About io.github.cyanheads/attack-surface-mcp-server
io.github.cyanheads/attack-surface-mcp-server is an MCP server in the Healthcare category: passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.
Install
Claude Code
claude mcp add io-github-cyanheads-attack-surface-mcp-server -- npx -y @cyanheads/attack-surface-mcp-servernpx
npx -y @cyanheads/attack-surface-mcp-serverThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (8)
attacksurface_enumerate_subdomainsPassive subdomain discovery from Certificate Transparency logs (crt.sh → Certspotter → TLS-SAN fallback chain), with DNS resolution to mark which names are live. Per-source provenance; no DNS brute-forcing.
Parameters not published.
attacksurface_inspect_tlsInspect TLS/SSL posture via a real read-only handshake: protocol, cipher, full certificate chain, SANs, validity window, days-to-expiry, issuer, validation status. Reports invalid/expired/self-signed certs instead of failing.
Parameters not published.
attacksurface_lookup_hostInfrastructure intelligence for a single IP (open ports, banners, software versions, ASN, geo) or a faceted internet-wide search, via Shodan. **Requires `SHODAN_API_KEY`** — returns a typed `source_unavailable` error when unset; the rest of the server is unaffected.
Parameters not published.
attacksurface_lookup_registrationRegistration and ownership lookup via RDAP (JSON; WHOIS fallback). A domain returns registrar, status, lifecycle events, nameservers, DNSSEC; an IP/CIDR returns netblock, allocation CIDRs, origin ASN, country.
Parameters not published.
attacksurface_map_domainFlagship workflow. Maps a domain's external surface end to end: CT-log subdomain discovery → DNS liveness → (standard+) DNS records, TLS posture, HTTP headers/tech → optional RDAP/WHOIS → (thorough + key) per-IP Shodan enrichment. Returns a structured surface map and a defensive assessment of observable facts.
Parameters not published.
attacksurface_probe_httpPassive HTTP(S) probe: one GET following redirects. Returns status, redirect chain, headers, a security-header audit (HSTS/CSP/X-Frame-Options/cookie flags/CORS reflection), and an evidence-bound technology fingerprint.
Parameters not published.
attacksurface_recon_guidanceOffline synthesis over findings gathered so far. Returns a prioritized **defensive** review plan plus pre-filled follow-up calls (which certs to renew, which hosts to inspect, which software versions to check for CVEs against an external NVD/OSV server). No external calls.
Parameters not published.
attacksurface_resolve_dnsResolve and enumerate DNS records (A/AAAA/CNAME/MX/NS/TXT/CAA) for one or more hosts across multiple public resolvers, with optional reverse DNS (PTR). Per-resolver values surface propagation gaps.
Parameters not published.
Ask AI
✦
Ask AI about io.github.cyanheads/attack-surface-mcp-server
Powered by Claude · Grounded in docs
I know everything about io.github.cyanheads/attack-surface-mcp-server. Ask me about installation, configuration, usage, or troubleshooting.
Security checks
6 checks have not been run yet.