Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.
If you already use Attack, the attack mcp server is the piece that lets your assistant work with it directly. Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.
Setup follows the usual MCP pattern — install or clone the server, register it in your client's configuration file, restart the client. The configuration blocks on this page cover the common clients.
The toolset is worth reading before you wire it up, because it tells you what the integration is really for:
attacksurface_map_domain — Flagship workflow. Maps a domain's external surface end to end: CT-log subdomain discovery → DNS liveness → (standard+) DNS records, TLS postureattacksurface_enumerate_subdomains — Passive subdomain discovery from Certificate Transparency logs (crt.sh → Certspotter → TLS-SAN fallback chain), with DNS resolution to mark whichattacksurface_resolve_dns — Resolve and enumerate DNS records (A/AAAA/CNAME/MX/NS/TXT/CAA) for one or more hosts across multiple public resolvers, with optional reverse DNSattacksurface_inspect_tls — Inspect TLS/SSL posture via a real read-only handshake: protocol, cipher, full certificate chain, SANs, validity window, days-to-expiry, issuerattacksurface_probe_http — Passive HTTP(S) probe: one GET following redirects. Returns status, redirect chain, headers, a security-header audit (HSTS/CSP/X-Frame-Options/cookieattacksurface_lookup_registration — Registration and ownership lookup via RDAP (JSON; WHOIS fallback). A domain returns registrar, status, lifecycle events, nameservers, DNSSEC; anattacksurface_lookup_host — Infrastructure intelligence for a single IP (open ports, banners, software versions, ASN, geo) or a faceted internet-wide search, via Shodanattacksurface_recon_guidance — Offline synthesis over findings gathered so far. Returns a prioritized defensive review plan plus pre-filled follow-up calls (which certs toPrerequisites — The Prerequisites tool exposed by this serverInstallation — The Installation tool exposed by this serverConfiguration is passed through the environment: MCP_TRANSPORT_TYPE, MCP_LOG_LEVEL, SHODAN_API_KEY, CERTSPOTTER_API_KEY, ATTACKSURFACE_RDAP_BOOTSTRAP_URL. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.
attacksurface_lookup_host, and a Certspotter API key to raise CT-fallback rate limits.Among the cloud and infrastructure options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Attack's toolset — attacksurface_map_domain, attacksurface_enumerate_subdomains, attacksurface_resolve_dns and 7 more — is a fair guide to whether it matches your workflow. It is maintained by cyanheads; worth a glance at recent repository activity before you build anything load-bearing on it.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
| Tool | What it does |
|---|---|
| attacksurface_map_domain | Flagship workflow. Maps a domain's external surface end to end: CT-log subdomain discovery → DNS liveness → (standard+) DNS records, TLS posture, HTTP headers/tech → optional RDAP/WHOIS → (thorough + key) per-IP Shodan e |
| attacksurface_enumerate_subdomains | Passive subdomain discovery from Certificate Transparency logs (crt.sh → Certspotter → TLS-SAN fallback chain), with DNS resolution to mark which names are live. Per-source provenance; no DNS brute-forcing. |
| attacksurface_resolve_dns | Resolve and enumerate DNS records (A/AAAA/CNAME/MX/NS/TXT/CAA) for one or more hosts across multiple public resolvers, with optional reverse DNS (PTR). Per-resolver values surface propagation gaps. |
| attacksurface_inspect_tls | Inspect TLS/SSL posture via a real read-only handshake: protocol, cipher, full certificate chain, SANs, validity window, days-to-expiry, issuer, validation status. Reports invalid/expired/self-signed certs instead of fai |
| attacksurface_probe_http | Passive HTTP(S) probe: one GET following redirects. Returns status, redirect chain, headers, a security-header audit (HSTS/CSP/X-Frame-Options/cookie flags/CORS reflection), and an evidence-bound technology fingerprint. |
| attacksurface_lookup_registration | Registration and ownership lookup via RDAP (JSON; WHOIS fallback). A domain returns registrar, status, lifecycle events, nameservers, DNSSEC; an IP/CIDR returns netblock, allocation CIDRs, origin ASN, country. |
| attacksurface_lookup_host | Infrastructure intelligence for a single IP (open ports, banners, software versions, ASN, geo) or a faceted internet-wide search, via Shodan. **Requires SHODAN_API_KEY** — returns a typed source_unavailable error when un |
| attacksurface_recon_guidance | Offline synthesis over findings gathered so far. Returns a prioritized **defensive** review plan plus pre-filled follow-up calls (which certs to renew, which hosts to inspect, which software versions to check for CVEs ag |
| Prerequisites | The Prerequisites tool exposed by this server. |
| Installation | The Installation tool exposed by this server. |
{
"mcpServers": {
"attack-surface-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/attack-surface-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Configuration as documented by the project. Restart the client after saving.
attacksurface_lookup_host, and a Certspotter API key to raise CT-fallback rate limits.| Variable | Description | Required |
|---|---|---|
| MCP_TRANSPORT_TYPE | Configuration value read at startup. | Optional |
| MCP_LOG_LEVEL | Configuration value read at startup. | Optional |
| SHODAN_API_KEY | Credential the server authenticates with. | Yes |
| CERTSPOTTER_API_KEY | Credential the server authenticates with. | Yes |
| ATTACKSURFACE_RDAP_BOOTSTRAP_URL | Endpoint or connection string the server talks to. | Yes |
Manage your whole Supabase project in conversation — database, auth, storage, Edge Functions and branches.
Stop letting your assistant hallucinate n8n node parameters — this server hands it the real schemas, templates and validation.
AWS Labs' official server suite — current AWS docs, CDK guidance, cost analysis and service tools.
Cloud browsers for AI agents — automation sessions that run in Browserbase's fleet, not on your machine.
Workers, KV, R2 and D1 by conversation — Cloudflare's official remote servers for building and observability.
Dashboards, Prometheus and Loki queries, incidents and alerts — observability by conversation.