SERVER

attack-surface-mcp-server

Rank #9,734

io.github.cyanheads/attack-surface-mcp-server

Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.

6 versions

1 GitHub stars

by cyanheads (135 servers)View repository ↗Claim this server

First listed

Jun 13, 2026

Last publish date

Sep 22, 2026

OVERVIEW

attack-surface-mcp-server is a Model Context Protocol (MCP) server published by cyanheads. It ranks #9,734 of 132,046 servers tracked on MCP Toplist, and its repository has 1 GitHub stars. attack-surface-mcp-server is listed across 4 registries — Official MCP, Glama, PulseMCP and Smithery, with 6 tracked versions. It was first listed on Jun 13, 2026 and most recently updated on Sep 22, 2026.

STANDING

#9,734of 132,046 tracked serversTop 10%

Ranks ahead of 122,312 of 132,046 servers on MCP Toplist.

CONNECT

Use attack-surface-mcp-server

No setupRuns out of the box

No credentials or required configuration declared — add it to your MCP client and go.

npm package

claude mcp add attack-surface-mcp-server -e "SHODAN_API_KEY=<your SHODAN_API_KEY>" -e "CERTSPOTTER_API_KEY=<your CERTSPOTTER_API_KEY>" -e "ATTACKSURFACE_DEFAULT_RESOLVERS=<your ATTACKSURFACE_DEFAULT_RESOLVERS>" -e "ATTACKSURFACE_HTTP_USER_AGENT=<your ATTACKSURFACE_HTTP_USER_AGENT>" -e "ATTACKSURFACE_MAX_SUBDOMAINS=<your ATTACKSURFACE_MAX_SUBDOMAINS>" -e "ATTACKSURFACE_RDAP_BOOTSTRAP_URL=<your ATTACKSURFACE_RDAP_BOOTSTRAP_URL>" -e "ATTACKSURFACE_ALLOW_PRIVATE_TARGETS=<your ATTACKSURFACE_ALLOW_PRIVATE_TARGETS>" -e "MCP_LOG_LEVEL=<your MCP_LOG_LEVEL>" -- npx -y @cyanheads/attack-surface-mcp-server run start:stdio

Replace each placeholder with your own value before saving.

npm package

claude mcp add attack-surface-mcp-server -e "MCP_HTTP_HOST=<your MCP_HTTP_HOST>" -e "MCP_HTTP_PORT=<your MCP_HTTP_PORT>" -e "MCP_HTTP_ENDPOINT_PATH=<your MCP_HTTP_ENDPOINT_PATH>" -e "MCP_AUTH_MODE=<your MCP_AUTH_MODE>" -e "MCP_LOG_LEVEL=<your MCP_LOG_LEVEL>" -- npx -y @cyanheads/attack-surface-mcp-server run start:http

Replace each placeholder with your own value before saving.

npm package

[mcp_servers.attack-surface-mcp-server]
command = "npx"
args = ["-y", "@cyanheads/attack-surface-mcp-server", "run", "start:stdio"]

[mcp_servers.attack-surface-mcp-server.env]
SHODAN_API_KEY = "<your SHODAN_API_KEY>"
CERTSPOTTER_API_KEY = "<your CERTSPOTTER_API_KEY>"
ATTACKSURFACE_DEFAULT_RESOLVERS = "<your ATTACKSURFACE_DEFAULT_RESOLVERS>"
ATTACKSURFACE_HTTP_USER_AGENT = "<your ATTACKSURFACE_HTTP_USER_AGENT>"
ATTACKSURFACE_MAX_SUBDOMAINS = "<your ATTACKSURFACE_MAX_SUBDOMAINS>"
ATTACKSURFACE_RDAP_BOOTSTRAP_URL = "<your ATTACKSURFACE_RDAP_BOOTSTRAP_URL>"
ATTACKSURFACE_ALLOW_PRIVATE_TARGETS = "<your ATTACKSURFACE_ALLOW_PRIVATE_TARGETS>"
MCP_LOG_LEVEL = "<your MCP_LOG_LEVEL>"

Add to ~/.codex/config.toml. Replace each placeholder with your own value before saving.

npm package

[mcp_servers.attack-surface-mcp-server]
command = "npx"
args = ["-y", "@cyanheads/attack-surface-mcp-server", "run", "start:http"]

