Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@asm-mcp-server Scan example.com with Shodan and summarize hosts, open ports, and CVE candidates with evidence."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A local server for using asm-agent from an MCP client. A connected LLM can collect public information, reference saved results, and verify evidence as MCP tools.
This server itself does not call the LLM API. For conversation and summarization, it uses the model on the MCP client side.
Python 3.12 or later
A separately set up asm-agent
An LLM client that supports MCP
Related MCP server: groundwork
Place asm-agent and asm-mcp-server in separate folders and prepare their dependencies respectively.
cd /absolute/path/to/asm-agent
uv sync
cd /absolute/path/to/asm-mcp-server
uv syncWhen using Shodan, save the API key on the asm-agent side.
cd /absolute/path/to/asm-agent
uv run asm-agent credentials set-shodanAdd the following to the MCP client configuration. Specify everything with absolute paths.
{
"mcpServers": {
"passive-attack-surface": {
"command": "/absolute/path/to/uv",
"args": [
"--directory",
"/absolute/path/to/asm-mcp-server",
"run",
"asm-mcp-server"
],
"env": {
"ASM_AGENT_EXECUTABLE": "/absolute/path/to/asm-agent/.venv/bin/asm-agent",
"ASM_MCP_REPORT_DIR": "/absolute/path/to/asm-mcp-server/reports"
}
}
}
}After registration, restart or reconnect the MCP client.
On Windows, specify the absolute path of uv.exe in command, and specify ASM_AGENT_EXECUTABLE in the following format.
C:\absolute\path\to\asm-agent\.venv\Scripts\asm-agent.exeexample.comをShodanありで調査して、見つかったホスト名、IPアドレス、公開ポート、CVE候補を根拠付きでまとめて。Tool | Description |
| Collects and saves public information about a domain |
| Returns a list of saved reports |
| Returns collection counts, warnings, and errors |
| Returns hostnames, IP addresses, and public services |
| Returns information sources and observation timestamps |
| Returns Shodan CVE candidates, products, and versions |
Tools that return lists support pagination with offset and limit.
Environment variable | Default value | Description |
|
| Absolute path of the |
|
| Report save destination |
|
| Maximum seconds to wait for a single investigation |
Shodan CVEs are candidates based on past observations and do not prove that a system is currently vulnerable.
uv run ruff check .
uv run mypy src
uv run pytest根拠を返す。asset指定時はsubjectまたはobjectが完全一致する根拠だけに絞る。
| Name | Required | Description | Default |
|---|---|---|---|
| asset | No | ||
| limit | No | ||
| offset | No | ||
| report_id | Yes |
| Name | Required | Description |
|---|---|---|
| total | Yes | |
| offset | Yes | |
| evidence | Yes | |
| has_more | Yes | |
| returned | Yes | |
| report_id | Yes | |
| asset_filter | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safety profile is covered. The description adds useful exact-match filtering semantics for the asset parameter, but it does not explain pagination behavior, result ordering, or how evidence relates to the required report_id.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no filler. The core verb and scope come first, and the key filtering condition follows in a compact, readable way.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema and readOnly annotation, the description is close to sufficient for a simple read operation, and it includes the important asset-filter behavior. However, it leaves the role of report_id implicit and does not mention pagination defaults, which an agent would need for confident invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden for parameter meaning. It adds meaningful semantics only for asset (exact match on subject/object), while report_id, limit, and offset receive no explanation beyond their schema titles.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states that the tool returns evidence and, when an asset is provided, filters to evidence where the subject or object exactly matches. This clearly identifies the core function, though it does not explicitly differentiate it from siblings like get_report_summary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus alternatives such as list_reports or get_report_summary. The asset-filter note is parameter behavior rather than tool-selection guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
レポートの対象、収集時刻、件数、一部取得、エラー、警告を返す。
| Name | Required | Description | Default |
|---|---|---|---|
| report_id | Yes |
| Name | Required | Description |
|---|---|---|
| domain | Yes | |
| partial | Yes | |
| warnings | Yes | |
| report_id | Yes | |
| asset_count | Yes | |
| completed_at | Yes | |
| evidence_count | Yes | |
| collector_errors | Yes | |
| vulnerability_count | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safe/read-only nature is covered. The description adds useful context by mentioning partial retrieval, errors, and warnings, which suggests the response can include non-fatal issues rather than only throwing exceptions. However, since an output schema exists and the description mostly lists return fields, the additional behavioral value is moderate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single Japanese sentence that is compact and information-dense. Every listed element contributes to understanding what the tool returns, and there is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the low complexity (one required parameter), read-only annotation, and presence of an output schema, the description is close to adequate. However, it lacks explicit guidance on selecting this tool over sibling tools and does not clarify the parameter's role in the description, leaving moderate gaps for an agent to infer.