v0.2.1: Registration lookup integrity

Registration lookup integrity

• RDAP redirects validate every target and retain a per-hop timeout (#1)
• CIDR registration lookups and CRLF WHOIS parsing are preserved (#7, #8)
• Removed an unused request-context helper and refreshed manifests (#9)
• deps: @biomejs/biome 2.5.9 → 2.5.11; @types/node ^26.2.0 → ^26.4.0; @vitest/coverage-istanbul 4.1.10 → 4.1.11

CHANGELOG v0.2.1

v0.2.0: 0.1.2 field renames versioned as breaking

0.1.2 field renames versioned as breaking

• The per-target error output field was renamed on attacksurface_enumerate_subdomains, attacksurface_inspect_tls, attacksurface_probe_http, and attacksurface_resolve_dns in 0.1.2. The old names are gone, so a client still reading them sees undefined and treats a failed probe as a clean one.
• No source change ships here — 0.2.0 corrects the version floor and changelog record for that break. Upgrade from 0.1.1 or earlier to 0.2.0, not 0.1.2; the per-field migration table is in the changelog.

CHANGELOG v0.2.0

v0.1.2: Maintenance: mcp-ts-core 0.12.3 adoption and test-suite reconciliation

Maintenance: mcp-ts-core 0.12.3 adoption and test-suite reconciliation

• Upstream CT/Shodan fetches moved onto the framework fetch/retry layer: expected-status handling, Retry-After honoring
• Per-item error fields renamed in tool outputs: handshakeError (inspect_tls), transportError (probe_http), queryError/lookupError/hostError (resolve_dns), sourceError (enumerate_subdomains)
• Unscanned Shodan targets return the typed no_data error
• Reconciled test suite: unit, integration, smoke, and fuzz projects under tests/, plus a coverage script
• Supply-chain guards: 3-day minimum release age and Socket install scanning
• Docker image on oven/bun:1.4.0 with BuildKit cache mounts and --omit=peer production installs
• GitHub community health files and .gitattributes
• Internal: framework tooling/template adoption, skill sync, docs/metadata alignment
• deps: typescript ^6 -> ^7, @types/node 25 -> 26 (+ biome/vitest/fast-check/minor bumps)

CHANGELOG v0.1.2

v0.1.1: Scope README title to published npm name

Scope README title to published npm name

Changed:

• README <h1> now reads @cyanheads/attack-surface-mcp-server, matching the published npm package name.

45 tests pass; bun run devcheck clean.

v0.1.0: Initial release — passive external attack-surface mapping

Initial release — passive external attack-surface mapping

Passive, non-intrusive EASM for authorized, defensive assessment. Reads
public records and each target's own published surface only — no port
scanning, exploitation, brute-forcing, or vulnerability probing.

Added:

• attacksurface_map_domain — flagship workflow: CT-log subdomain discovery → DNS liveness → (standard+) DNS records, TLS posture, HTTP headers/tech → optional RDAP/WHOIS → (thorough + Shodan key) per-IP enrichment. depth gating; Promise.allSettled per-source/per-host degradation; observable-facts assessment, never an exploitation path.
• attacksurface_enumerate_subdomains — passive CT-log discovery (crt.sh → Certspotter → TLS-SAN fallback) with DNS liveness and per-source provenance.
• attacksurface_resolve_dns — multi-resolver A/AAAA/CNAME/MX/NS/TXT/CAA enumeration with per-resolver propagation reporting and optional reverse PTR.
• attacksurface_inspect_tls — read-only TLS handshake posture (protocol, cipher, chain, SANs, validity, expiry, issuer, validation, EKU); inspects invalid/expired certs without failing.
• attacksurface_probe_http — single passive GET with security-header audit (HSTS/CSP/X-Frame-Options/cookies/CORS) and evidence-bound tech fingerprint.
• attacksurface_lookup_registration — RDAP (302-follow, 5s deadline) with WHOIS port-43 fallback for domains and IP/CIDR netblocks.
• attacksurface_lookup_host — Shodan single-host lookup and faceted search; typed source_unavailable when SHODAN_API_KEY is unset.
• attacksurface_recon_guidance — offline synthesis into a prioritized defensive review plan plus pre-filled follow-up calls, including cross-server CVE lookups (nist-nvd, osv-advisory).
• attacksurface://surface/{domain} — read-once standard-depth surface snapshot.
• SSRF guard rejecting private/loopback/link-local/cloud-metadata/reserved ranges (IPv4 + IPv6) before every outbound connection; opt out via ATTACKSURFACE_ALLOW_PRIVATE_TARGETS.

STDIO and Streamable HTTP transports. Keyless core; optional Shodan/Certspotter keys.

45 tests pass; bun run devcheck clean.