How do I install attack-surface-mcp-server?

Pick a client above and copy the generated config. Cursor and VS Code also have a deep link when the server can run locally or remotely.

Is attack-surface-mcp-server official?

No. Registry-listed is not the same as vendor-official. Read the methodology for the difference.

How is the trust score calculated?

This listing scores 58 (Fair). The formula is published on the methodology page.

MCPpedia

attack-surface-mcp-server MCP Server | MCPpedia

attack-surface-mcp-server MCP Server

Name: attack-surface-mcp-server MCP Server
Author: cyanheads

Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.

Tools Versions Alternatives

Registrycyanheads

58Fair

Install

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "cyanheads-attack-surface-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/attack-surface-mcp-server@0.4.0"
      ],
      "env": {
        "SHODAN_API_KEY": "YOUR_SHODAN_API_KEY",
        "CERTSPOTTER_API_KEY": "YOUR_CERTSPOTTER_API_KEY",
        "ATTACKSURFACE_DEFAULT_RESOLVERS": "8.8.8.8,1.1.1.1,9.9.9.9",
        "ATTACKSURFACE_HTTP_USER_AGENT": "",
        "ATTACKSURFACE_MAX_SUBDOMAINS": "200",
        "ATTACKSURFACE_RDAP_BOOTSTRAP_URL": "https://rdap.org",
        "ATTACKSURFACE_ALLOW_PRIVATE_TARGETS": "false",
        "MCP_LOG_LEVEL": "info"
      }
    }
  }
}

Install guide

Related servers

pagespeed-insights-mcp

75Good

Google PageSpeed Insights and CrUX: six workflow tools for web performance.

Registryruslanlap72 stars500/wk

Hive Intelligence MCP

73Good

Evidence-backed crypto due diligence with sources, freshness, and a runtime receipt on every call.

Environment

Name	Required	Notes
SHODAN_API_KEY	No	Optional Shodan API key. Enables attacksurface_lookup_host; absent → that one tool returns source_unavailable and the rest of the server works. Secret.
CERTSPOTTER_API_KEY	No	Optional Certspotter API key. Raises CT-fallback rate limits; absent → free unauthenticated tier. Secret.
ATTACKSURFACE_DEFAULT_RESOLVERS	No	Comma-separated default DNS resolver IPs for attacksurface_resolve_dns.
ATTACKSURFACE_HTTP_USER_AGENT	No	Default User-Agent for attacksurface_probe_http (overridable per call).
ATTACKSURFACE_MAX_SUBDOMAINS	No	Map/snapshot resolution cap; enumeration also caps each page at 50 candidates.
ATTACKSURFACE_RDAP_BOOTSTRAP_URL	No	RDAP bootstrap base URL; override for a private/mirrored RDAP.
ATTACKSURFACE_ALLOW_PRIVATE_TARGETS	No	Set true to permit non-public target ranges for trusted internal-network assessment; URL and HTTP(S) scheme checks remain enforced.
MCP_LOG_LEVEL	No	Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').
MCP_TRANSPORT_TYPE	No	Selects the HTTP transport.
MCP_HTTP_HOST	No	The hostname for the HTTP server.
MCP_HTTP_PORT	No	The port to run the HTTP server on.
MCP_HTTP_ENDPOINT_PATH	No	The endpoint path for the MCP server.
MCP_AUTH_MODE	No	Authentication mode to use: 'none', 'jwt', or 'oauth'.
MCP_LOG_LEVEL	No	Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').

attack-surface-mcp-server MCP Server

Install

Related servers

pagespeed-insights-mcp

Hive Intelligence MCP

Environment

Tools

About

FAQ

Reviews

Screaming Frog SEO Spider MCP Server (headless)

Funplay Unity MCP

Kilotest

mcp-server