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description does not mention report_id at all. The schema's title 'Report Id' makes the parameter somewhat self-explanatory, but the description misses the opportunity to clarify that this ID identifies which report's summary will be returned.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('返す' / returns) and delineates a clear resource: a report summary with specific components (target, collection time, count, partial retrieval, errors, warnings). It clearly indicates this is a retrieval operation for one report's summary, though it does not explicitly differentiate itself from siblings like list_reports.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used when you need a report summary, and the read-only annotation supports safe retrieval. However, it does not explicitly state when to use this tool versus siblings such as list_reports or get_evidence, and it provides no exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
保存済みレポートのドメイン、ホスト名、IP、サービス、証明書をページ単位で返す。
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| offset | No | ||
| report_id | Yes | ||
| asset_type | No |
| Name | Required | Description |
|---|---|---|
| total | Yes | |
| assets | Yes | |
| offset | Yes | |
| has_more | Yes | |
| returned | Yes | |
| report_id | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint already marks this as a safe read operation, and the description adds the useful fact that results are paged and scoped to saved reports. It does not describe filtering behavior or any special constraints beyond this, but there is no contradiction with the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler; the resource types are front-loaded and the paging behavior is stated at the end. Every word contributes.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The read-only listing behavior and asset scope are adequately conveyed, and an output schema exists to specify return values. However, the description lacks explicit sibling routing and leaves parameter-level semantics to be inferred, so it is functional but not fully complete on its own.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description partially compensates by enumerating asset_type values (domain, hostname, IP, service, certificate) and implying limit/offset through 'ページ単位で返す'. It does not explicitly explain report_id, limit, or offset, so parameter meaning is only partially conveyed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a precise action (returns) and resource scope: domains, hostnames, IPs, services, and certificates from saved reports, with page-based output. This is enough to distinguish it from sibling tools like list_reports and list_vulnerabilities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The use case is implied rather than explicit: it lists assets belonging to a saved report, and the page-unit note indicates pagination use. However, it never states when to prefer this over siblings such as list_vulnerabilities or what prerequisites are needed (e.g., obtaining a report_id).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
MCP経由で作成済みのレポートを新しい順に返す。domainは完全一致で絞り込む。
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No |
| Name | Required | Description |
|---|---|---|
| reports | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint and openWorldHint, so the safety profile is covered. The description adds useful behavioral details beyond annotations: results are returned newest-first and the domain filter is an exact match. Pagination and limits are not mentioned, but an output schema exists and there is no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short, information-dense sentences. The main listing behavior is front-loaded and the filtering condition is stated immediately after; there is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list operation with one optional parameter and an existing output schema, the description covers the essential scope, ordering, and domain-filtering semantics. An agent has enough to make a correct invocation without needing the return structure explained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the only parameter (domain) is fully explained by the phrase '完全一致で絞り込む', which tells the agent that filtering is exact-match. The optional/null default is already visible in the schema, so the description provides exactly the missing semantic meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('返す' / returns), a specific resource ('MCP経由で作成済みのレポート'), and an ordering ('新しい順'). It is unambiguous about what is listed, but it does not explicitly contrast with sibling tools such as get_report_summary, so it misses full sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The behavior implies when to use it: an agent wants MCP-created reports, newest first, optionally filtered by exact domain. However, there is no explicit when-to-use/when-not-to-use guidance or mention of alternatives, leaving the choice mostly to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Shodanがサービス観測へ関連付けた脆弱性候補と製品・観測情報を返す。
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| offset | No | ||
| report_id | Yes |
| Name | Required | Description |
|---|---|---|
| total | Yes | |
| offset | Yes | |
| has_more | Yes | |
| returned | Yes | |
| report_id | Yes | |
