How do I install Attack Surface?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Attack Surface need an API key?

The publisher lists these environment variables: SHODAN_API_KEY, CERTSPOTTER_API_KEY, ATTACKSURFACE_DEFAULT_RESOLVERS, ATTACKSURFACE_HTTP_USER_AGENT, ATTACKSURFACE_MAX_SUBDOMAINS, ATTACKSURFACE_RDAP_BOOTSTRAP_URL, ATTACKSURFACE_ALLOW_PRIVATE_TARGETS, MCP_LOG_LEVEL, MCP_TRANSPORT_TYPE, MCP_HTTP_HOST, MCP_HTTP_PORT, MCP_HTTP_ENDPOINT_PATH, MCP_AUTH_MODE.

What transport does Attack Surface use?

Attack Surface runs locally over stdio.

When was Attack Surface last checked?

Last checked 2026-11-11. Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.

Attack Surface MCP server

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Local command

npx -y @cyanheads/[email protected]

Credentials from the publisher

SHODAN_API_KEY — Optional Shodan API key. Enables attacksurface_lookup_host; absent → that one tool returns source_unavailable and the rest of the server works.
CERTSPOTTER_API_KEY — Optional Certspotter API key. Raises CT-fallback rate limits; absent → free unauthenticated tier.
ATTACKSURFACE_DEFAULT_RESOLVERS — Comma-separated default DNS resolver IPs for attacksurface_resolve_dns.
ATTACKSURFACE_HTTP_USER_AGENT — Default User-Agent for attacksurface_probe_http (overridable per call).
ATTACKSURFACE_MAX_SUBDOMAINS — Map/snapshot resolution cap; enumeration also caps each page at 50 candidates.
ATTACKSURFACE_RDAP_BOOTSTRAP_URL — RDAP bootstrap base URL; override for a private/mirrored RDAP.
ATTACKSURFACE_ALLOW_PRIVATE_TARGETS — Set true to permit non-public target ranges for trusted internal-network assessment; URL and HTTP(S) scheme checks remain enforced.
MCP_LOG_LEVEL — Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1SHODAN_API_KEY=<secret> CERTSPOTTER_API_KEY=<secret> ATTACKSURFACE_DEFAULT_RESOLVERS=<value> ATTACKSURFACE_HTTP_USER_AGENT=<value> ATTACKSURFACE_MAX_SUBDOMAINS=<value> ATTACKSURFACE_RDAP_BOOTSTRAP_URL=<value> ATTACKSURFACE_ALLOW_PRIVATE_TARGETS=<value> MCP_LOG_LEVEL=<value> claude mcp add io.github.cyanheads-attack-surface-mcp-server -- npx -y @cyanheads/attack-surface-mcp-server@0.5.0

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.cyanheads-attack-surface-mcp-server": {4      "command": "npx",5      "args": [6        "-y",7        "@cyanheads/[email protected]"8      ],9      "env": {10        "SHODAN_API_KEY": "<secret>",11        "CERTSPOTTER_API_KEY": "<secret>",12        "ATTACKSURFACE_DEFAULT_RESOLVERS": "<value>",13        "ATTACKSURFACE_HTTP_USER_AGENT": "<value>",14        "ATTACKSURFACE_MAX_SUBDOMAINS": "<value>",15        "ATTACKSURFACE_RDAP_BOOTSTRAP_URL": "<value>",16        "ATTACKSURFACE_ALLOW_PRIVATE_TARGETS": "<value>",17        "MCP_LOG_LEVEL": "<value>"18      }19    }20  }21}

claude_desktop_config.json

Local · npmPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Attack Surface

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install Attack Surface?

Does Attack Surface need an API key?

What transport does Attack Surface use?

When was Attack Surface last checked?

Documentation