io.github.cyanheads/attack-surface-mcp-server

Est-ce que io.github.cyanheads/attack-surface-mcp-server est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.cyanheads/attack-surface-mcp-server » est classé « Vérifié ». Aucun comportement malveillant détecté au test comportemental. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Versions auditées & empreintes

Vérifiez la version que vous utilisez : son empreinte doit correspondre à celle listée ici — sinon vous n'utilisez pas la version auditée.

⚠ La dernière version publiée (0.4.0) n'a pas encore été auditée. Un nouveau pentest est programmé ; les verdicts ci-dessous portent sur les versions listées.

Vous utilisez ce serveur ? Suivez-le (créez un compte) pour être alerté dès qu'une nouvelle version paraît ou que le verdict change.

Les 8 outils

• attacksurface_map_domain≈ 359 tokens

  Flagship workflow: map a domain's external attack surface end to end. Discovers subdomains from Certificate Transparency logs, resolves each to find live hosts, and (at standard+ depth) characterizes each live host's DNS records, TLS posture, and HTTP security headers and technology stack, plus optional RDAP/WHOIS registration. At thorough depth with a Shodan key it adds per-IP Shodan enrichment. Returns a structured surface map and a defensive assessment of observable facts (expiring certs, missing security headers, weak TLS) — never an exploitation plan. All work is passive (public records and the target's own published responses) and SSRF-guarded. Assess only assets you own or are explicitly authorized to test.

  Paramètres, retour & exemple (3)

  Paramètres

  • depth · string · optionnel · quick | standard | thorough
    "quick" = subdomains + liveness only; "standard" = + DNS/TLS/HTTP posture; "thorough" = + Shodan enrichment (when keyed).
  • domain · string · requis
    Apex domain to map (e.g. "example.com").
  • includeRegistration · boolean · optionnel
    When true (and depth is standard+), include RDAP/WHOIS registration for the apex.

  Exemple d'appel

  {"name": "attacksurface_map_domain", "arguments": {"domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• attacksurface_enumerate_subdomains≈ 294 tokens

  Discover subdomains passively from Certificate Transparency logs, then resolve each candidate via DNS to mark which are live. crt.sh is the primary source, Certspotter the fallback (crt.sh is frequently overloaded), and the apex domain's own TLS certificate SAN list a third always-available source. Every discovered name carries its source provenance. No DNS brute-forcing — this reads public logs, it does not probe the target's resolvers. Use only on domains you own or are authorized to assess.

  Paramètres, retour & exemple (3)

  Paramètres

  • domain · string · requis
    Apex domain to enumerate (e.g. "example.com").
  • sources · array · optionnel
    CT sources to query. Omit for all of crt.sh, certspotter, tls-san.
  • includeUnresolved · boolean · optionnel
    When true, include names that did not resolve. When false, return only live hosts.

  Exemple d'appel

  {"name": "attacksurface_enumerate_subdomains", "arguments": {"domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• attacksurface_resolve_dns≈ 357 tokens

  Resolve and enumerate DNS records (A, AAAA, CNAME, MX, NS, TXT, CAA) for one or more hosts across multiple public resolvers, with optional reverse DNS (PTR) for resolved IPs. Reports per-resolver values so propagation gaps and split-horizon DNS are visible. Each host is checked against an SSRF guard; one failing host degrades to a per-host error rather than failing the whole call.

  Paramètres, retour & exemple (4)

  Paramètres

  • hosts · array · requis
    Hosts to resolve (1–50).
  • reverse · boolean · optionnel
    When true, also perform reverse DNS (PTR) on resolved A/AAAA addresses.
  • resolvers · array · optionnel
    Resolver IPs to query. Omit to use the server defaults (8.8.8.8, 1.1.1.1, 9.9.9.9). Private/loopback resolver IPs are rejected.
  • recordTypes · array · optionnel
    Record types to query. Omit for all of A/AAAA/CNAME/MX/NS/TXT/CAA.

  Exemple d'appel

  {"name": "attacksurface_resolve_dns", "arguments": {"hosts": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• attacksurface_inspect_tls≈ 301 tokens

  Inspect TLS/SSL posture for one or more hosts via a real read-only handshake: negotiated protocol and cipher, leaf certificate and chain depth, SANs, validity window, days-to-expiry, issuer, and validation status. Invalid, expired, and self-signed certificates are inspected and reported. Unparseable validity bounds retain their raw values and add findings; an unknown expiry returns null days-to-expiry. One handshake per host; no application data is sent. SSRF-guarded; per-host failures degrade to a per-host error.

  Paramètres, retour & exemple (3)

  Paramètres

  • port · integer · optionnel
    TLS port to connect to.
  • hosts · array · requis
    Hosts to inspect (1–50).
  • timeoutMs · integer · optionnel
    Per-host handshake timeout in milliseconds.

