asm-mcp-server

A local server for using asm-agent from an MCP client. A connected LLM can collect public information, reference saved results, and verify evidence as MCP tools.

This server itself does not call the LLM API. For conversation and summarization, it uses the model on the MCP client side.

Requirements

• Python 3.12 or later

• uv

• A separately set up asm-agent

• An LLM client that supports MCP

Related MCP server: groundwork

Setup

Place asm-agent and asm-mcp-server in separate folders and prepare their dependencies respectively.

cd /absolute/path/to/asm-agent
uv sync

cd /absolute/path/to/asm-mcp-server
uv sync

When using Shodan, save the API key on the asm-agent side.

cd /absolute/path/to/asm-agent
uv run asm-agent credentials set-shodan

Register with the MCP client

Add the following to the MCP client configuration. Specify everything with absolute paths.

{
  "mcpServers": {
    "passive-attack-surface": {
      "command": "/absolute/path/to/uv",
      "args": [
        "--directory",
        "/absolute/path/to/asm-mcp-server",
        "run",
        "asm-mcp-server"
      ],
      "env": {
        "ASM_AGENT_EXECUTABLE": "/absolute/path/to/asm-agent/.venv/bin/asm-agent",
        "ASM_MCP_REPORT_DIR": "/absolute/path/to/asm-mcp-server/reports"
      }
    }
  }
}

After registration, restart or reconnect the MCP client.

On Windows, specify the absolute path of uv.exe in command, and specify ASM_AGENT_EXECUTABLE in the following format.

C:\absolute\path\to\asm-agent\.venv\Scripts\asm-agent.exe

Conversation example

example.comをShodanありで調査して、見つかったホスト名、IPアドレス、公開ポート、CVE候補を根拠付きでまとめて。

Available tools

Tools that return lists support pagination with offset and limit.

Configuration

Shodan CVEs are candidates based on past observations and do not prove that a system is currently vulnerable.

Development

uv run ruff check .
uv run mypy src
uv run pytest

License

MIT License