io.github.cyanheads/attack-surface-mcp-server

io.github.cyanheads/attack-surface-mcp-server

Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.

View repository →

Connect this server

Add this to your MCP client config — claude_desktop_config.json (Claude Desktop) or .cursor/mcp.json (Cursor).Suits: Claude Desktop · Cursor.

{
  "mcpServers": {
    "attack-surface-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/attack-surface-mcp-server@0.5.0"
      ],
      "env": {
        "SHODAN_API_KEY": "<your SHODAN_API_KEY>",
        "CERTSPOTTER_API_KEY": "<your CERTSPOTTER_API_KEY>",
        "ATTACKSURFACE_DEFAULT_RESOLVERS": "8.8.8.8,1.1.1.1,9.9.9.9",
        "ATTACKSURFACE_MAX_SUBDOMAINS": "200",
        "ATTACKSURFACE_RDAP_BOOTSTRAP_URL": "https://rdap.org",
        "ATTACKSURFACE_ALLOW_PRIVATE_TARGETS": "false",
        "MCP_LOG_LEVEL": "info"
      }
    }
  }
}
Environment variables
  • SHODAN_API_KEYsecretOptional Shodan API key. Enables attacksurface_lookup_host; absent → that one tool returns source_unavailable and the rest of the server works.
  • CERTSPOTTER_API_KEYsecretOptional Certspotter API key. Raises CT-fallback rate limits; absent → free unauthenticated tier.
  • ATTACKSURFACE_DEFAULT_RESOLVERSComma-separated default DNS resolver IPs for attacksurface_resolve_dns.
  • ATTACKSURFACE_MAX_SUBDOMAINSMap/snapshot resolution cap; enumeration also caps each page at 50 candidates.
  • ATTACKSURFACE_RDAP_BOOTSTRAP_URLRDAP bootstrap base URL; override for a private/mirrored RDAP.
  • ATTACKSURFACE_ALLOW_PRIVATE_TARGETSSet true to permit non-public target ranges for trusted internal-network assessment; URL and HTTP(S) scheme checks remain enforced.
  • MCP_LOG_LEVELSets the minimum log level for output (e.g., 'debug', 'info', 'warn').

A starting point — check the repository for exact arguments and setup. Restart your client after editing the config.

Category
Developer Tools
Version
0.5.0
Registry
active
Published
10/30/2026

More Developer Tools servers

Browse all Developer Tools →

io.github.cyanheads/aviation-weather-mcp-server

cyanheads

METARs, TAFs, PIREPs, domestic/international SIGMETs and CWAs via NWS AWC. AIRMETs not served.

Developer ToolsAdded 1 week ago

io.github.cyanheads/biorxiv-mcp-server

cyanheads

Search and retrieve bioRxiv and medRxiv preprints — by DOI, date interval, or keyword — via MCP.

Developer ToolsAdded 1 week ago

io.github.cyanheads/bls-labor-mcp-server

cyanheads

Fetch US Bureau of Labor Statistics data — CPI, unemployment, wages, JOLTS, and more via MCP.

Developer ToolsAdded 1 week ago

io.github.cyanheads/bls-mcp-server

cyanheads

Fetch US Bureau of Labor Statistics data — CPI, unemployment, wages, JOLTS, and more via MCP.

Developer ToolsAdded 5 months ago

io.github.cyanheads/bluesky-mcp-server

cyanheads

Search Bluesky posts and feeds; read profiles, threads, and trends. STDIO or Streamable HTTP.

Developer ToolsAdded 1 week ago

io.github.cyanheads/brapi-mcp-server

cyanheads

Collaborative BrAPI v2.1 MCP workspace: studies, germplasm, genotypes across Breedbase, T3, more.

Developer ToolsAdded 3 weeks ago

Add the badge to your site

Show visitors that io.github.cyanheads/attack-surface-mcp-server is listed here — it’s also the link we check for a free listing.

io.github.cyanheads/attack-surface-mcp-server — listed on Serverdex

HTML — for your website

<a href="https://serverdex.io/server/io-github-cyanheads-attack-surface-mcp-server?utm_source=badge"><img src="https://serverdex.io/brand/badge.svg" alt="io.github.cyanheads/attack-surface-mcp-server — listed on Serverdex" width="123" height="40" loading="lazy"></a>

Recommended. A dofollow link from your own domain is the one that counts for search engines, and it's the link we check for a free listing.

Markdown — for your README

[![io.github.cyanheads/attack-surface-mcp-server — listed on Serverdex](https://serverdex.io/brand/badge.svg)](https://serverdex.io/server/io-github-cyanheads-attack-surface-mcp-server?utm_source=badge)

Nice for visibility, but GitHub marks README links nofollow, so it doesn't pass authority. Use the HTML badge on your site as well.