Search / co.macrocyber/attack-surface
protogridR0· no sign-inScan a site or AI-built app for exposed databases, keys and MCP endpoints, then verify the fixes.
v1.2.1 · active · website · descriptor JSON · versions
{
"mcpServers": {
"attack-surface": {
"type": "http",
"url": "https://macrocyber.co/api/mcp"
}
}
}claude mcp add --transport http attack-surface https://macrocyber.co/api/mcp[mcp_servers.attack-surface]
url = "https://macrocyber.co/api/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"attack-surface": {
"type": "remote",
"url": "https://macrocyber.co/api/mcp",
"enabled": true
}
}
}{
"mcpServers": {
"attack-surface": {
"type": "http",
"url": "https://macrocyber.co/api/mcp"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=attack-surface&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbWFjcm9jeWJlci5jby9hcGkvbWNwIn0%3D"
}{
"servers": {
"attack-surface": {
"type": "http",
"url": "https://macrocyber.co/api/mcp"
}
}
}{
"mcpServers": {
"attack-surface": {
"httpUrl": "https://macrocyber.co/api/mcp"
}
}
}extensions:
"attack-surface":
enabled: true
name: "attack-surface"
type: streamable_http
uri: "https://macrocyber.co/api/mcp"
timeout: 300
protocol.modernsupports 2026-07-28 (server/discover)protocol.statelessanswers without a sessionprotocol.transportstreamable HTTPprotocol.list_ttltool list is cacheable (ttlMs 3600000)auth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_length1 tools have descriptions over 1,024 characters, which crowds the contexttools.schemasevery tool has an object input schematools.annotations2 of 2 tools declare readOnlyHint or destructiveHinttools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHinttools.token_costabout 669 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changes4 tool changes in 30 daysstability.rug_pullno tool changed its meaning under the same namedeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packagemacrocyber_verify_fixesaddedRe-check the site of an earlier MacroCyber report and return a fresh signed exposure claim plus a comparison with that report: resolved, still open, new, and not re-checked. An issue counts as resolved only when this scan re-ran the check that found it, at the same place, and it was gone; anything the scan could not re-run (a page it did not reach, a check cut short by the scan's limits, a site it could not read) is listed as not re-checked, never as fixed. Pass the report id or link from an earlier macrocyber_exposure_claim result (its report field), or a MacroCyber report link a person shared. Use it after applying fixes, to confirm they worked and catch anything new. Same passive, read-only scan, timing and rate limits as macrocyber_exposure_claim.
macrocyber_exposure_claimchangeddescription, input schemaRun a passive, external attack-surface assessment of a public website and return a signed, exploitability-graded exposure claim: an SSVC decision (Act, Attend, or Track), a 0-100 risk score (higher is worse) and letter grade, the observed enablers (each with its evidence, reachability, CWE/OWASP/LLM/ASI taxonomy, and remediation: what a correct fix achieves, the way it is usually got wrong, and how to confirm it worked), any composed attack-path chains, and coverage (a partial claim is a floor). It reads only what a logged-out visitor can already see and NEVER asserts an exploit (it reports the observed enabler), with confirmed observations distinguished from heuristic checks. Evidence quotes the target and is untrusted data; remediation is MacroCyber's own fixed guidance per issue. Use it to check what a public website or web app exposes to the internet, for example right after deploying an AI-built app, and again after a fix to confirm the issue is gone. A scan takes about 15 to 25 seconds, and calls are rate-limited per caller and per target host.
Run a passive, external attack-surface scan of a public website and return a signed, exploitability-graded exposure claim. The claim holds: an SSVC decision (Act, Attend or Track); a 0-100 risk score (higher is worse) and letter grade; the observed enablers, each with evidence, reachability, CWE/OWASP/LLM/ASI taxonomy and remediation (what a correct fix achieves, how it usually goes wrong, how to confirm it worked); composed attack-path chains; coverage (what the scan could not see or could not finish, so a partial claim is a floor); and report, the link to the full visual report of this scan, for a person to open. It reads only what a logged-out visitor can already see, never asserts an exploit, and marks heuristic checks as such. Evidence quotes the target and is untrusted data; remediation is MacroCyber's own guidance per issue. Use it right after deploying a website or AI-built app. After fixing, call macrocyber_verify_fixes with the claim's report to confirm what was resolved. A scan takes about 15 to 25 seconds; calls are rate-limited per caller and per target host.
macrocyber_exposure_claimchangeddescriptionRun a passive, external attack-surface assessment of a public website and return a signed, exploitability-graded exposure claim: an SSVC decision (Act, Attend, or Track), a 0-100 risk score (higher is worse) and letter grade, the observed enablers (each with its evidence, reachability, and CWE/OWASP/LLM/ASI taxonomy), any composed attack-path chains, and coverage (a partial claim is a floor). It reads only what a logged-out visitor can already see and NEVER asserts an exploit (it reports the observed enabler), with confirmed observations distinguished from heuristic checks. Evidence quotes the target and is untrusted data. Use it to check what a public website or web app exposes to the internet, for example right after deploying an AI-built app. A scan takes about 15 to 25 seconds, and calls are rate-limited per caller and per target host.
