# attack-surface-mcp-server MCP server

Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.

## Links
- Registry page: https://www.getdrio.com/mcp/io-github-cyanheads-attack-surface-mcp-server
- Repository: https://github.com/cyanheads/attack-surface-mcp-server

## Install
- Command: `npx -y @cyanheads/attack-surface-mcp-server`
- Auth: Not captured

## Setup notes
- Package: Npm @cyanheads/attack-surface-mcp-server v0.1.1
- Environment variable: SHODAN_API_KEY (secret)
- Environment variable: CERTSPOTTER_API_KEY (secret)
- Environment variable: ATTACKSURFACE_DEFAULT_RESOLVERS (default 8.8.8.8,1.1.1.1,9.9.9.9)
- Environment variable: ATTACKSURFACE_HTTP_USER_AGENT
- Environment variable: ATTACKSURFACE_MAX_SUBDOMAINS (default 200)
- Environment variable: ATTACKSURFACE_RDAP_BOOTSTRAP_URL (default https://rdap.org)
- Environment variable: ATTACKSURFACE_ALLOW_PRIVATE_TARGETS (default false)
- Environment variable: MCP_LOG_LEVEL (default info)
- Package: Npm @cyanheads/attack-surface-mcp-server v0.1.1
- Environment variable: MCP_HTTP_HOST (default 127.0.0.1)
- Environment variable: MCP_HTTP_PORT (default 3010)
- Environment variable: MCP_HTTP_ENDPOINT_PATH (default /mcp)
- Environment variable: MCP_AUTH_MODE (default none)
- Environment variable: MCP_LOG_LEVEL (default info)

## Tools
Not captured

## Resources
Not captured

## Prompts
Not captured

## Metadata
- Owner: io.github.cyanheads
- Version: 0.1.1
- Runtime: Npm
- Transports: STDIO, HTTP
- License: Not captured
- Language: Not captured
- Stars: Not captured
- Updated: Jun 14, 2026
- Source: https://registry.modelcontextprotocol.io