name: Nucleus Security MCP Tool / REST Operation Crosswalk description: >- Binds the Nucleus MCP Server's documented tool categories to the Nucleus platform REST operations that back them. BOTH sides of this crosswalk are partially gated: the MCP tools/list requires an authenticated per-tenant session, and the platform Swagger definition is published only inside a logged-in customer console. Every row is therefore mapped by name and semantics from public documentation, and confidence is set accordingly. No operationIds are asserted because Nucleus does not publish any. generated: '2026-08-26' method: derived source: >- Derived from https://help.nucleussec.com/docs/nucleus-mcp-server.md (MCP tool categories) and the REST endpoints named verbatim in the public help-center API pages (data-export.md, metrics-api-reference.md, finding-processing-rules-api.md, external-issue-linking.md), 2026-08-26. surfaces: openapi: platform_api: base_url: https://[instance-name].nucleussec.com/nucleus/api spec: gated spec_note: >- Swagger/OpenAPI definition exists and is complete per the provider, but is reachable only from inside an authenticated Nucleus console (Help > API Docs > swagger.yaml). Not publicly retrievable. auth: apiKey header x-apikey public_vulnerability_intelligence: base_url: https://nucleussec.com/wp-json/nucleussec/v1 spec: openapi/nucleus-security-vulnerability-intelligence-openapi.yml spec_note: Generated by API Evangelist from the provider's own route descriptor and live responses. auth: none gated: false graphql: present: false mcp: product_endpoint: https://[your-nucleus-instance].nucleussec.com/nucleus/mcp product_gated: true website_endpoint: https://nucleussec.com/wp-json/mcp/mcp-oauth-server website_gated: true crosswalk: - tool: Project Management tools category: projects rest: [] rest_paths: - 'GET /projects' binding: semantic confidence: low note: >- Provider documents these tools as "retrieve lists of projects or detailed information about individual projects". Every documented REST endpoint in the public help center is scoped under /projects/{project_id}, which confirms a project resource exists, but the project list/detail operations themselves are not named on any public page. Path shown is inferred from the consistent /projects/{project_id} prefix and is NOT a provider-published operation. - tool: Asset Management tools category: assets rest: [] rest_paths: - 'GET /projects/{project_id}/assets/groups/metrics' binding: semantic confidence: medium note: >- The asset-group metrics endpoint is published verbatim in the Metrics API Reference and directly serves the documented tool capability "associated groups, and related metrics". Asset detail retrieval is described by the provider but has no publicly named endpoint. - tool: Findings and Vulnerability Management tools category: findings rest: [] rest_paths: - 'POST /api/projects/{project_id}/findings/search' - 'GET /projects/{project_id}/assets/groups/metrics' binding: semantic confidence: medium note: >- The findings search endpoint is published verbatim in the External Issue Linking API page and matches the documented tool capability "view findings sorted by risk". The metrics endpoint supplies "current vulnerability metrics" and vulnerability trend parameters (discovered_count_{n}d, resolved_count_{n}d, mttr_{n}d). - tool: NQL Metadata category: nql rest: [] binding: none confidence: low note: Dataset discovery for Nucleus Query Language. No public REST equivalent is documented. - tool: NQL Reference category: nql rest: [] binding: none confidence: low note: Returns the NQL syntax reference. No public REST equivalent is documented. - tool: NQL Query category: nql rest: [] binding: none confidence: low note: >- Executes NQL against findings, assets and related datasets under RBAC/AGAC. NQL is a Nucleus-specific query language with no publicly documented REST execution endpoint, though it plausibly shares a backend with findings search. mcp_only: - tool: NQL Metadata reason: Query-language dataset discovery; no publicly documented REST operation. - tool: NQL Reference reason: Query-language syntax reference; no publicly documented REST operation. - tool: NQL Query reason: >- NQL execution is exposed to AI clients through MCP. No public REST endpoint for NQL execution appears in the help center. rest_only: - path: 'GET /projects/{project_id}/dataexport' reason: >- Bulk data export file listing. Documented in the Data Export API page. No MCP tool category covers bulk export; the MCP tools are read/summarise oriented. - path: 'GET /api/projects/{project_id}/jobs/{job_id}' reason: Asynchronous job status polling. No corresponding MCP tool category. - path: 'GET /projects/{project_id}/automation/findingprocessing' reason: Finding Processing Rules listing. No corresponding MCP tool category. - path: 'POST /projects/{project_id}/automation/findingprocessing' reason: >- Create a finding processing rule. A WRITE operation with no MCP tool - the documented MCP tool set is read-only, which is a deliberate and notable safety boundary. - path: 'PUT /projects/{project_id}/automation/findingprocessing/{rule_id}' reason: Update a finding processing rule. Write operation, no MCP tool. - path: 'DELETE /projects/{project_id}/automation/findingprocessing/{rule_id}' reason: Delete a finding processing rule. Write operation, no MCP tool. - operation: listVulnerabilities path: 'GET /vulnerabilities/list' surface: public_vulnerability_intelligence reason: >- Public vulnerability intelligence dataset on nucleussec.com. A different surface from the tenant platform; no MCP tool exposes it. coverage: mcp_tool_categories_documented: 4 mcp_individual_tools_named_by_provider: 3 mcp_tools_with_public_input_schemas: 0 rest_operations_publicly_named: 8 rest_operations_with_public_openapi: 2 bound_rows: 3 unbound_mcp_rows: 3 rest_only_rows: 7 note: >- Coverage is low on both axes because both contracts are gated. This file records what is publicly knowable, not a complete map. An authenticated tools/list against a customer instance plus the in-console swagger.yaml would raise every confidence value.