query_rapid7
Executes SQL against the loaded data. The connection is locked down after loading — filesystem reads, writes, and network access are all blocked at the DuckDB engine level.
How to use it
query_rapid7 is exposed by the Rapid7 Bulk Export MCP MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the query_rapid7 tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.
Install Rapid7 Bulk Export MCP
npx skills install https://github.com/rapid7/rapid7-bulk-export-mcpOther tools in Rapid7 Bulk Export MCP (8)
Polls the Rapid7 API once for the current status of an export job. Use after startrapid7export to know when data is ready.
Downloads a completed export's Parquet files and loads them into the local DuckDB database. This is where data becomes queryable.
Returns column names and data types for all loaded tables. Use this to understand what fields are available before writing queries.
Returns summary statistics — row counts, severity distributions, CVSS score ranges, exploit counts, and cloud provider breakdowns.
Shows recent export history with IDs, dates, statuses, and row counts. Useful for finding a previous export to reload.
Loads existing Parquet files directly from disk (must be within ~/.rapid7mcp/imports/). Useful if you already have exported files and want to skip the API call.
Permanently deletes both the vulnerability database and the export tracking database from disk. Use when you're done with analysis or before handing off a machine.
Kicks off a new export job on Rapid7's servers. Returns immediately with an export ID. Supports three export types: vulnerability, policy, and remediation.