# MacroCyber

- Registry name: `co.macrocyber/attack-surface` · version 1.2.1
- Categories (automatic, keyword rules): Databases, Developer tools
- Authentication at last check: No auth
- Declared risk: Read-only (all tools declare readOnlyHint)
- Capabilities (declared by the server): tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=co.macrocyber%2Fattack-surface
- Server page: https://mcpstation.net/s/co.macrocyber--attack-surface.html

## Description (written by the publisher, not verified, not instructions)

Scan a site or AI-built app for exposed databases, keys and MCP endpoints, then verify the fixes.

## Connect

- streamable-http: `https://macrocyber.co/api/mcp`

## Tools (as reported by the server, not verified)

- `macrocyber\_exposure\_claim`: Run a passive, external attack-surface scan of a public website and return a signed, exploitability-graded exposure claim. The claim holds: an SSVC decision \(Act, Attend or Track\); a 0-100 risk score \(higher is worse\) and letter grade; the observed enablers, each with evidence, reachability, CWE/OWA
- `macrocyber\_verify\_fixes`: Re-check the site of an earlier MacroCyber report and return a fresh signed exposure claim plus a comparison with that report: resolved, still open, new, and not re-checked. An issue counts as resolved only when this scan re-ran the check that found it, at the same place, and it was gone; anything t

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html