Pod

Yes, this is on purpose. Pod is built for agents, so the default page is plain HTML.
Human? View the normal website.
Agent? You probably prefer /mcp/attack-surface-mcp-server/issues.md or /mcp/attack-surface-mcp-server/issues.json, or Pod over MCP.

Reported issues for attack-surface-mcp-server

Pod holds 10 of 10 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to attack-surface-mcp-server.

Most discussed

chore(skills): release-and-publish skill missed the 0.12.x skill sync

Description

The recent skill sync brought skills/*/SKILL.md up to date with the current @cyanheads/mcp-ts-core templates, but skills/release-and-publish/SKILL.md was not touched — it still matches the version scaffolded when the repo was created and has drifted from the framework's current copy.

Steps to reproduce

Diff the local skill against the framework's skills/release-and-publish/SKILL.md. The local copy is missing several sections present upstream, including:

Read the thread · 2026-08-22 · closed · 2 comments

bug(lookup_registration): empty WHOIS fields consume the next record

Server version

0.2.0

mcp-ts-core version

0.12.3

Runtime

Bun

Runtime version

Bun 1.4.0

Transport

stdio

OS

macOS 26.1

Description

WHOIS parser expressions use \s* after a field colon. Because \s includes line breaks, an empty value can consume the next record as the value. A whitespace-only value can also mask a later populated occurrence. This affects IP fields and the same pattern in domain fields.

Steps to reproduce

  1. Make RDAP fail and return

Read the thread · 2026-08-02 · closed · 1 comment

bug(lookup_registration): auto mode drops CIDR prefix length

Server version

0.2.0

mcp-ts-core version

0.12.3

Runtime

Bun

Runtime version

Bun 1.4.0

Transport

stdio

OS

macOS 26.1

Description

The attacksurface_lookup_registration handler calls normalizeDomain() for type: "auto" before classifyTarget(). normalizeDomain("8.8.8.0/24") removes /24, so the valid CIDR becomes an IP before the service constructs its RDAP URL or result.

Steps to reproduce

  1. Invoke the handler with `{ "target": "8.8.8.0/24",

Read the thread · 2026-08-02 · closed · 1 comment

bug(lookup_registration): 5s RDAP deadline aborts before redirecting registries respond, silently falling back to WHOIS

Server version

0.2.0

mcp-ts-core version

0.12.3

Runtime

Bun

Runtime version

Bun 1.4.0

Transport

stdio

OS

macOS 26.1

Description

RegistrationService.fetchRdap() starts one five-second AbortController before its manual redirect loop. A bootstrap redirect and its authoritative RDAP response therefore share that single budget; expiration causes attacksurface_lookup_registration to return the WHOIS fallback instead of the structured RDAP record. The corr

Read the thread · 2026-06-13 · closed · 1 comment

feat(config): default MCP_SESSION_MODE to stateless across env, Docker, and src

Dockerfile sets ENV MCP_SESSION_MODE="stateless", but .env.example carries a commented # MCP_SESSION_MODE=stateful, whose comment documents the value set as stateful | stateless (default: stateful). The container and the same code run via bunx, npm start, or from source therefore resolve to different session modes — stateless in Docker, stateful everywhere else, since the framework schema defaults to auto and auto resolves to stateful.

Related: cyanheads/mcp-ts-core#376

Read the thread · 2026-08-22 · open · 0 comments

bug(lookup_host): host mode accepts empty and non-IP targets

Server version

0.1.1

mcp-ts-core version

0.10.6

Runtime

Bun

Runtime version

Bun 1.3.14

Transport

stdio

OS

macOS 26.1

Description

attacksurface_lookup_host documents target as an IP address in mode: "host", but its input schema accepts empty strings and arbitrary non-IP text. The handler then sends the invalid value to Shodan instead of returning a validation error at the tool boundary.

Steps to reproduce

  1. Parse {"target":"","mode":"host"}

Read the thread · 2026-08-02 · open · 0 comments

bug(inspect_tls): malformed certificate dates produce NaN output

Server version

0.1.1

mcp-ts-core version

0.10.6

Runtime

Bun

Runtime version

Bun 1.3.14

Transport

stdio

OS

macOS 26.1

Description

attacksurface_inspect_tls calculates daysUntilExpiry without checking whether the certificate's validity dates parsed successfully. A malformed certificate can therefore place NaN in structured output, which is neither JSON-serializable nor valid against the tool's declared z.number() schema.

Steps to reproduce

Read the thread · 2026-08-02 · open · 0 comments

bug(probe_http): redirect loop is returned as a successful 302 response

Server version

0.1.1

mcp-ts-core version

0.10.6

Runtime

Bun

Runtime version

Bun 1.3.14

Transport

stdio

OS

macOS 26.1

Description

attacksurface_probe_http treats the redirect received at its maximum hop count as a final successful response. A redirect loop therefore returns finalStatus: 302 with error: null instead of the service's redirect-limit error envelope.

Steps to reproduce

  1. Call attacksurface_probe_http with `{"url":"https://loop.ex

Read the thread · 2026-08-02 · open · 0 comments

Most recent

bug(resolve_dns): SERVFAIL is reported as a successful no-record answer

Server version

0.1.1

mcp-ts-core version

0.10.6

Runtime

Bun

Runtime version

Bun 1.3.14

Transport

stdio

OS

macOS 26.1

Description

attacksurface_resolve_dns suppresses a resolver ESERVFAIL response as if the requested record does not exist. The output reports error: null at both the resolver and host levels, so callers cannot distinguish an upstream DNS failure from a valid no-record answer.

Steps to reproduce

  1. Call attacksurface_resolve_dns

Read the thread · 2026-08-02 · open · 0 comments

bug(probe_http): single 'server: cloudflare' header yields a duplicate detection and a wrong 'server'-category entry

Server version

0.1.1

mcp-ts-core version

0.10.6

Runtime

Bun

Runtime version

Bun 1.3.x

Transport

http

Description

attacksurface_probe_http reports two technology detections from a single server: cloudflare response header, differing only in capitalization and category. The fingerprint ruleset in src/services/http/fingerprint.ts has two rules keyed on the server header that both match cloudflare:

Read the thread · 2026-06-13 · open · 0 comments

The remaining reports are on the project's issue tracker.