| vulnerabilities | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already declares this is a read operation, and the description adds context about the data source (Shodan) and the relationship to service observations. It does not disclose pagination behavior or what happens when no vulnerabilities are found, but given the annotation coverage this is acceptable but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler or redundancy, and it front-loads the core action and resource. It is concise, though it sacrifices important parameter and usage detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With three parameters, one required, and zero schema descriptions, the tool description does not provide enough context to invoke it confidently. An output schema exists, but the agent still lacks guidance on how to populate report_id or interpret the meaning of limit and offset in this context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not mention report_id, limit, or offset at all. An agent gets no additional meaning about what report_id refers to or how pagination works beyond the raw parameter names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('returns') and resource ('vulnerability candidates and product/observation information associated by Shodan'), so the agent can understand what the tool produces. However, it does not explicitly contrast with sibling tools like list_assets or get_evidence, so differentiation relies mostly on the tool name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives, and no mention of prerequisites such as obtaining a valid report_id. The context is only implicit from the tool name and required parameter.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
指定apexドメインを受動調査し、保存したレポートの識別子と件数を返す。
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | 調査対象のapexドメイン。URL、IP、ワイルドカードは不可。 | |
| skip_dns | No | ||
| max_hosts | No | ||
| enable_shodan | No | ||
| max_api_pages | No | ||
| timeout_seconds | No | ||
| max_shodan_host_lookups | No |
| Name | Required | Description |
|---|---|---|
| domain | Yes | |
| partial | Yes | |
| warnings | Yes | |
| report_id | Yes | |
| asset_count | Yes | |
| completed_at | Yes | |
| evidence_count | Yes | |
| collector_errors | Yes | |
| vulnerability_count | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds context beyond the annotations: it discloses the scan is passive (受動), a meaningful non-intrusiveness trait, and that it saves reports, which gives concrete substance to readOnlyHint=false and idempotentHint=false. However, it does not disclose whether the scan is asynchronous, how long it may run, or that enabling Shodan invokes a third-party API with rate-limit/cost implications. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, efficiently worded sentence with the action front-loaded (passively investigate the apex domain) and the outcome stated at the end; no wasted words. It is slightly terse for a tool with seven parameters, but as a concise front-loaded definition it is well structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While an output schema covers return values and annotations cover the safety profile, the description is too thin for a tool of this complexity. It leaves unexplained the parameter behavior (Shodan, DNS skipping, host limits, timeouts), whether scanning blocks or returns asynchronously, and what side effects re-running produces. An agent could select the tool but could not invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 14% — only the domain parameter is documented — yet the description adds no meaning for the six undocumented parameters (skip_dns, max_hosts, enable_shodan, max_api_pages, timeout_seconds, max_shodan_host_lookups). The description merely echoes 'apex domain' from the schema and fails to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb (受動調査する — passively investigate), a specific resource (apex domain), and a concrete outcome (returns saved report identifiers and their count). This clearly separates it from the sibling list/get tools such as list_reports and get_report_summary, which operate on existing reports, whereas scan_domain is the action that produces them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states only what the tool does and gives no guidance on when to use it versus the sibling tools. It names no alternatives, states no when-not-to-use conditions, and offers no prerequisites; the domain input restriction (no URL/IP/wildcard) appears in the schema rather than as usage direction in the description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0get_evidenceget_report_summarylist_assetslist_reportslist_vulnerabilitiesscan_domainScored across 6 tools
Each tool has a clearly distinct role: scan_domain initiates a scan, list_reports lists report metadata, get_report_summary provides a detailed summary, list_assets retrieves asset data, get_evidence pulls evidence, and list_vulnerabilities returns vulnerability data. There is no meaningful overlap between these operations.
All tool names follow a consistent snake_case verb_noun pattern: scan_domain, list_reports, get_report_summary, list_assets, get_evidence, list_vulnerabilities. The verb choice consistently indicates whether the tool creates or retrieves information.
Six tools is a well-scoped size for an attack surface management/recon server. Each tool maps to a distinct step in the workflow: scan, report listing, summary, asset enumeration, evidence retrieval, and vulnerability listing.
The core reconnaissance workflow is well covered: scan a domain, view reports, inspect summaries, list assets, retrieve evidence, and see vulnerabilities. Minor gaps exist around report lifecycle management, such as deleting or updating reports, but users can complete the primary investigation workflow without dead ends.
Scrape, crawl and search the web for AI agents via MCP.
Web search, fetch, extract, and research for AI agents. Markdown output + AI-synthesized answers.
Web research for agents: quality-scored Google search, webpage extraction, and deep research.
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
