Tenable launches a security inspector for community agents and MCP servers

Tenable unveiled the CyberAgents Exchange AI Inspector on September 3 at OpenAI's Cyber Summit — a security review process for community-built agents, skills, MCP servers, and multi-agent playbooks, before a company adopts them in production.

The problem it solves: adopting AI components of unknown origin

CyberAgents Exchange, launched in August 2026, is an open-source, cybersecurity-native registry for AI agents, skills, MCP servers, and multi-agent playbooks. Following its SWARM event at Black Hat USA, the registry has already accumulated more than 100 community-submitted components. The problem is the same one that exists with any open-source package — npm, PyPI, or in this case MCP servers — installing it without review means accepting the risk of whatever that component does with the permissions you grant it.

How the Inspector works

Exchange Inspector combines three layers: frontier evaluation using OpenAI's GPT cyber models, skills inspection powered by Tenable One AI Exposure, and expert review by Tenable's human researchers. It's not just an automated scan — it combines AI for scale of analysis with human review for cases where expert judgment matters more than pattern detection.

Availability

Exchange Inspector is expected to be available in September 2026. Tenable said the tool helps security teams safely accelerate enterprise adoption of agentic AI — the explicit goal isn't to slow adoption down, but to give security teams a way to approve third-party components without having to manually audit each one from scratch.

What this means for your company if you build or consume MCP servers

If your company already exposes internal services via MCP (or is evaluating doing so, as we discussed with the Sonos case a few days ago), it's worth monitoring this type of third-party security-reviewed registry — they're becoming the de facto standard for deciding which community AI components are safe to adopt, the same way a security-audited package registry is already standard in conventional software development.