cosmic-mcp

All servers

attack-surface-mcp-server

io.github.cyanheads/attack-surface-mcp-server · version 0.5.0

Community listing. Not installed or verified by cosmic-mcp. Read the source and its permissions before you run it.

Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.

https://github.com/cyanheads/attack-surface-mcp-server

Quick facts

  • Listing: Community
  • Published Oct 30, 09:22 UTC
  • Transport: stdio
  • Package: npm @cyanheads/attack-surface-mcp-server 0.5.0
  • Listed by cosmic-mcp: Nov 9, 04:25 UTC

APIs and integrations

Setup snippets

Generated from the registry entry. cosmic-mcp has not run or reviewed this server; values in angle brackets are yours to fill in.

Run it locally (npm)

npx -y '@cyanheads/[email protected]'

Claude Desktop (claude_desktop_config.json)

{
  "mcpServers": {
    "attack-surface-mcp-server": {
      "args": [
        "-y",
        "@cyanheads/[email protected]"
      ],
      "command": "npx",
      "env": {
        "ATTACKSURFACE_ALLOW_PRIVATE_TARGETS": "<your attacksurface allow private targets>",
        "ATTACKSURFACE_DEFAULT_RESOLVERS": "<your attacksurface default resolvers>",
        "ATTACKSURFACE_HTTP_USER_AGENT": "<your attacksurface http user agent>",
        "ATTACKSURFACE_MAX_SUBDOMAINS": "<your attacksurface max subdomains>",
        "ATTACKSURFACE_RDAP_BOOTSTRAP_URL": "<your attacksurface rdap bootstrap url>",
        "CERTSPOTTER_API_KEY": "<your certspotter api key>",
        "MCP_LOG_LEVEL": "<your mcp log level>",
        "SHODAN_API_KEY": "<your shodan api key>"
      }
    }
  }
}

Claude Code

claude mcp add 'attack-surface-mcp-server' -- npx -y '@cyanheads/[email protected]'

Cursor (.cursor/mcp.json)

{
  "mcpServers": {
    "attack-surface-mcp-server": {
      "args": [
        "-y",
        "@cyanheads/[email protected]"
      ],
      "command": "npx",
      "env": {
        "ATTACKSURFACE_ALLOW_PRIVATE_TARGETS": "<your attacksurface allow private targets>",
        "ATTACKSURFACE_DEFAULT_RESOLVERS": "<your attacksurface default resolvers>",
        "ATTACKSURFACE_HTTP_USER_AGENT": "<your attacksurface http user agent>",
        "ATTACKSURFACE_MAX_SUBDOMAINS": "<your attacksurface max subdomains>",
        "ATTACKSURFACE_RDAP_BOOTSTRAP_URL": "<your attacksurface rdap bootstrap url>",
        "CERTSPOTTER_API_KEY": "<your certspotter api key>",
        "MCP_LOG_LEVEL": "<your mcp log level>",
        "SHODAN_API_KEY": "<your shodan api key>"
      }
    }
  }
}

VS Code (.vscode/mcp.json)

{
  "servers": {
    "attack-surface-mcp-server": {
      "args": [
        "-y",
        "@cyanheads/[email protected]"
      ],
      "command": "npx",
      "env": {
        "ATTACKSURFACE_ALLOW_PRIVATE_TARGETS": "<your attacksurface allow private targets>",
        "ATTACKSURFACE_DEFAULT_RESOLVERS": "<your attacksurface default resolvers>",
        "ATTACKSURFACE_HTTP_USER_AGENT": "<your attacksurface http user agent>",
        "ATTACKSURFACE_MAX_SUBDOMAINS": "<your attacksurface max subdomains>",
        "ATTACKSURFACE_RDAP_BOOTSTRAP_URL": "<your attacksurface rdap bootstrap url>",
        "CERTSPOTTER_API_KEY": "<your certspotter api key>",
        "MCP_LOG_LEVEL": "<your mcp log level>",
        "SHODAN_API_KEY": "<your shodan api key>"
      },
      "type": "stdio"
    }
  }
}

Related servers

  • Atako Verified domain
    Remote MCP server to run your Atako AI agents: chat, projects, files, integrations and channels.
  • AwrAIter — Telegram channels Verified domain
    Telegram channels you administer: analytics, content plans, scheduled publishing. No userbot
  • 01Mind Verified domain
    A machine-to-machine agent superstore -- paid API services for autonomous agents via x402 on Base.
  • 0xArchive Market Data Verified domain
    Hyperliquid and Lighter market data: order books, trades, candles, funding, OI, and webhooks
  • 10ML Perfume Finder Verified domain
    Free perfume MCP server and fragrance API: 6,000+ perfumes, note pyramids, accords, similar scents.
  • 17NAS Network Tools Verified domain
    Free network diagnostic tools: IP info, DNS lookup, IPv6 check. No API key.