sync' first.

Analyze locally synced data with count, group-by, and summary operations. Data must be synced first with the sync command.

Use this command for certs expiring soon or using weak crypto, with their asset/service context. Do NOT use it for raw certificate rows or full-text cert search; use 'inventory list certificates' instead. Filters the locally-synced certificates by expiry window (already expired or expiring within --days) and joins each to the presenting asset, ordered by asset criticality and soonest expiry. --weak restricts to certificates that are self-signed or carry an MD5/SHA-1 signature (detected from the stored certificate data when present). Reads the local store; run 'inventory sync' first.

Get API domain context: resource taxonomy, auth requirements, query tips, and unique capabilities. Call this first.

Compare two local sync snapshots and report what changed on your attack surface: assets, services/ports, and software that appeared or disappeared. By default it compares the two most recent syncs; --since picks the baseline as the most recent sync at or before now minus the given window (e.g. 7d, 24h, 2w). Run 'inventory sync' at least twice for diff to have two snapshots to compare.

Export paginated API data to a local file. Supports JSONL (one JSON object per line, streaming-friendly) and JSON (array). JSONL is recommended for large datasets as it has no memory pressure.

Use this command for what newly became exposed or vulnerable since the last sync, ranked by criticality. Do NOT use it for the whole-surface appeared/disappeared inventory delta; use 'diff' instead. Do NOT use it for a point-in-time exposure ranking; use 'triage' instead. Joins the two most recent local sync snapshots to isolate the security-relevant change: services that first appeared after the baseline and vulnerabilities first detected after the baseline, each joined to its asset and ordered by asset criticality. --since picks the baseline as the most recent sync at or before now minus the given window (e.g. 7d, 24h, 2w). Run 'inventory sync' at least twice for exposure-delta to have a baseline.

Roll up exposed services across an address range: for the given CIDR, group the locally-synced services by transport/port/protocol and count how many assets in that range expose each. Surfaces which subnets concentrate risky exposed services before a scan or segmentation change. Reads the local store; run 'inventory sync' first.

Import data from a JSONL file by issuing POST requests for each record. Each line must be a valid JSON object. Failed records are logged to stderr but do not stop the import.

Manage the local SQLite copy of your runZero attack surface that powers the offline analysis commands (triage, diff, affected, software rollup, stale, exposure-map, exposure-delta, certs-expiring). runZero's HTTP API is organized by scope (/org, /account, /export), so a single live query cannot join assets to their services, software, and vulnerabilities. 'inventory sync' pulls the per-entity Export endpoints (/export/org/<entity>.json) into local tables once; the offline analysis commands then answer cross-entity questions with zero additional API quota.

List the locally-synced rows for one entity, newest sync first. Returns the original runZero JSON for each row, so --select with dotted paths narrows deeply nested records. Reads the local store; run 'inventory sync' first.

Show local store row counts per entity and the last sync time

Pull runZero's per-entity Export data into the local SQLite store so the offline analysis commands can run offline. Each run is recorded as a snapshot, so running sync twice lets 'diff' show what changed on the attack surface. Requires a runZero API token (RUNZERO_API_KEY). The token's scope must include export access (Export ET, Organization OT, or Account CT key).

Execute one runzero API endpoint by its endpoint_id (from runzero_search). Params are passed as a JSON object; path placeholders and query strings are resolved automatically.

Search the runzero API for endpoints matching a natural-language query. Returns a ranked list of {endpoint_id, method, path, summary} entries. Call this first to find the endpoint to execute.

Use this command to start a scan on a site and block until it finishes. Do NOT use it to merely enqueue without watching; use 'org create-scan' instead. Do NOT use it to inspect an already-running task; use 'org get-task' / 'org get-task-log' instead. Issues PUT /org/sites/{site_id}/scan with the given targets, then polls the created task until it reaches a terminal state (processed, stopped, canceled, failed, or error), streaming each status change to stderr. Exits 0 when the scan is processed; a failed, canceled, or error task returns a non-zero exit. Requires an Organization (OT) or Account (CT) API token with scan permission.

Full-text search across all synced data. Faster than paginating list endpoints. Requires sync first.

software subcommands: rollup

Group the locally-synced software inventory by product and version with a distinct-asset count, most-deployed first — the rollup the live API never returns. Pass a name to filter to a product or vendor (case-insensitive substring); omit it to roll up everything. Reads the local store; run 'inventory sync' first.

Run read-only SQL against local database. Use for ad-hoc analysis, aggregations, and joins across synced resources. Requires sync first.

List assets that need hygiene attention: not seen in the last N days, running an end-of-life OS, or missing tags/owners. Each row carries the reasons it was flagged plus its age in days, oldest first. Emit IDs with '--json --select asset_id' and pipe them into the bulk asset commands to retag or retire. Reads the local store; run 'inventory sync' first.

Sync data from the API into a local SQLite database. Supports resumable incremental sync (only fetches new data since last sync) and full resync. Once synced, use the 'search' command for instant full-text search. Exit codes & warnings: Resources the API denies access to (HTTP 403, or HTTP 400 with an access-policy body) are reported as warnings rather than failing the run. In --json mode each is emitted as a {"event":"sync_warning",...} line carrying status, reason, and message fields, and a final {"event":"sync_summary",...} aggregates the run. Exit 0 when at least one resource synced and no resource flagged in the spec as critical (x-critical: true) failed; non-critical failures emit {"event":"sync_warning","reason":"exit_policy_default_changed", ...} so callers can detect that a partial failure was tolerated. Pass --strict to exit non-zero on any per-resource failure. Exit is always non-zero when every selected resource failed, regardless of --strict. Resource scoping: --resources runs the named top-level resources, plus any parent-keyed dependent whose own name is listed OR whose parent table is listed. Naming a parent therefore cascades to its dependents (so "sync this parent and its children" works without listing every nested resource by hand). There is no flag today to suppress the cascade for a named parent. To run a dependent without re-syncing its parent, list only the dependent by name; the parent table must already be populated from a prior sync.

Tail streams live data changes by polling the API at configurable intervals. Events are emitted as NDJSON to stdout for piping to other tools. Gracefully shuts down on SIGTERM/SIGINT. Note: For APIs with WebSocket or SSE support, a future version will use native streaming instead of polling.

Rank locally-synced assets by criticality, then by their highest vulnerability severity, then by vulnerability count. Joins assets, services, and vulnerabilities in one pass — something the live runZero API cannot return in a single call. Reads the local store; run 'inventory sync' first.

Compound workflows that combine multiple API operations

Archive fetches all syncable resources from the API and stores them in a local SQLite database. Supports incremental sync (only new data since last run) and full resync. After archiving, use 'search' for instant full-text search.

Show local archive status and sync state for all resources