Known Gaps

Known limitations and coverage gaps in Qualys MCP v0.1.0. The server covers 9+ Qualys modules through 7 workflow tools backed by 42 aggregator functions, but some areas remain limited.

Known Gaps

Trend & Historical Analysis

What's missing: Week-over-week and month-over-month trend data, vulnerability trends over 90 days, remediation rates over time.

Why: Qualys VMDR API does not provide historical snapshot endpoints. Trends would require external storage of periodic snapshots.

Workaround: Use security_overview(period="week") or security_overview(period="month") for period-scoped views.

Granular Patch Management

What's missing: Individual patch job queries by ID, patch scheduling, maintenance windows, rollback history.

Workaround: Use plan_remediation(scope="patches", platform="windows") for platform-specific views. For individual job management, use the Qualys console.

Kubernetes & Container Runtime

What's missing: K8s cluster inventory, namespace-level breakdown, RBAC analysis, pod-level queries.

Workaround: Use assess_risk(scope="containers") for image-level vulnerability data.

WAS Scan Management

What's missing: WAS scan status, scan scheduling, per-app scan history.

Workaround: Use assess_risk(scope="web", app_name="...") for findings. Manage scans through the Qualys WAS console.

SLA & Business-Unit Segmentation

What's missing: SLA-based queries, department-level metrics.

Workaround: Use assess_risk(tag="...") and plan_remediation(tag="...") for tag-based segmentation.

Write Operations

What's missing: Creating remediation tickets, scheduling scans, modifying asset tags, accepting risks.

Status: v0.1.0 is read-only by design. Write operations are under consideration for future releases.

Module Coverage