Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan via MCP. STDIO or Streamable HTTP.

Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.

Runtime application security for JavaScript and Node.js: dependency inventory, attack-surface mapping, and an in-process guard that virtually patches known vulnerabilities and hardens responses.

MCP attack-surface posture snapshot validator and drift analyzer

Straiker attack-surface CLI: map, probe, strike

A tool to explore the attack surface of a GraphQL API

MCP server for the BeVigil OSINT API — mobile app attack surface discovery (hosts, subdomains, S3 buckets, wordlists) for AI agents

n8n community node for Cavelo Attack Surface Management platform

Deterministic LLM prompt defense scanner — 17 attack vectors + 12 Unicode smuggling categories + 6 output-scanner rules for MCP/agent attack surface. Pure regex, zero AI cost, < 5ms.

Security scanner for DSH plugins: static and semantic passes over plugin source, DSH-specific attack-surface rules, npm audit, batch scanning, and an HTML report with per-finding severity and evidence.

Black-box security terminal for Soroban smart contracts — attack-surface reconstruction and Chaos Monkey fuzzing against deployed Testnet contracts, no source code required.

npm registry proxy designed to reduce the attack surface of npm publish

A zero-dependency MRI scan for your AI coding agent attack surface.

ESLint rules for the Next.js App Router attack surface: unguarded Server Actions, data-layer imports outside the DAL, unvalidated FormData reaching the database.

GraphQL IDE for better development workflows (GraphQL Subscriptions, interactive docs & collaboration).

Parses and normalizes attack surface scope definitions: IP ranges, CIDR, domains, wildcards, and exclusions. Framework-agnostic, zero-dependency.

A library to find JS RegExp with super-linear worst-case time complexity for attack strings that repeat a single character.

A static-code-analysis tool that can be used to perform security-focused code reviews. It enables an auditor to swiftly map the attack-surface of a large application, with an emphasis on identifying development anti-patterns and footguns.

MCP server for JavaScript endpoint discovery and attack surface mapping. Discovers JS files from 23+ passive sources, extracts API endpoints via AST parsing, reconstructs sourcemaps, probes API documentation. Powered by the Anastasis engine.

Audited & minimal JS implementation of elliptic curve cryptography