Skip to main content
Glama
kalala252

asm-mcp-server

by kalala252

asm-mcp-server

MCP 클라이언트에서 asm-agent를 사용하기 위한 로컬 서버입니다. 연결된 LLM은 공개 정보 수집, 저장된 결과 조회, 근거 확인을 MCP 도구로 실행할 수 있습니다.

이 서버 자체는 LLM API를 호출하지 않습니다. 대화와 요약에는 MCP 클라이언트 측 모델을 사용합니다.

필요 사항

  • Python 3.12 이상

  • uv

  • 별도로 설정한 asm-agent

  • MCP를 지원하는 LLM 클라이언트

Related MCP server: erlik-graph

설정

asm-agent와 asm-mcp-server를 별도 폴더에 배치하고 각각의 의존성을 준비합니다.

cd /absolute/path/to/asm-agent
uv sync

cd /absolute/path/to/asm-mcp-server
uv sync

Shodan을 사용하는 경우 asm-agent 쪽에서 API 키를 저장합니다.

cd /absolute/path/to/asm-agent
uv run asm-agent credentials set-shodan

MCP 클라이언트에 등록

MCP 클라이언트 설정에 다음 내용을 추가합니다. 모두 절대 경로로 지정하세요.

{
  "mcpServers": {
    "passive-attack-surface": {
      "command": "/absolute/path/to/uv",
      "args": [
        "--directory",
        "/absolute/path/to/asm-mcp-server",
        "run",
        "asm-mcp-server"
      ],
      "env": {
        "ASM_AGENT_EXECUTABLE": "/absolute/path/to/asm-agent/.venv/bin/asm-agent",
        "ASM_MCP_REPORT_DIR": "/absolute/path/to/asm-mcp-server/reports"
      }
    }
  }
}

등록 후 MCP 클라이언트를 재시작하거나 다시 연결합니다.

Windows에서는 command에 uv.exe의 절대 경로를 지정하고, ASM_AGENT_EXECUTABLE에는 다음 형식으로 지정합니다.

C:\absolute\path\to\asm-agent\.venv\Scripts\asm-agent.exe

대화 예시

example.comをShodanありで調査して、見つかったホスト名、IPアドレス、公開ポート、CVE候補を根拠付きでまとめて。

사용 가능한 도구

도구

내용

scan_domain

도메인의 공개 정보를 수집하여 저장합니다

list_reports

저장된 리포트 목록을 반환합니다

get_report_summary

수집 건수, 경고, 오류를 반환합니다

list_assets

호스트 이름, IP 주소, 공개 서비스를 반환합니다

get_evidence

정보 출처와 관측 일시를 반환합니다

list_vulnerabilities

Shodan의 CVE 후보, 제품, 버전을 반환합니다

목록을 반환하는 도구는 offset과 limit로 분할 조회할 수 있습니다.

설정

환경 변수

기본값

내용

ASM_AGENT_EXECUTABLE

PATH의 asm-agent

실행할 asm-agent의 절대 경로

ASM_MCP_REPORT_DIR

./reports

리포트 저장 위치

ASM_MCP_SCAN_TIMEOUT_SECONDS

600

1회 조사를 기다리는 최대 초 수

Shodan의 CVE는 과거 관측에 기반한 후보이며, 현재도 취약하다는 것을 증명하는 것은 아닙니다.

개발

uv run ruff check .
uv run mypy src
uv run pytest

라이선스

MIT License

Available Tools

6 tools
get_evidenceB
Read-only

根拠を返す。asset指定時はsubjectまたはobjectが完全一致する根拠だけに絞る。

NameRequiredDescriptionDefault
assetNo
limitNo
offsetNo
report_idYes

Output Schema

NameRequiredDescription
totalYes
offsetYes
evidenceYes
has_moreYes
returnedYes
report_idYes
asset_filterYes

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the safety profile is covered. The description adds useful exact-match filtering semantics for the asset parameter, but it does not explain pagination behavior, result ordering, or how evidence relates to the required report_id.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences with no filler. The core verb and scope come first, and the key filtering condition follows in a compact, readable way.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema and readOnly annotation, the description is close to sufficient for a simple read operation, and it includes the important asset-filter behavior. However, it leaves the role of report_id implicit and does not mention pagination defaults, which an agent would need for confident invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the burden for parameter meaning. It adds meaningful semantics only for asset (exact match on subject/object), while report_id, limit, and offset receive no explanation beyond their schema titles.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states that the tool returns evidence and, when an asset is provided, filters to evidence where the subject or object exactly matches. This clearly identifies the core function, though it does not explicitly differentiate it from siblings like get_report_summary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance about when to use this tool versus alternatives such as list_reports or get_report_summary. The asset-filter note is parameter behavior rather than tool-selection guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_report_summaryB
Read-only

