Attack Surface MCP Server runs on your own machine — the client starts it, so there is no endpoint to ping. 410 installs a week from npm. Last commit 30 Oct 2026.
Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.
Nothing serious here today
Today is the operative word: we check Attack Surface MCP Server every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add attack-surface-mcp-server -- npx -y @cyanheads/attack-surface-mcp-server{
"mcpServers": {
"attack-surface-mcp-server": {
"command": "npx",
"args": [
"-y",
"@cyanheads/attack-surface-mcp-server"
]
}
}
}[mcp_servers.attack-surface-mcp-server]
command = "npx"
args = ["-y", "@cyanheads/attack-surface-mcp-server"]{
"mcpServers": {
"attack-surface-mcp-server": {
"command": "npx",
"args": [
"-y",
"@cyanheads/attack-surface-mcp-server"
]
}
}
}{
"servers": {
"attack-surface-mcp-server": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@cyanheads/attack-surface-mcp-server"
]
}
}
}Optional settings from the registry entry, left out of the block above:
MCP_TRANSPORT_TYPE (Selects the HTTP transport), MCP_HTTP_HOST (The hostname for the HTTP server), MCP_HTTP_PORT (The port to run the HTTP server on), MCP_HTTP_ENDPOINT_PATH (The endpoint path for the MCP server), MCP_AUTH_MODE (Authentication mode to use: 'none', 'jwt', or 'oauth'), MCP_LOG_LEVEL (Sets the minimum log level for output (e.g., 'debug', 'info', 'warn')).
Alternatives to Attack Surface MCP Server
same job, measured the same wayExternal checks of TLS, HTTP, email domain, DNS, ports, blocklists and domain expiry
Pay-per-call x402 DNS, WHOIS/RDAP, availability, email security, SSL check, CT subdomains.
Discover mobile app attack surfaces via BeVigil OSINT — hosts, subdomains, URLs, and more.
Passive OSINT and security recon: DNS, TLS, email posture, IP reputation, CVE/KEV, CT logs.
Free passive security scanning - check any domain's DMARC, TLS, headers, and exposures.
WHOIS/RDAP, DNS, SSL, live subdomains with IPs, and SPF/DMARC/DKIM for any domain.
DNS monitoring and domain security: live DNS, propagation, WHOIS/RDAP, SSL and look-alike domains.
Domain intelligence for agents: WHOIS, DNS, SSL/TLS, security headers, reputation, subdomains.
Attack Surface MCP Server — questions
Answers built from our own checks of this server.