Attack Surface MCP Server: Install & Setup

Install Attack Surface in Claude Code

Claude Code

claude mcp add attack-surface -- npx -y @cyanheads/attack-surface-mcp-server

mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)

{
  "mcpServers": {
    "attack-surface": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/attack-surface-mcp-server"
      ]
    }
  }
}

Frequently asked questions

What does the Attack Surface MCP server do?

Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.

Is the Attack Surface MCP server free?

Yes, most likely. Open source and no paid account or API key is mentioned in the listing. Check the provider for current pricing.

Does Attack Surface run locally or remotely?

Local. Runs on your machine (stdio). You install it with npx, uvx, Docker or from source.

How do I add Attack Surface to Claude Code?

Run: claude mcp add attack-surface -- npx -y @cyanheads/attack-surface-mcp-server

More location & travel MCP servers

View all

Bluelink

mattoddie/bluelink-mcp

Check your Hyundai or Kia's charge, range, locks and location, pre-heat it and manage charging.

LocalAccount needed

tickadoo Experiences and Events

tickadoo/tickadoo-mcp

Discover and book theatre, shows, events, tours and experiences worldwide via tickadoo, with real-time prices, availability and booking links.

RemoteAccount neededTypeScript

DevCDP

2149

Dayananda-D/DevCDP

Chrome DevTools for AI assistants: console, network, DOM, source maps, breakpoints, live variables.

LocalFree

DaedalMap Administrative Boundaries (loc_id to polygon)

xyver/daedal-map

Geographic data packs for disasters, FX rates and global indicators, with new packs added weekly.

RemoteAccount neededPython

Flytoday

sepehr071/flytoday-mcp

Unofficial read-only Flytoday: Iranian and international flights, hotels, villas, trains, buses.

LocalFree

Aviation

Perufitlife/aviation-mcp

Aviation data: decoded METAR weather by ICAO code, airport and aircraft specs, an aviation glossary and FAA-style practice questions.

RemoteAccount neededTypeScript