Skip to content
mcp/harbor
Verified official

attack surface mcp server MCP

v0.2.2

io.github.cyanheads/attack-surface-mcp-server

Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.

transport:stdio runtime:npm
View source

Target client

run in your project directory

Held in this page only — never stored, logged, or sent anywhere but back to your screen. 

claude mcp add attack-surface-mcp-server -e SHODAN_API_KEY=<SHODAN_API_KEY> -e CERTSPOTTER_API_KEY=<CERTSPOTTER_API_KEY> -e ATTACKSURFACE_DEFAULT_RESOLVERS=<ATTACKSURFACE_DEFAULT_RESOLVERS> -e ATTACKSURFACE_HTTP_USER_AGENT=<ATTACKSURFACE_HTTP_USER_AGENT> -e ATTACKSURFACE_MAX_SUBDOMAINS=<ATTACKSURFACE_MAX_SUBDOMAINS> -e ATTACKSURFACE_RDAP_BOOTSTRAP_URL=<ATTACKSURFACE_RDAP_BOOTSTRAP_URL> -e ATTACKSURFACE_ALLOW_PRIVATE_TARGETS=<ATTACKSURFACE_ALLOW_PRIVATE_TARGETS> -e MCP_LOG_LEVEL=<MCP_LOG_LEVEL> -- npx -y @cyanheads/attack-surface-mcp-server

Adds it for this project only. Append --scope user to make it available everywhere. Claude Code docs

This listing does not declare its tools. Connect the server and your client will discover them on the handshake.