[mcp_servers.attack-surface-mcp-server.env]
MCP_HTTP_HOST = "<your MCP_HTTP_HOST>"
MCP_HTTP_PORT = "<your MCP_HTTP_PORT>"
MCP_HTTP_ENDPOINT_PATH = "<your MCP_HTTP_ENDPOINT_PATH>"
MCP_AUTH_MODE = "<your MCP_AUTH_MODE>"
MCP_LOG_LEVEL = "<your MCP_LOG_LEVEL>"

Add to ~/.codex/config.toml. Replace each placeholder with your own value before saving.

npm package

{
  "mcpServers": {
    "attack-surface-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/attack-surface-mcp-server",
        "run",
        "start:stdio"
      ],
      "env": {
        "SHODAN_API_KEY": "<your SHODAN_API_KEY>",
        "CERTSPOTTER_API_KEY": "<your CERTSPOTTER_API_KEY>",
        "ATTACKSURFACE_DEFAULT_RESOLVERS": "<your ATTACKSURFACE_DEFAULT_RESOLVERS>",
        "ATTACKSURFACE_HTTP_USER_AGENT": "<your ATTACKSURFACE_HTTP_USER_AGENT>",
        "ATTACKSURFACE_MAX_SUBDOMAINS": "<your ATTACKSURFACE_MAX_SUBDOMAINS>",
        "ATTACKSURFACE_RDAP_BOOTSTRAP_URL": "<your ATTACKSURFACE_RDAP_BOOTSTRAP_URL>",
        "ATTACKSURFACE_ALLOW_PRIVATE_TARGETS": "<your ATTACKSURFACE_ALLOW_PRIVATE_TARGETS>",
        "MCP_LOG_LEVEL": "<your MCP_LOG_LEVEL>"
      }
    }
  }
}

Add to claude_desktop_config.json (Settings → Developer → Edit Config). Replace each placeholder with your own value before saving.

npm package

{
  "mcpServers": {
    "attack-surface-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/attack-surface-mcp-server",
        "run",
        "start:http"
      ],
      "env": {
        "MCP_HTTP_HOST": "<your MCP_HTTP_HOST>",
        "MCP_HTTP_PORT": "<your MCP_HTTP_PORT>",
        "MCP_HTTP_ENDPOINT_PATH": "<your MCP_HTTP_ENDPOINT_PATH>",
        "MCP_AUTH_MODE": "<your MCP_AUTH_MODE>",
        "MCP_LOG_LEVEL": "<your MCP_LOG_LEVEL>"
      }
    }
  }
}

Add to claude_desktop_config.json (Settings → Developer → Edit Config). Replace each placeholder with your own value before saving.

npm package

{
  "mcpServers": {
    "attack-surface-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/attack-surface-mcp-server",
        "run",
        "start:stdio"
      ],
      "env": {
        "SHODAN_API_KEY": "<your SHODAN_API_KEY>",
        "CERTSPOTTER_API_KEY": "<your CERTSPOTTER_API_KEY>",
        "ATTACKSURFACE_DEFAULT_RESOLVERS": "<your ATTACKSURFACE_DEFAULT_RESOLVERS>",
        "ATTACKSURFACE_HTTP_USER_AGENT": "<your ATTACKSURFACE_HTTP_USER_AGENT>",
        "ATTACKSURFACE_MAX_SUBDOMAINS": "<your ATTACKSURFACE_MAX_SUBDOMAINS>",
        "ATTACKSURFACE_RDAP_BOOTSTRAP_URL": "<your ATTACKSURFACE_RDAP_BOOTSTRAP_URL>",
        "ATTACKSURFACE_ALLOW_PRIVATE_TARGETS": "<your ATTACKSURFACE_ALLOW_PRIVATE_TARGETS>",
        "MCP_LOG_LEVEL": "<your MCP_LOG_LEVEL>"
      }
    }
  }
}

Add to ~/.cursor/mcp.json (global) or .cursor/mcp.json (per project). Replace each placeholder with your own value before saving.

npm package

{
  "mcpServers": {
    "attack-surface-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/attack-surface-mcp-server",
        "run",
        "start:http"
      ],
      "env": {
        "MCP_HTTP_HOST": "<your MCP_HTTP_HOST>",
        "MCP_HTTP_PORT": "<your MCP_HTTP_PORT>",
        "MCP_HTTP_ENDPOINT_PATH": "<your MCP_HTTP_ENDPOINT_PATH>",
        "MCP_AUTH_MODE": "<your MCP_AUTH_MODE>",
        "MCP_LOG_LEVEL": "<your MCP_LOG_LEVEL>"
      }
    }
  }
}

