HotStack

← Back to browse

attack-surface-mcp-server

Indexed by io.github.cyanheads
View source ↗

About

Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.

Use this server

Add it to your MCP client. The catalogue lists this config verbatim from its source — it does not run, download, or vouch for the server. Review the command before you run it.

Transportstdio (runs a local command)
Env varsSHODAN_API_KEY CERTSPOTTER_API_KEY ATTACKSURFACE_DEFAULT_RESOLVERS ATTACKSURFACE_HTTP_USER_AGENT ATTACKSURFACE_MAX_SUBDOMAINS ATTACKSURFACE_RDAP_BOOTSTRAP_URL ATTACKSURFACE_ALLOW_PRIVATE_TARGETS MCP_LOG_LEVEL
Claude Code 
claude mcp add --env SHODAN_API_KEY= --env CERTSPOTTER_API_KEY= --env ATTACKSURFACE_DEFAULT_RESOLVERS= --env ATTACKSURFACE_HTTP_USER_AGENT= --env ATTACKSURFACE_MAX_SUBDOMAINS= --env ATTACKSURFACE_RDAP_BOOTSTRAP_URL= --env ATTACKSURFACE_ALLOW_PRIVATE_TARGETS= --env MCP_LOG_LEVEL= attack-surface-mcp-server -- npx @cyanheads/attack-surface-mcp-server
Cursor

Add to Cursor

If the button doesn't open Cursor, use the JSON below — Cursor accepts the same mcpServers config.

VS Code 
code --add-mcp '{"name":"attack-surface-mcp-server","command":"npx","args":["@cyanheads/attack-surface-mcp-server"],"env":{"SHODAN_API_KEY":"","CERTSPOTTER_API_KEY":"","ATTACKSURFACE_DEFAULT_RESOLVERS":"","ATTACKSURFACE_HTTP_USER_AGENT":"","ATTACKSURFACE_MAX_SUBDOMAINS":"","ATTACKSURFACE_RDAP_BOOTSTRAP_URL":"","ATTACKSURFACE_ALLOW_PRIVATE_TARGETS":"","MCP_LOG_LEVEL":""}}'
JSON 
{
  "mcpServers": {
    "attack-surface-mcp-server": {
      "command": "npx",
      "args": [
        "@cyanheads/attack-surface-mcp-server"
      ],
      "env": {
        "SHODAN_API_KEY": "",
        "CERTSPOTTER_API_KEY": "",
        "ATTACKSURFACE_DEFAULT_RESOLVERS": "",
        "ATTACKSURFACE_HTTP_USER_AGENT": "",
        "ATTACKSURFACE_MAX_SUBDOMAINS": "",
        "ATTACKSURFACE_RDAP_BOOTSTRAP_URL": "",
        "ATTACKSURFACE_ALLOW_PRIVATE_TARGETS": "",
        "MCP_LOG_LEVEL": ""
      }
    }
  }
}

Environment variables are listed by name only — fill in your own values. Entries never carry secrets.