  Exemple d'appel

  {"name": "attacksurface_inspect_tls", "arguments": {"hosts": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• attacksurface_probe_http≈ 322 tokens

  Passively probe a single URL with one HTTP(S) GET, following redirects. Returns the final status, the full redirect chain, response headers, a security-header audit (HSTS, CSP, X-Frame-Options, cookie Secure/HttpOnly/SameSite flags, and CORS origin-reflection), and an evidence-bound technology fingerprint (server, framework, CDN, WAF, CMS) drawn from headers and lightweight body markers. Strictly one request per host — no path traversal, parameter injection, or multi-method probing. Each redirect hop is validated against an SSRF guard. Use only on assets you own or are authorized to assess.

  Paramètres, retour & exemple (3)

  Paramètres

  • url · string · requis
    Absolute http:// or https:// URL to probe (e.g. "https://example.com"). Must be an http(s) URL; other schemes and private/loopback targets are rejected.
  • timeoutMs · integer · optionnel
    Per-request timeout in milliseconds.
  • userAgent · string · optionnel
    Override the User-Agent header. Omit to use the server default.

  Exemple d'appel

  {"name": "attacksurface_probe_http", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• attacksurface_lookup_registration≈ 259 tokens

  Look up registration and ownership via RDAP (structured JSON), with a WHOIS fallback for TLDs without RDAP or when RDAP is unresponsive. For a domain it returns registrar, status codes, creation/expiry/updated events, nameservers, and DNSSEC; for an IP or CIDR it returns the netblock name, allocation CIDRs, origin ASN, and country. Registry data is frequently redacted or sparse — absent fields are reported as unknown, never inferred. Use only on assets you own or are authorized to assess.

  Paramètres, retour & exemple (2)

  Paramètres

  • type · string · optionnel · auto | domain | ip
    Force the target interpretation, or "auto" to detect domain vs IP/CIDR.
  • target · string · requis
    A domain (e.g. "example.com"), an IP (e.g. "8.8.8.8"), or a CIDR (e.g. "8.8.8.0/24").

  Exemple d'appel

  {"name": "attacksurface_lookup_registration", "arguments": {"target": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• attacksurface_lookup_host≈ 303 tokens

  Get infrastructure intelligence for a single IP (open ports, service banners, software versions, hostnames, ASN, geo) via Shodan, or run a faceted internet-wide search (mode: "search") that may consume Shodan query credits. Requires SHODAN_API_KEY; without it this tool returns a typed source_unavailable error while the rest of the server keeps working. Shodan data reflects Shodan's last scan, not a live port state. Use only on assets you own or are authorized to assess.

  Paramètres, retour & exemple (3)

  Paramètres

  • mode · string · optionnel · host | search
    "host" = single-IP lookup; "search" = faceted query (may consume query credits).
  • facets · array · optionnel
    Facet fields for mode "search" (e.g. ["port", "org", "country"]).
  • target · string · requis
    For mode "host": an IP address. For mode "search": a Shodan search query (e.g. "org:\"Example Inc\" port:443").

  Exemple d'appel

  {"name": "attacksurface_lookup_host", "arguments": {"target": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• attacksurface_recon_guidance≈ 692 tokens

  Synthesize findings gathered so far into a prioritized defensive review plan plus pre-filled follow-up tool calls. Given live hosts, TLS/cert state, missing security headers, detected software versions, and open ports, returns markdown guidance (what to remediate first, which certs are expiring, which versions warrant a CVE check) and concrete next calls — including chaining detected software to an external NVD or OSV vulnerability server. Read-only and offline: reasons only over the state passed in, makes no external calls, and never produces an exploitation plan. For assets you own or are authorized to assess.

  Paramètres, retour & exemple (2)

  Paramètres

  • topic · string · optionnel · triage | posture | coverage
    "triage" = prioritize what to fix first; "posture" = TLS/header hardening; "coverage" = gaps to fill next.
  • findings · object · requis
    Findings gathered so far from prior attack-surface tool calls.

  Exemple d'appel

  {"name": "attacksurface_recon_guidance", "arguments": {"findings": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

Badge pour votre README

Ce serveur a passé le pentest comportemental. Le badge porte son nom et renvoie à cette fiche — la preuve, c'est la fiche (verdict live qu'on contrôle), pas l'image.

[![Vérifié par MCP Hub](https://dokore.fr/badge/io.github.cyanheads--attack-surface-mcp-server.svg)](https://dokore.fr/serveur/io.github.cyanheads--attack-surface-mcp-server)

<a href="https://dokore.fr/serveur/io.github.cyanheads--attack-surface-mcp-server"><img src="https://dokore.fr/badge/io.github.cyanheads--attack-surface-mcp-server.svg" alt="Vérifié par MCP Hub" height="20"></a>

Réévalué en continu : si le comportement change, le verdict tombe et le badge disparaît. Un badge qui ne pointe pas vers une fiche dokore.fr ne prouve rien. Comment ça marche

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

@cyanheads/attack-surface-mcp-server@0.4.0