Attack Surface MCP server
Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.
not scanned yet
2 stars392 downloads/wk
Reviews
Write oneNobody has reviewed Attack Surface yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Attack Surface tools
No tool declarations could be read from the package source. They show once the server is installed.
How Attack Surface compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 83/100
- higher than 65% of 48,255 servers
- GitHub stars
- 2
- more than 75% of 28,688 servers
- Downloads a week
- 392
- more than 85% of 12,191 servers with a package
Release history: 7 versions in the registry since 2026-08-30, latest 2026-10-30, typically one every 13 days.
Install Attack Surface in Claude Code, Cursor or VS Code
Runs npx -y @cyanheads/attack-surface-mcp-server on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add attack-surface-mcp-server -- npx -y @cyanheads/attack-surface-mcp-server
What the publisher says
From the Attack Surface repository's README, as published. We do not edit it. Read it on GitHub
@cyanheads/attack-surface-mcp-server Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan via MCP. STDIO or Streamable HTTP. 8 Tools • 1 Resource
[!IMPORTANT]
Authorized, defensive use only. Point this server only at assets you own or are explicitly authorized to assess. It performs passive, non-intrusive reconnaissance — it reads public records (Certificate Transparency logs, DNS, RDAP/WHOIS) and each target's own published surface (one TLS handshake and one HTTP GET per host). It does not port-scan, exploit, brute-force, fuzz, or probe for vulnerabilities; that capability is excluded from the surface by design, not gated behind a flag. Output is descriptive — what exists and what the security posture is — never an exploitation plan. Every outbound connection passes an SSRF guard that refuses private, loopback, link-local, and cloud-metadata targets.
Tools
Eight tools organized around the recon workflow — attacksurfacemapdomain orchestrates the full flow end to end, the per-aspect tools back it for targeted follow-up, and attacksurfacereconguidance synthesizes findings into a defensive review plan. Seven are keyless; one (attacksurfacelookuphost) needs a Shodan key and degrades gracefully without it.
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Attack Surface: common questions
- Is Attack Surface MCP server safe?
- Mostly: it is graded B (83/100). Read the Attack Surface safety report
- How do I install Attack Surface?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Attack Surface need an API key?
- Yes. The registry entry asks for
SHODAN_API_KEY,CERTSPOTTER_API_KEY. - Is Attack Surface maintained?
- The last commit was 17 days ago (2026-10-17). The latest release is v0.5.0.
- What can I use instead of Attack Surface?
- Servers from other publishers that do the same job: Domain Liveness MCP server.
- How does Attack Surface compare with other MCP servers?
- safety score 83/100 (higher than 65% of 48,255 servers); github stars 2 (more than 75% of 28,688 servers); downloads a week 392 (more than 85% of 12,191 servers with a package). Full comparison.
Alternatives to Attack Surface
Same job from other publishers: the closest match first, then the best rated.
- Domain LivenessIs this business's website still there? Checks apex and www, and DNS separately from HTTP.not reviewedEstablishedA