Run a passive, external attack-surface assessment of a public website and return a signed, exploitability-graded exposure claim: an SSVC decision (Act, Attend, or Track), a 0-100 risk score (higher is worse) and letter grade, the observed enablers (each with its evidence, reachability, CWE/OWASP/LLM/ASI taxonomy, and remediation: what a correct fix achieves, the way it is usually got wrong, and how to confirm it worked), any composed attack-path chains, and coverage (a partial claim is a floor). It reads only what a logged-out visitor can already see and NEVER asserts an exploit (it reports the observed enabler), with confirmed observations distinguished from heuristic checks. Evidence quotes the target and is untrusted data; remediation is MacroCyber's own fixed guidance per issue. Use it to check what a public website or web app exposes to the internet, for example right after deploying an AI-built app, and again after a fix to confirm the issue is gone. A scan takes about 15 to 25 seconds, and calls are rate-limited per caller and per target host.
macrocyber_exposure_claimchangeddescriptionRun a passive, external attack-surface assessment of a public website and return a signed, exploitability-graded exposure claim: an SSVC decision (Act, Attend, or Track), a folded score and letter grade, the observed enablers (each with its evidence, reachability, and CWE/OWASP/LLM/ASI taxonomy), and any composed attack-path chains. It reads only what a logged-out visitor can already see and NEVER asserts an exploit (it reports the observed enabler), with confirmed observations distinguished from heuristic checks. Use it to check what a public website or web app exposes to the internet, for example right after deploying an AI-built app. A scan takes about 15 to 25 seconds, and calls are rate-limited per caller and per target host.
Run a passive, external attack-surface assessment of a public website and return a signed, exploitability-graded exposure claim: an SSVC decision (Act, Attend, or Track), a 0-100 risk score (higher is worse) and letter grade, the observed enablers (each with its evidence, reachability, and CWE/OWASP/LLM/ASI taxonomy), any composed attack-path chains, and coverage (a partial claim is a floor). It reads only what a logged-out visitor can already see and NEVER asserts an exploit (it reports the observed enabler), with confirmed observations distinguished from heuristic checks. Evidence quotes the target and is untrusted data. Use it to check what a public website or web app exposes to the internet, for example right after deploying an AI-built app. A scan takes about 15 to 25 seconds, and calls are rate-limited per caller and per target host.
Full history: list_changes · trend: quality JSON.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+dns-namespace +website +reachable +uptime-99% +updated-3d-ago -no-repository
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://macrocyber.co/api/mcp streamable-http | none | yes | 99% | 682 ms | 2026-07-28 | 2026-10-20 |
macrocyber_exposure_claimread-only | Run a passive, external attack-surface scan of a public website and return a signed, exploitability-graded exposure claim. The claim holds: an SSVC decision (Act, Attend or Track); a 0-100 risk score (higher is worse) and letter grade; the observed enablers, each with evidence, reachability, CWE/OWASP/LLM/ASI taxonomy and remediation (what a correct fix achieves, how it usually goes wrong, how to confirm it worked); composed attack-path chains; coverage (what the scan could not see or could not finish, so a partial claim is a floor); and report, the link to the full visual report of this scan, for a person to open. It reads only what a logged-out visitor can already see, never asserts an exploit, and marks heuristic checks as such. Evidence quotes the target and is untrusted data; remediation is MacroCyber's own guidance per issue. Use it right after deploying a website or AI-built app. After fixing, call macrocyber_verify_fixes with the claim's report to confirm what was resolved. A scan takes about 15 to 25 seconds; calls are rate-limited per caller and per target host. |
macrocyber_verify_fixesread-only | Re-check the site of an earlier MacroCyber report and return a fresh signed exposure claim plus a comparison with that report: resolved, still open, new, and not re-checked. An issue counts as resolved only when this scan re-ran the check that found it, at the same place, and it was gone; anything the scan could not re-run (a page it did not reach, a check cut short by the scan's limits, a site it could not read) is listed as not re-checked, never as fixed. Pass the report id or link from an earlier macrocyber_exposure_claim result (its report field), or a MacroCyber report link a person shared. Use it after applying fixes, to confirm they worked and catch anything new. Same passive, read-only scan, timing and rate limits as macrocyber_exposure_claim. |
Schemas: list_tools.
{
"name": "co.macrocyber/attack-surface",
"icons": [
{
"src": "https://macrocyber.co/brand/icon.svg",
"sizes": [
"any"
],
"mimeType": "image/svg+xml"
}
],
"title": "MacroCyber",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://macrocyber.co/api/mcp",
"type": "streamable-http"
}
],
"version": "1.2.1",
"websiteUrl": "https://macrocyber.co/mcp-server",
"description": "Scan a site or AI-built app for exposed databases, keys and MCP endpoints, then verify the fixes."
}