レポートの対象、収集時刻、件数、一部取得、エラー、警告を返す。

NameRequiredDescriptionDefault
report_idYes

Output Schema

NameRequiredDescription
domainYes
partialYes
warningsYes
report_idYes
asset_countYes
completed_atYes
evidence_countYes
collector_errorsYes
vulnerability_countYes

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the safe/read-only nature is covered. The description adds useful context by mentioning partial retrieval, errors, and warnings, which suggests the response can include non-fatal issues rather than only throwing exceptions. However, since an output schema exists and the description mostly lists return fields, the additional behavioral value is moderate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single Japanese sentence that is compact and information-dense. Every listed element contributes to understanding what the tool returns, and there is no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the low complexity (one required parameter), read-only annotation, and presence of an output schema, the description is close to adequate. However, it lacks explicit guidance on selecting this tool over sibling tools and does not clarify the parameter's role in the description, leaving moderate gaps for an agent to infer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description does not mention report_id at all. The schema's title 'Report Id' makes the parameter somewhat self-explanatory, but the description misses the opportunity to clarify that this ID identifies which report's summary will be returned.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('返す' / returns) and delineates a clear resource: a report summary with specific components (target, collection time, count, partial retrieval, errors, warnings). It clearly indicates this is a retrieval operation for one report's summary, though it does not explicitly differentiate itself from siblings like list_reports.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is used when you need a report summary, and the read-only annotation supports safe retrieval. However, it does not explicitly state when to use this tool versus siblings such as list_reports or get_evidence, and it provides no exclusion criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_assetsA
Read-only

保存済みレポートのドメイン、ホスト名、IP、サービス、証明書をページ単位で返す。

NameRequiredDescriptionDefault
limitNo
offsetNo
report_idYes
asset_typeNo

Output Schema

NameRequiredDescription
totalYes
assetsYes
offsetYes
has_moreYes
returnedYes
report_idYes

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

readOnlyHint already marks this as a safe read operation, and the description adds the useful fact that results are paged and scoped to saved reports. It does not describe filtering behavior or any special constraints beyond this, but there is no contradiction with the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no filler; the resource types are front-loaded and the paging behavior is stated at the end. Every word contributes.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The read-only listing behavior and asset scope are adequately conveyed, and an output schema exists to specify return values. However, the description lacks explicit sibling routing and leaves parameter-level semantics to be inferred, so it is functional but not fully complete on its own.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description partially compensates by enumerating asset_type values (domain, hostname, IP, service, certificate) and implying limit/offset through 'ページ単位で返す'. It does not explicitly explain report_id, limit, or offset, so parameter meaning is only partially conveyed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a precise action (returns) and resource scope: domains, hostnames, IPs, services, and certificates from saved reports, with page-based output. This is enough to distinguish it from sibling tools like list_reports and list_vulnerabilities.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The use case is implied rather than explicit: it lists assets belonging to a saved report, and the page-unit note indicates pagination use. However, it never states when to prefer this over siblings such as list_vulnerabilities or what prerequisites are needed (e.g., obtaining a report_id).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_reportsA
Read-only

MCP経由で作成済みのレポートを新しい順に返す。domainは完全一致で絞り込む。

NameRequiredDescriptionDefault
domainNo

Output Schema

NameRequiredDescription
reportsYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint and openWorldHint, so the safety profile is covered. The description adds useful behavioral details beyond annotations: results are returned newest-first and the domain filter is an exact match. Pagination and limits are not mentioned, but an output schema exists and there is no contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short, information-dense sentences. The main listing behavior is front-loaded and the filtering condition is stated immediately after; there is no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list operation with one optional parameter and an existing output schema, the description covers the essential scope, ordering, and domain-filtering semantics. An agent has enough to make a correct invocation without needing the return structure explained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the only parameter (domain) is fully explained by the phrase '完全一致で絞り込む', which tells the agent that filtering is exact-match. The optional/null default is already visible in the schema, so the description provides exactly the missing semantic meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('返す' / returns), a specific resource ('MCP経由で作成済みのレポート'), and an ordering ('新しい順'). It is unambiguous about what is listed, but it does not explicitly contrast with sibling tools such as get_report_summary, so it misses full sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The behavior implies when to use it: an agent wants MCP-created reports, newest first, optionally filtered by exact domain. However, there is no explicit when-to-use/when-not-to-use guidance or mention of alternatives, leaving the choice mostly to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_vulnerabilitiesC
Read-only

Shodanがサービス観測へ関連付けた脆弱性候補と製品・観測情報を返す。

NameRequiredDescriptionDefault
limitNo
offsetNo
report_idYes

Output Schema

NameRequiredDescription
totalYes
offsetYes
has_moreYes
returnedYes
report_idYes
vulnerabilitiesYes

