io.github.cyanheads

attack-surface-mcp-server

Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.

communityapplication

Package Details

@cyanheads/attack-surface-mcp-server

0.1.0•https://www.npmjs.com/package/@cyanheads/attack-surface-mcp-server
Transportstdio
Runtimebun

Package Arguments

Positional
Position 0
run
Position 1
start:stdio

Environment Variables

SHODAN_API_KEY(str)
Secret

Optional Shodan API key. Enables attacksurface_lookup_host; absent → that one tool returns source_unavailable and the rest of the server works.

CERTSPOTTER_API_KEY(str)
Secret

Optional Certspotter API key. Raises CT-fallback rate limits; absent → free unauthenticated tier.

ATTACKSURFACE_DEFAULT_RESOLVERS(str)
Default:8.8.8.8,1.1.1.1,9.9.9.9

Comma-separated default DNS resolver IPs for attacksurface_resolve_dns.

ATTACKSURFACE_HTTP_USER_AGENT(str)

Default User-Agent for attacksurface_probe_http (overridable per call).

ATTACKSURFACE_MAX_SUBDOMAINS(str)
Default:200

Cap on subdomains resolved during a map_domain run.

ATTACKSURFACE_RDAP_BOOTSTRAP_URL(str)
Default:https://rdap.org

RDAP bootstrap base URL; override for a private/mirrored RDAP.

ATTACKSURFACE_ALLOW_PRIVATE_TARGETS(str)
Default:false

Set true to disable the SSRF guard for internal-network assessment (local/trusted deployments only).

MCP_LOG_LEVEL(str)
Default:info

Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').

@cyanheads/attack-surface-mcp-server

0.1.0•https://www.npmjs.com/package/@cyanheads/attack-surface-mcp-server
TransportStreamable HTTP
Runtimebun

Package Arguments

Positional
Position 0
run
Position 1
start:http

Environment Variables

MCP_HTTP_HOST(str)
Default:127.0.0.1

The hostname for the HTTP server.

MCP_HTTP_PORT(str)
Default:3010

The port to run the HTTP server on.

MCP_HTTP_ENDPOINT_PATH(str)
Default:/mcp

The endpoint path for the MCP server.

MCP_AUTH_MODE(str)
Default:none

Authentication mode to use: 'none', 'jwt', or 'oauth'.

MCP_LOG_LEVEL(str)
Default:info

Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').