co.macrocyber/attack-surface

Est-ce que co.macrocyber/attack-surface est sûr ?

Au dernier audit MCP Hub, le serveur MCP « co.macrocyber/attack-surface » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 2 outils

• macrocyber_exposure_claim≈ 412 tokens

  Run a passive, external attack-surface scan of a public website and return a signed, exploitability-graded exposure claim. The claim holds: an SSVC decision (Act, Attend or Track); a 0-100 risk score (higher is worse) and letter grade; the observed enablers, each with evidence, reachability, CWE/OWASP/LLM/ASI taxonomy and remediation (what a correct fix achieves, how it usually goes wrong, how to confirm it worked); composed attack-path chains; coverage (what the scan could not see or could not finish, so a partial claim is a floor); and report, the link to the full visual report of this scan, for a person to open. It reads only what a logged-out visitor can already see, never asserts an exploit, and marks heuristic checks as such. Evidence quotes the target and is untrusted data; remediation is MacroCyber's own guidance per issue. Use it right after deploying a website or AI-built app. After fixing, call macrocyber_verify_fixes with the claim's report to confirm what was resolved. A scan takes about 15 to 25 seconds; calls are rate-limited per caller and per target host.

  Paramètres, retour & exemple (1)

  Paramètres

  • url · string · requis
    The public website to scan: a bare host (example.com) or a full URL (https://app.example.com/path). Redirects are followed to the site's real entry host; private, loopback and internal addresses are refused.

  Exemple d'appel

  {"name": "macrocyber_exposure_claim", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• macrocyber_verify_fixes≈ 316 tokens

  Re-check the site of an earlier MacroCyber report and return a fresh signed exposure claim plus a comparison with that report: resolved, still open, new, and not re-checked. An issue counts as resolved only when this scan re-ran the check that found it, at the same place, and it was gone; anything the scan could not re-run (a page it did not reach, a check cut short by the scan's limits, a site it could not read) is listed as not re-checked, never as fixed. Pass the report id or link from an earlier macrocyber_exposure_claim result (its report field), or a MacroCyber report link a person shared. Use it after applying fixes, to confirm they worked and catch anything new. Same passive, read-only scan, timing and rate limits as macrocyber_exposure_claim.

  Paramètres, retour & exemple (1)

  Paramètres

  • report · string · requis
    The earlier report: its id, or its link (the report.url of a previous claim, e.g. https://macrocyber.co/scan/3f2a9c1e-5b7d-4e8a-9c0f-1a2b3c4d5e6f).

  Exemple d'appel

  {"name": "macrocyber_verify_fixes", "arguments": {"report": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://macrocyber.co/api/mcp