TDQS

C2.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation already declares this is a read operation, and the description adds context about the data source (Shodan) and the relationship to service observations. It does not disclose pagination behavior or what happens when no vulnerabilities are found, but given the annotation coverage this is acceptable but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no filler or redundancy, and it front-loads the core action and resource. It is concise, though it sacrifices important parameter and usage detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With three parameters, one required, and zero schema descriptions, the tool description does not provide enough context to invoke it confidently. An output schema exists, but the agent still lacks guidance on how to populate report_id or interpret the meaning of limit and offset in this context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not mention report_id, limit, or offset at all. An agent gets no additional meaning about what report_id refers to or how pagination works beyond the raw parameter names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('returns') and resource ('vulnerability candidates and product/observation information associated by Shodan'), so the agent can understand what the tool produces. However, it does not explicitly contrast with sibling tools like list_assets or get_evidence, so differentiation relies mostly on the tool name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives, and no mention of prerequisites such as obtaining a valid report_id. The context is only implicit from the tool name and required parameter.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_domainB

指定apexドメインを受動調査し、保存したレポートの識別子と件数を返す。

NameRequiredDescriptionDefault
domainYes調査対象のapexドメイン。URL、IP、ワイルドカードは不可。
skip_dnsNo
max_hostsNo
enable_shodanNo
max_api_pagesNo
timeout_secondsNo
max_shodan_host_lookupsNo

Output Schema

NameRequiredDescription
domainYes
partialYes
warningsYes
report_idYes
asset_countYes
completed_atYes
evidence_countYes
collector_errorsYes
vulnerability_countYes

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds context beyond the annotations: it discloses the scan is passive (受動), a meaningful non-intrusiveness trait, and that it saves reports, which gives concrete substance to readOnlyHint=false and idempotentHint=false. However, it does not disclose whether the scan is asynchronous, how long it may run, or that enabling Shodan invokes a third-party API with rate-limit/cost implications. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, efficiently worded sentence with the action front-loaded (passively investigate the apex domain) and the outcome stated at the end; no wasted words. It is slightly terse for a tool with seven parameters, but as a concise front-loaded definition it is well structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While an output schema covers return values and annotations cover the safety profile, the description is too thin for a tool of this complexity. It leaves unexplained the parameter behavior (Shodan, DNS skipping, host limits, timeouts), whether scanning blocks or returns asynchronously, and what side effects re-running produces. An agent could select the tool but could not invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 14% — only the domain parameter is documented — yet the description adds no meaning for the six undocumented parameters (skip_dns, max_hosts, enable_shodan, max_api_pages, timeout_seconds, max_shodan_host_lookups). The description merely echoes 'apex domain' from the schema and fails to compensate for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb (受動調査する — passively investigate), a specific resource (apex domain), and a concrete outcome (returns saved report identifiers and their count). This clearly separates it from the sibling list/get tools such as list_reports and get_report_summary, which operate on existing reports, whereas scan_domain is the action that produces them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states only what the tool does and gives no guidance on when to use it versus the sibling tools. It names no alternatives, states no when-not-to-use conditions, and offers no prerequisites; the domain input restriction (no URL/IP/wildcard) appears in the schema rather than as usage direction in the description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.1.0
    • First observedget_evidence
    • First observedget_report_summary
    • First observedlist_assets
    • First observedlist_reports
    • First observedlist_vulnerabilities
    • First observedscan_domain

TDQS

A3.6/5.0

Scored across 6 tools

Disambiguation5/5

Each tool has a clearly distinct role: scan_domain initiates a scan, list_reports lists report metadata, get_report_summary provides a detailed summary, list_assets retrieves asset data, get_evidence pulls evidence, and list_vulnerabilities returns vulnerability data. There is no meaningful overlap between these operations.

Naming Consistency5/5

All tool names follow a consistent snake_case verb_noun pattern: scan_domain, list_reports, get_report_summary, list_assets, get_evidence, list_vulnerabilities. The verb choice consistently indicates whether the tool creates or retrieves information.

Tool Count5/5

Six tools is a well-scoped size for an attack surface management/recon server. Each tool maps to a distinct step in the workflow: scan, report listing, summary, asset enumeration, evidence retrieval, and vulnerability listing.

Completeness4/5

The core reconnaissance workflow is well covered: scan a domain, view reports, inspect summaries, list assets, retrieve evidence, and see vulnerabilities. Minor gaps exist around report lifecycle management, such as deleting or updating reports, but users can complete the primary investigation workflow without dead ends.

Maintenance

ActivityStale
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI agents to perform grounded web research with injection resistance, claim verification, and cost-aware routing through MCP tools like web_search, fetch_url, extract_claims, and check_grounding.
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables LLMs to perform OSINT link-analysis by exposing transforms (DNS, WHOIS, Shodan, etc.) as MCP tools for autonomous investigation and graph enrichment.
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables passive OSINT reconnaissance by providing search dorking and open-source intelligence collection tools through MCP, without requiring active interaction with target systems.
    MIT