"Understanding Attack Surface Management" matching MCP tools:

• get_crisis_resources

  library

  Return the canonical 988 / 911 / Crisis Text Line payload. Surface this immediately whenever the user signals self-harm or imminent danger.

  Connector

• scry_tools

  Scry

  List detected attack tools — (protocol, payload, path) tuples sent by 3+ distinct source IPs. Aggregate metadata only; never lists member actors.

  Connector

• dossier_ct_log

  drwho.me developer tools

  Core dossier check: Discover subdomains visible in Certificate Transparency logs. Use for attack-surface mapping; prefer dossier_full when running a complete audit. Queries crt.sh first, falls back to certspotter; capped at 100 unique subdomains; 10s timeout. Returns a CheckResult with { subdomains[], wildcards[], certCount, source }.

  Connector

• get_crisis_resources

  library

  Return the canonical 988 / 911 / Crisis Text Line payload. Surface this immediately whenever the user signals self-harm or imminent danger.

  Connector

• get_crisis_resources

  library

  Return the canonical 988 / 911 / Crisis Text Line payload. Surface this immediately whenever the user signals self-harm or imminent danger.

  Connector

• get_crisis_resources

  library

  Return the canonical 988 / 911 / Crisis Text Line payload. Surface this immediately whenever the user signals self-harm or imminent danger.

  Connector

• dossier_ct_log

  drwho.me

  Core dossier check: Discover subdomains visible in Certificate Transparency logs. Use for attack-surface mapping; prefer dossier_full when running a complete audit. Queries crt.sh first, falls back to certspotter; capped at 100 unique subdomains; 10s timeout. Returns a CheckResult with { subdomains[], wildcards[], certCount, source }.

  Connector

• whensport_hr_getVenues

  horse-racing

  Get the horse racing venue list (racecourses). Surface (turf/dirt/all-weather) varies by card and is reported per-meeting, not per-venue.

  Connector

• get_crisis_resources

  library

  Return the canonical 988 / 911 / Crisis Text Line payload. Surface this immediately whenever the user signals self-harm or imminent danger.

  Connector

• get_crisis_resources

  library

  Return the canonical 988 / 911 / Crisis Text Line payload. Surface this immediately whenever the user signals self-harm or imminent danger.

  Connector

• list_endpoints

  Trillboards DOOH Advertising

  List every registered Trillboards API operation. WHEN TO USE: - First call in an agent session to learn what the API offers. - Filter to agent_safe=true to list only side-effect-free endpoints. - Narrow to a single surface (data-api, sdk-api, device-api, sensing-api, partner-api-generated, dsp-api-generated). RETURNS: - operations: Array of { surface, method, path, operation_id, summary, description, agent_safe, idempotent, cost_tier, tags, doc_url, example_request } - total_operations: Total count. - surfaces: Known surface identifiers. EXAMPLE: Agent: "What read-only endpoints can I call?" list_endpoints({ agent_safe: true })

  Connector

• get_html

  Dock

  Read an HTML surface's body. HTML surfaces (Surface.kind="html") store mockup or full-page content as three text fields (html, css, js) rendered together inside a sandboxed iframe. Use `list_surfaces` to enumerate html surfaces in a workspace. Omit `surface_slug` to read the primary html surface; pass it to target a specific tab. Empty (never-written) html surfaces return { html:"", css:"", js:"" }. 404 when `surface_slug` doesn't match a live html surface. Requires viewer role.

  Connector

• get_crisis_resources

  library

  Return the canonical 988 / 911 / Crisis Text Line payload. Surface this immediately whenever the user signals self-harm or imminent danger.

  Connector

• parliament_search_hansard

  UK Legal Research

  Search Hansard for parliamentary debates, questions, and speeches. Returns contributions from MPs and Lords including date, party, debate title, and text (capped at 3000 chars per contribution). Useful for understanding legislative intent or political context.

  Connector

• list_rows

  Dock

  List rows in a workspace's table surface. Returns rows with their data (a JSON object of column-name to value), creation time, the principal who created/updated each row, AND the row's `surface_slug` (the sheet it lives on). Empty array if no rows have been added yet. Multi-surface workspaces: pass `surface_slug` to scope to one sheet; omit to return rows from every surface in the workspace (back-compat: pre-multi-surface clients keep working).

  Connector

• delete_surface

  Dock

  Archive a surface (soft-delete). Rows + doc body are preserved for restore. Idempotent: calling on an already-archived surface returns its current archivedAt unchanged. Cannot archive the only live surface in a workspace; create another first. Editor role required. Emits `surface.archived`.

  Connector

• get_crisis_resources

  library

  Return the canonical 988 / 911 / Crisis Text Line payload. Surface this immediately whenever the user signals self-harm or imminent danger.

  Connector

• get_crisis_resources

  library

  Return the canonical 988 / 911 / Crisis Text Line payload. Surface this immediately whenever the user signals self-harm or imminent danger.

  Connector

• subdomain_enum

  ContrastAPI

  Discover subdomains using passive methods: Certificate Transparency logs + DNS brute-force (no active probing). Use to map organization's attack surface; non-intrusive. Response carries next_calls — capped at 5 ssl_check hints (one per first-five subdomain) so triage scales to large enumerations without token bloat; pull tail entries by name when needed. Free: 30/hr, Pro: 500/hr. Returns {domain, count, subdomains, sources, found_via_wordlist, found_via_crtsh, crtsh_status, warnings, summary, next_calls}. Always check crtsh_status: 'ok' means the CT lookup completed (so a low count is real); 'timeout' / 'rate_limited' / 'unavailable' / 'error' means CT logs did not respond and the count is wordlist-only — the actual attack surface is likely larger, retry later or surface the limitation to the user.

  Connector

• lookup_cargo_crate

  Commit — Supply Chain Risk Scoring

  Get a behavioral commitment profile for any Rust crate on crates.io. Returns real signals: crate age, download volume (estimated weekly from 90-day totals), version count, publish cadence, owner count (users with publish access), team owners, and linked GitHub activity. Supply chain risks apply to Cargo too — crate owners with publish access are the attack surface. A single owner on a high-download crate is the same risk pattern as npm. Useful for: vetting Rust dependencies before adding to Cargo.toml, identifying abandonware, supply chain risk assessment. Examples: "serde", "tokio", "reqwest", "clap", "rand"

  Connector