Add to ~/.cursor/mcp.json (global) or .cursor/mcp.json (per project). Replace each placeholder with your own value before saving.

npm package

{
  "servers": {
    "attack-surface-mcp-server": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/attack-surface-mcp-server",
        "run",
        "start:stdio"
      ],
      "env": {
        "SHODAN_API_KEY": "<your SHODAN_API_KEY>",
        "CERTSPOTTER_API_KEY": "<your CERTSPOTTER_API_KEY>",
        "ATTACKSURFACE_DEFAULT_RESOLVERS": "<your ATTACKSURFACE_DEFAULT_RESOLVERS>",
        "ATTACKSURFACE_HTTP_USER_AGENT": "<your ATTACKSURFACE_HTTP_USER_AGENT>",
        "ATTACKSURFACE_MAX_SUBDOMAINS": "<your ATTACKSURFACE_MAX_SUBDOMAINS>",
        "ATTACKSURFACE_RDAP_BOOTSTRAP_URL": "<your ATTACKSURFACE_RDAP_BOOTSTRAP_URL>",
        "ATTACKSURFACE_ALLOW_PRIVATE_TARGETS": "<your ATTACKSURFACE_ALLOW_PRIVATE_TARGETS>",
        "MCP_LOG_LEVEL": "<your MCP_LOG_LEVEL>"
      }
    }
  }
}

Save as .vscode/mcp.json in your workspace. Replace each placeholder with your own value before saving.

npm package

{
  "servers": {
    "attack-surface-mcp-server": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/attack-surface-mcp-server",
        "run",
        "start:http"
      ],
      "env": {
        "MCP_HTTP_HOST": "<your MCP_HTTP_HOST>",
        "MCP_HTTP_PORT": "<your MCP_HTTP_PORT>",
        "MCP_HTTP_ENDPOINT_PATH": "<your MCP_HTTP_ENDPOINT_PATH>",
        "MCP_AUTH_MODE": "<your MCP_AUTH_MODE>",
        "MCP_LOG_LEVEL": "<your MCP_LOG_LEVEL>"
      }
    }
  }
}

Save as .vscode/mcp.json in your workspace. Replace each placeholder with your own value before saving.

npm package

{
  "mcpServers": {
    "attack-surface-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/attack-surface-mcp-server",
        "run",
        "start:stdio"
      ],
      "env": {
        "SHODAN_API_KEY": "<your SHODAN_API_KEY>",
        "CERTSPOTTER_API_KEY": "<your CERTSPOTTER_API_KEY>",
        "ATTACKSURFACE_DEFAULT_RESOLVERS": "<your ATTACKSURFACE_DEFAULT_RESOLVERS>",
        "ATTACKSURFACE_HTTP_USER_AGENT": "<your ATTACKSURFACE_HTTP_USER_AGENT>",
        "ATTACKSURFACE_MAX_SUBDOMAINS": "<your ATTACKSURFACE_MAX_SUBDOMAINS>",
        "ATTACKSURFACE_RDAP_BOOTSTRAP_URL": "<your ATTACKSURFACE_RDAP_BOOTSTRAP_URL>",
        "ATTACKSURFACE_ALLOW_PRIVATE_TARGETS": "<your ATTACKSURFACE_ALLOW_PRIVATE_TARGETS>",
        "MCP_LOG_LEVEL": "<your MCP_LOG_LEVEL>"
      }
    }
  }
}

Add to ~/.codeium/windsurf/mcp_config.json. Replace each placeholder with your own value before saving.

npm package

{
  "mcpServers": {
    "attack-surface-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/attack-surface-mcp-server",
        "run",
        "start:http"
      ],
      "env": {
        "MCP_HTTP_HOST": "<your MCP_HTTP_HOST>",
        "MCP_HTTP_PORT": "<your MCP_HTTP_PORT>",
        "MCP_HTTP_ENDPOINT_PATH": "<your MCP_HTTP_ENDPOINT_PATH>",
        "MCP_AUTH_MODE": "<your MCP_AUTH_MODE>",
        "MCP_LOG_LEVEL": "<your MCP_LOG_LEVEL>"
      }
    }
  }
}

