How do I install the attack mcp server?

Use a recorded configuration for your client, replace example credential values and paths, and verify the documented runtime. Restart or reconnect the client, then inspect the available tools.

What credentials does it need?

It reads `MCP_TRANSPORT_TYPE`, `MCP_LOG_LEVEL`, `SHODAN_API_KEY`, `CERTSPOTTER_API_KEY`, `ATTACKSURFACE_RDAP_BOOTSTRAP_URL` from the environment. Store these in your client's env block or a secrets manager — never commit them to a repository — and grant the narrowest scope that still covers your use case.

SSyncDev

Start a project

Attack MCP Server

Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.

Local serverstdio

What is the Attack MCP Server?

Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.

What the server does

Declarative tool and resource definitions — single file per primitive, framework handles registration and validation
Unified error handling — handlers throw, framework catches, classifies, and formats
Pluggable auth: none, jwt, oauth
Swappable storage backends: in-memory, filesystem, Supabase, Cloudflare KV/R2/D1
Structured logging with optional OpenTelemetry tracing
STDIO and Streamable HTTP transports

Credentials and setup notes

Bun v1.3.11 or higher (or Node.js v24+). - No API key required for the core tools. Optional: a Shodan API key for attacksurface_lookup_host, and a Certspotter API key to raise CT-fallback rate limits.

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

Tool	What it does
attacksurface_map_domain	Flagship workflow. Maps a domain's external surface end to end: CT-log subdomain discovery → DNS liveness → (standard+) DNS records, TLS posture, HTTP headers/tech → optional RDAP/WHOIS → (thorough + key) per-IP Shodan e
attacksurface_enumerate_subdomains	Passive subdomain discovery from Certificate Transparency logs (crt.sh → Certspotter → TLS-SAN fallback chain), with DNS resolution to mark which names are live. Per-source provenance; no DNS brute-forcing.
attacksurface_resolve_dns	Resolve and enumerate DNS records (A/AAAA/CNAME/MX/NS/TXT/CAA) for one or more hosts across multiple public resolvers, with optional reverse DNS (PTR). Per-resolver values surface propagation gaps.
attacksurface_inspect_tls	Inspect TLS/SSL posture via a real read-only handshake: protocol, cipher, full certificate chain, SANs, validity window, days-to-expiry, issuer, validation status. Reports invalid/expired/self-signed certs instead of fai
attacksurface_probe_http	Passive HTTP(S) probe: one GET following redirects. Returns status, redirect chain, headers, a security-header audit (HSTS/CSP/X-Frame-Options/cookie flags/CORS reflection), and an evidence-bound technology fingerprint.
attacksurface_lookup_registration	Registration and ownership lookup via RDAP (JSON; WHOIS fallback). A domain returns registrar, status, lifecycle events, nameservers, DNSSEC; an IP/CIDR returns netblock, allocation CIDRs, origin ASN, country.
attacksurface_lookup_host	Infrastructure intelligence for a single IP (open ports, banners, software versions, ASN, geo) or a faceted internet-wide search, via Shodan. Requires SHODAN_API_KEY — returns a typed source_unavailable error when un
attacksurface_recon_guidance	Offline synthesis over findings gathered so far. Returns a prioritized defensive review plan plus pre-filled follow-up calls (which certs to renew, which hosts to inspect, which software versions to check for CVEs ag

How to install the Attack MCP Server

{
  "mcpServers": {
    "attack-surface-mcp-server": {
      "type": "stdio",
      "command": "bunx",
      "args": ["@cyanheads/attack-surface-mcp-server@latest"],
      "env": {
        "MCP_TRANSPORT_TYPE": "stdio",
        "MCP_LOG_LEVEL": "info"
      }
    }
  }
}

Configuration as documented by the project. Restart the client after saving.

Configuration

Bun v1.3.11 or higher (or Node.js v24+). - No API key required for the core tools. Optional: a Shodan API key for attacksurface_lookup_host, and a Certspotter API key to raise CT-fallback rate limits.

Variable	Description	Required
MCP_TRANSPORT_TYPE	Configuration value read at startup.	Optional
MCP_LOG_LEVEL	Configuration value read at startup.	Optional
SHODAN_API_KEY	Credential the server authenticates with.	Yes
CERTSPOTTER_API_KEY	Credential the server authenticates with.	Yes
ATTACKSURFACE_RDAP_BOOTSTRAP_URL	Endpoint or connection string the server talks to.	Yes

Example prompts to try

“Use Attack to attacksurface map domain.”
“Use Attack to attacksurface enumerate subdomains.”
“Use Attack to attacksurface resolve dns.”

Frequently asked questions

Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan. Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.