Attack Surface Mcp Server

io.github.cyanheads/attack-surface-mcp-server · v0.6.0

Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.

Source code Set it up

Connect Runs on your machine

Terminal

claude mcp add attack-surface-mcp-server -e SHODAN_API_KEY=<SHODAN_API_KEY> -e CERTSPOTTER_API_KEY=<CERTSPOTTER_API_KEY> -e ATTACKSURFACE_DEFAULT_RESOLVERS=<ATTACKSURFACE_DEFAULT_RESOLVERS> -e ATTACKSURFACE_HTTP_USER_AGENT=<ATTACKSURFACE_HTTP_USER_AGENT> -e ATTACKSURFACE_MAX_SUBDOMAINS=<ATTACKSURFACE_MAX_SUBDOMAINS> -e ATTACKSURFACE_RDAP_BOOTSTRAP_URL=<ATTACKSURFACE_RDAP_BOOTSTRAP_URL> -e ATTACKSURFACE_ALLOW_PRIVATE_TARGETS=<ATTACKSURFACE_ALLOW_PRIVATE_TARGETS> -e MCP_LOG_LEVEL=<MCP_LOG_LEVEL> -- npx -y @cyanheads/[email protected]

claude_desktop_config.json

{
  "mcpServers": {
    "attack-surface-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/[email protected]"
      ],
      "env": {
        "SHODAN_API_KEY": "<SHODAN_API_KEY>",
        "CERTSPOTTER_API_KEY": "<CERTSPOTTER_API_KEY>",
        "ATTACKSURFACE_DEFAULT_RESOLVERS": "<ATTACKSURFACE_DEFAULT_RESOLVERS>",
        "ATTACKSURFACE_HTTP_USER_AGENT": "<ATTACKSURFACE_HTTP_USER_AGENT>",
        "ATTACKSURFACE_MAX_SUBDOMAINS": "<ATTACKSURFACE_MAX_SUBDOMAINS>",
        "ATTACKSURFACE_RDAP_BOOTSTRAP_URL": "<ATTACKSURFACE_RDAP_BOOTSTRAP_URL>",
        "ATTACKSURFACE_ALLOW_PRIVATE_TARGETS": "<ATTACKSURFACE_ALLOW_PRIVATE_TARGETS>",
        "MCP_LOG_LEVEL": "<MCP_LOG_LEVEL>"
      }
    }
  }
}

~/.cursor/mcp.json

{
  "mcpServers": {
    "attack-surface-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/[email protected]"
      ],
      "env": {
        "SHODAN_API_KEY": "<SHODAN_API_KEY>",
        "CERTSPOTTER_API_KEY": "<CERTSPOTTER_API_KEY>",
        "ATTACKSURFACE_DEFAULT_RESOLVERS": "<ATTACKSURFACE_DEFAULT_RESOLVERS>",
        "ATTACKSURFACE_HTTP_USER_AGENT": "<ATTACKSURFACE_HTTP_USER_AGENT>",
        "ATTACKSURFACE_MAX_SUBDOMAINS": "<ATTACKSURFACE_MAX_SUBDOMAINS>",
        "ATTACKSURFACE_RDAP_BOOTSTRAP_URL": "<ATTACKSURFACE_RDAP_BOOTSTRAP_URL>",
        "ATTACKSURFACE_ALLOW_PRIVATE_TARGETS": "<ATTACKSURFACE_ALLOW_PRIVATE_TARGETS>",
        "MCP_LOG_LEVEL": "<MCP_LOG_LEVEL>"
      }
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "attack-surface-mcp-server": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/[email protected]"
      ],
      "env": {
        "SHODAN_API_KEY": "<SHODAN_API_KEY>",
        "CERTSPOTTER_API_KEY": "<CERTSPOTTER_API_KEY>",
        "ATTACKSURFACE_DEFAULT_RESOLVERS": "<ATTACKSURFACE_DEFAULT_RESOLVERS>",
        "ATTACKSURFACE_HTTP_USER_AGENT": "<ATTACKSURFACE_HTTP_USER_AGENT>",
        "ATTACKSURFACE_MAX_SUBDOMAINS": "<ATTACKSURFACE_MAX_SUBDOMAINS>",
        "ATTACKSURFACE_RDAP_BOOTSTRAP_URL": "<ATTACKSURFACE_RDAP_BOOTSTRAP_URL>",
        "ATTACKSURFACE_ALLOW_PRIVATE_TARGETS": "<ATTACKSURFACE_ALLOW_PRIVATE_TARGETS>",
        "MCP_LOG_LEVEL": "<MCP_LOG_LEVEL>"
      }
    }
  }
}

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools

This server runs locally, so its tools are listed by your MCP client once it starts.

Environment variables

Name	Description
`SHODAN_API_KEY` Optional, secret	Optional Shodan API key. Enables attacksurface_lookup_host; absent → that one tool returns source_unavailable and the rest of the server works.
`CERTSPOTTER_API_KEY` Optional, secret	Optional Certspotter API key. Raises CT-fallback rate limits; absent → free unauthenticated tier.
`ATTACKSURFACE_DEFAULT_RESOLVERS` Optional	Comma-separated public DNS resolver IPs. The first also supplies discovery liveness, PTR and public DNS checks before guarded connections.
`ATTACKSURFACE_HTTP_USER_AGENT` Optional	Default User-Agent for attacksurface_probe_http (overridable per call).
`ATTACKSURFACE_MAX_SUBDOMAINS` Optional	Map/snapshot resolution cap; enumeration also caps each page at 50 candidates.
`ATTACKSURFACE_RDAP_BOOTSTRAP_URL` Optional	RDAP bootstrap base URL; override for a private/mirrored RDAP.
`ATTACKSURFACE_ALLOW_PRIVATE_TARGETS` Optional	Set true to permit non-public target ranges for trusted internal-network assessment; URL and HTTP(S) scheme checks remain enforced.
`MCP_LOG_LEVEL` Optional	Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').

Details

Package	`@cyanheads/[email protected]` (NPM, stdio)
Package	`@cyanheads/[email protected]` (NPM, streamable-http)
First published	11 Nov 2026
Last updated	11 Nov 2026
Registry name	`io.github.cyanheads/attack-surface-mcp-server`

More other servers See all

Live status

Local install

Installed and run on your own machine, so there is no public endpoint to check.

Pair it with live search

Agents that use Attack Surface Mcp Server often also need current facts. NestDaddy MCP gives your AI today's internet: web search, real-time breaking news and full page reading in one connector.

See NestDaddy MCP

For maintainers

[![NestDaddy MCP](https://nestdaddy.com/mcp/servers/io-github-cyanheads-attack-surface-mcp-server/badge.svg)](https://nestdaddy.com/mcp/servers/io-github-cyanheads-attack-surface-mcp-server)

Add the badge to your README. It turns green while your server passes our daily check. Listing details come from the official MCP registry; update them there.

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.