Add to ~/.codeium/windsurf/mcp_config.json. Replace each placeholder with your own value before saving.

npm package

{
  "mcpServers": {
    "attack-surface-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/attack-surface-mcp-server",
        "run",
        "start:stdio"
      ],
      "env": {
        "SHODAN_API_KEY": "<your SHODAN_API_KEY>",
        "CERTSPOTTER_API_KEY": "<your CERTSPOTTER_API_KEY>",
        "ATTACKSURFACE_DEFAULT_RESOLVERS": "<your ATTACKSURFACE_DEFAULT_RESOLVERS>",
        "ATTACKSURFACE_HTTP_USER_AGENT": "<your ATTACKSURFACE_HTTP_USER_AGENT>",
        "ATTACKSURFACE_MAX_SUBDOMAINS": "<your ATTACKSURFACE_MAX_SUBDOMAINS>",
        "ATTACKSURFACE_RDAP_BOOTSTRAP_URL": "<your ATTACKSURFACE_RDAP_BOOTSTRAP_URL>",
        "ATTACKSURFACE_ALLOW_PRIVATE_TARGETS": "<your ATTACKSURFACE_ALLOW_PRIVATE_TARGETS>",
        "MCP_LOG_LEVEL": "<your MCP_LOG_LEVEL>"
      }
    }
  }
}

Replace each placeholder with your own value before saving.

npm package

{
  "mcpServers": {
    "attack-surface-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/attack-surface-mcp-server",
        "run",
        "start:http"
      ],
      "env": {
        "MCP_HTTP_HOST": "<your MCP_HTTP_HOST>",
        "MCP_HTTP_PORT": "<your MCP_HTTP_PORT>",
        "MCP_HTTP_ENDPOINT_PATH": "<your MCP_HTTP_ENDPOINT_PATH>",
        "MCP_AUTH_MODE": "<your MCP_AUTH_MODE>",
        "MCP_LOG_LEVEL": "<your MCP_LOG_LEVEL>"
      }
    }
  }
}

Replace each placeholder with your own value before saving.

BADGE

Show your rank

Maintain this server? Add the live rank badge to your README — it updates automatically as the leaderboard changes.

Markdown

[![MCP Toplist](https://mcptoplist.com/badge/io.github.cyanheads%2Fattack-surface-mcp-server.svg)](https://mcptoplist.com/server/io.github.cyanheads%2Fattack-surface-mcp-server)

HTML

<a href="https://mcptoplist.com/server/io.github.cyanheads%2Fattack-surface-mcp-server"><img src="https://mcptoplist.com/badge/io.github.cyanheads%2Fattack-surface-mcp-server.svg" alt="MCP Toplist: Top 10% of 132,046" /></a>

Variants: append ?metric=score or ?metric=stars to the image URL.

REGISTRIES

Listed on 4 registries

ORGANIZATION

cyanheads

Organization

cyanheads

Servers in org

135

Versions across org

2337

Other servers by cyanheads

View all cyanheads servers →

VERSIONS

Available versions (6)

Version	Published
0.2.2	Sep 22, 2026
0.2.1	Aug 30, 2026
0.2.0	Aug 21, 2026
0.1.2	Aug 21, 2026
0.1.1	Jun 14, 2026
0.1.0	Jun 13, 2026

FAQ

Frequently asked questions

Who maintains attack-surface-mcp-server?: attack-surface-mcp-server is maintained by cyanheads, which publishes 135 MCP servers (2337 total versions) tracked on MCP Toplist.
Is attack-surface-mcp-server listed on the Official MCP Registry?: Yes — attack-surface-mcp-server is listed on the Official MCP Registry, alongside Glama, PulseMCP and Smithery.
How many versions does attack-surface-mcp-server have?: MCP Toplist tracks 6 versions of attack-surface-mcp-server, most recently published on Sep 22, 2026.
Where can I find the source code for attack-surface-mcp-server?: The source code for attack-surface-mcp-server is hosted at github.com/cyanheads/attack-surface-mcp-server.

Used in projects

Do you run this server?

Add to a project

Community projects list the MCP servers behind real agents and apps. Publish yours and this page will link to it.

EXPLORE

All MCP Servers Official MCP Servers GitHub MCP Servers Best MCP Servers Most Active MCP Servers New MCP Servers Best New MCP Servers