attack-surface-mcp-server AGENTS.md

Developer Protocol

Server: attack-surface-mcp-server Version: 0.2.1 Framework: @cyanheads/mcp-ts-core ^0.12.3 Engines: Bun ≥1.3.0, Node ≥24.0.0 MCP SDK: @modelcontextprotocol/server/client ^2.0.0 Zod: ^4.4.3

Read the framework docs first: node_modules/@cyanheads/mcp-ts-core/CLAUDE.md contains the full API reference — builders, Context, error codes, exports, patterns. This file covers server-specific conventions only.

---

Authorized-use posture

This is a defensive external-attack-surface-mapping (EASM) server. It is passive and non-intrusive by mandate: it reads public records (Certificate Transparency, DNS, RDAP/WHOIS) and each target's own published surface (one TLS handshake, one HTTP GET per host). It does not port-scan, exploit, brute-force, fuzz, or probe for vulnerabilities — that capability is excluded from the surface by design, never gated behind a flag. Output is descriptive (what exists, what the posture is), never an exploitation plan.

• Keep the framing in the surface. The server instructions, the attacksurface_map_domain description, and attacksurface_recon_guidance all state the target must be owned or authorized for assessment. Preserve that when editing any of them. Don't add active/intrusive capability or a mode: active toggle — excluding it structurally is the safety property.
• The SSRF guard is the security spine. Every outbound connection to a user-supplied target (DNS, TLS, HTTP) must pass assertSafeDomain / assertSafeUrl / assertSafeResolverIp (src/utils/ssrf-guard.ts) before connecting. It rejects private, loopback, link-local, cloud-metadata, and reserved ranges. Never route a new outbound path around it.
• No fabricated signal. Report detections with their triggering evidence; report absent CT/DNS/RDAP fields as unknown. No invented confidence composites.

---

Core Rules

• Logic throws, framework catches. Tool/resource handlers are pure — throw on failure, no try/catch. Plain Error is fine; the framework catches, classifies, and formats. Use error factories (notFound(), validationError(), etc.) when the error code matters.
• Use ctx.log for request-scoped logging. No console calls.
• Use ctx.state for tenant-scoped storage. Never access persistence directly.
• Secrets in env vars only — never hardcoded.
• Close the loop on issues. When implementing work tracked by a GitHub issue, comment on the issue with what landed and close it. Do both — a comment without a close leaves stale issues open; a close without a comment leaves no record of what shipped. The comment is for future readers — state the concrete changes, not the conversation that produced them.