io.github.cyanheads/attack-surface-mcp-server

Resolve and enumerate DNS records (A, AAAA, CNAME, MX, NS, TXT, CAA) for one or more hosts across multiple public resolvers, with optional reverse DNS (PTR) for resolved IPs. Reports per-resolver values so propagation gaps and split-horizon DNS are visible. Each host is checked against an SSRF guard; one failing host degrades to a per-host error rather than failing the whole call.

Synthesize findings gathered so far into a prioritized defensive review plan plus pre-filled follow-up tool calls. Given live hosts, TLS/cert state, missing security headers, detected software versions, and open ports, returns markdown guidance (what to remediate first, which certs are expiring, which versions warrant a CVE check) and concrete next calls — including chaining detected software to an external NVD or OSV vulnerability server. Read-only and offline: reasons only over the state passed in, makes no external calls, and never produces an exploitation plan. For assets you own or are authorized to assess.

Discover subdomains passively from Certificate Transparency logs, then resolve each candidate via DNS to mark which are live. crt.sh is the primary source, Certspotter the fallback (crt.sh is frequently overloaded), and the apex domain's own TLS certificate SAN list a third always-available source. Every discovered name carries its source provenance. No DNS brute-forcing — this reads public logs, it does not probe the target's resolvers. Use only on domains you own or are authorized to assess.

Inspect TLS/SSL posture for one or more hosts via a real read-only handshake: negotiated protocol and cipher, the full certificate chain, SANs, validity window, days-to-expiry, issuer, and validation status. Invalid, expired, and self-signed certificates are inspected and reported rather than failing — surfacing posture problems is the point. One handshake per host; no application data is sent. SSRF-guarded; per-host failures degrade to a per-host error.

Flagship workflow: map a domain's external attack surface end to end. Discovers subdomains from Certificate Transparency logs, resolves each to find live hosts, and (at standard+ depth) characterizes each live host's DNS records, TLS posture, and HTTP security headers and technology stack, plus optional RDAP/WHOIS registration. At thorough depth with a Shodan key it adds per-IP Shodan enrichment. Returns a structured surface map and a defensive assessment of observable facts (expiring certs, missing security headers, weak TLS) — never an exploitation plan. All work is passive (public records and the target's own published responses) and SSRF-guarded. Assess only assets you own or are explicitly authorized to test.

Passively probe a single URL with one HTTP(S) GET, following redirects. Returns the final status, the full redirect chain, response headers, a security-header audit (HSTS, CSP, X-Frame-Options, cookie Secure/HttpOnly/SameSite flags, and CORS origin-reflection), and an evidence-bound technology fingerprint (server, framework, CDN, WAF, CMS) drawn from headers and lightweight body markers. Strictly one request per host — no path traversal, parameter injection, or multi-method probing. Each redirect hop is validated against an SSRF guard. Use only on assets you own or are authorized to assess.

Look up registration and ownership via RDAP (structured JSON), with a WHOIS fallback for TLDs without RDAP or when RDAP is unresponsive. For a domain it returns registrar, status codes, creation/expiry/updated events, nameservers, and DNSSEC; for an IP or CIDR it returns the netblock name, allocation CIDRs, origin ASN, and country. Registry data is frequently redacted or sparse — absent fields are reported as unknown, never inferred. Use only on assets you own or are authorized to assess.

Get infrastructure intelligence for a single IP (open ports, service banners, software versions, hostnames, ASN, geo) via Shodan\'s free host endpoint, or run a faceted internet-wide search (mode: "search") that consumes paid Shodan query credits. Requires SHODAN_API_KEY; without it this tool returns a typed source_unavailable error while the rest of the server keeps working. Shodan data reflects Shodan\'s last scan, not a live port state. Use only on assets you own or are authorized to assess.