Digital Infrastructure Exposure MCP Server

Passive infrastructure reconnaissance and misconfiguration detection intelligence for AI agents via the Model Context Protocol. This MCP server orchestrates 8 data sources covering domain WHOIS, DNS records, certificate transparency, IP geolocation, technology stacks, internet-wide service enumeration, and vulnerability databases to deliver subdomain discovery, DNS security auditing, SSL health checking, technology-to-CVE matching, hosting geography mapping, and a composite Digital Exposure Score (0-100).

What data can you access?

Data Point	Source	Coverage
Domain registration and ownership	WHOIS Lookup	All TLDs
DNS records including security	DNS Lookup	Any domain
Certificate transparency logs	SSL/crt.sh Certificate	All issued certificates
IP location and ASN mapping	IP Geolocation	Global coverage
Website technology identification	Tech Stack Detector	Any website
Internet-wide service enumeration	Censys Host Search	IPv4 scan data
National Vulnerability Database	NVD CVE Search	All published CVEs
Known Exploited Vulnerabilities	CISA KEV Catalog	Actively exploited CVEs

MCP Tools

Tool	Price	Description
full_exposure_audit	$2.00	Complete digital exposure audit across all 8 sources: subdomains, DNS, SSL, tech stack CVE mapping, hosting geography, Censys enumeration. Returns Digital Exposure Score (0-100).
subdomain_discovery	$2.00	Discover subdomains via certificate transparency logs (crt.sh), DNS records, and Censys index. Returns subdomain inventory with IP mapping.
dns_security_audit	$2.00	DNS security audit: SPF, DKIM, DMARC compliance, dangling CNAMEs, zone transfer exposure, and email security posture.
ssl_certificate_health	$2.00	SSL certificate health and chain validation: expiry, issuer, key strength, and certificate transparency compliance.
tech_stack_vulnerability_match	$2.00	Match detected technology stack to known CVEs (NVD) and CISA Known Exploited Vulnerabilities for exploit prioritization.
hosting_geography_map	$2.00	Map hosting geography and infrastructure concentration: IP geolocation, ASN distribution, and provider dependency analysis.
internet_service_enumeration	$2.00	Enumerate exposed internet services via Censys: open ports, service banners, and protocol versions.
compare_org_exposure	$4.00	Compare digital exposure profiles across organizations with side-by-side scoring and dimensional breakdown.

Data Sources

• WHOIS Lookup -- Domain registration details including registrar, creation/expiry dates, and privacy protection status
• DNS Lookup -- DNS record enumeration including A, AAAA, MX, TXT (SPF/DKIM/DMARC), CNAME, and NS records
• SSL/crt.sh Certificate -- Certificate transparency logs for subdomain discovery and certificate chain analysis
• IP Geolocation -- IP address to geographic location mapping with ASN, ISP, and organization identification
• Tech Stack Detector -- Website technology identification including frameworks, CDNs, analytics, CMS, and hosting
• Censys Host Search -- Internet-wide scan data revealing exposed services, open ports, and protocol versions
• NVD CVE Search -- National Vulnerability Database with CVSS severity scores and affected product matching
• CISA KEV Catalog -- Known Exploited Vulnerabilities with remediation deadlines and active exploitation indicators

How the scoring works

Five scoring dimensions quantify different aspects of digital infrastructure exposure.

Infrastructure Sprawl Index measures the number and geographic distribution of internet-facing assets discovered via certificate transparency, DNS, and Censys. More exposed assets across more providers indicates higher sprawl.

Misconfiguration Detection checks SPF, DKIM, and DMARC email security compliance; identifies dangling CNAME records vulnerable to subdomain takeover; and flags certificate issues (expired, weak keys, incomplete chains).

Technology Vulnerability Mapping builds a pipeline from detected tech stack to CVE matching to CISA KEV prioritization. Technologies with known exploited vulnerabilities are flagged for immediate remediation.

Geographic Concentration Risk analyzes hosting distribution across providers, ASNs, and geographic regions. High concentration in a single provider or region creates availability risk.

Digital Exposure Score (0-100):

Score Range	Level	Interpretation
0-20	LOW	Well-managed infrastructure with minimal exposure
21-40	MODERATE	Some exposure vectors, standard hardening recommended
41-60	ELEVATED	Multiple exposure vectors requiring attention
61-80	HIGH	Significant exposure with exploitable vulnerabilities
81-100	CRITICAL	Critical exposure, immediate remediation required

How to connect this MCP server

Claude Desktop

{
  "mcpServers": {
    "digital-infrastructure-exposure": {
      "url": "https://digital-infrastructure-exposure-mcp.apify.actor/mcp"
    }
  }
}

Programmatic (HTTP)

curl -X POST https://digital-infrastructure-exposure-mcp.apify.actor/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_APIFY_TOKEN" \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"full_exposure_audit","arguments":{"domain":"example.com"}},"id":1}'

This MCP server also works with Cursor, Windsurf, Cline, and any other MCP-compatible client.

Use cases for digital infrastructure intelligence

Security Ratings and Third-Party Risk

Score third-party digital exposure with full_exposure_audit for vendor risk management. The Digital Exposure Score provides a quantified metric for procurement and ongoing monitoring.

Cyber Insurance Pre-Binding Assessment

Assess digital exposure before binding cyber insurance policies with full_exposure_audit and tech_stack_vulnerability_match. Exploitable vulnerabilities and infrastructure sprawl inform underwriting.

Penetration Testing OSINT Phase

Automate the OSINT reconnaissance phase with subdomain_discovery, internet_service_enumeration, and tech_stack_vulnerability_match. Passive data collection before active testing.

IT Asset Management and Shadow IT

Discover unknown subdomains and services with subdomain_discovery and internet_service_enumeration. Certificate transparency reveals assets that may not be in your CMDB.

DNS and Email Security Posture

Audit email security configuration with dns_security_audit. Check SPF, DKIM, and DMARC compliance and identify dangling CNAMEs vulnerable to subdomain takeover.

Hosting Concentration Risk Assessment

Map hosting infrastructure with hosting_geography_map to identify provider concentration, geographic risk, and single points of failure.

How much does it cost?

Individual tools cost $2.00 per call. The comparison tool costs $4.00. The Apify Free plan includes $5 of monthly credits. Pay-per-event with no subscription.

FAQ

Q: Is this active or passive scanning? A: Entirely passive. Uses WHOIS records, DNS lookups, certificate transparency logs, and Censys pre-scanned index data. No packets are sent to target infrastructure.

Q: Does this find all subdomains? A: Certificate transparency covers all SSL/TLS certificates issued for domain variations. Combined with DNS and Censys, coverage is comprehensive but may miss internal-only or non-SSL subdomains.

Q: How does tech-to-CVE matching work? A: Detected technologies (e.g., "Apache 2.4.49") are matched against NVD CVE records for known vulnerabilities. CISA KEV cross-reference identifies which vulnerabilities are being actively exploited.

Q: Is it legal to use this? A: All data sources are publicly available passive data. No active scanning is performed. See Apify's guide on web scraping legality.

Q: Can I scan internal domains? A: Only internet-facing assets are visible through passive reconnaissance. Internal domains, private IP ranges, and intranet services are not accessible.

Q: How often should I run exposure audits? A: Monthly audits are recommended for standard monitoring. Weekly or daily for high-risk environments. Use Apify Schedules for automation.

Related MCP servers

MCP Server	Focus
autonomous-cyber-red-team-mcp	Attack graph simulation and exploit chain analysis
counterparty-due-diligence-mcp	Digital presence verification for entity screening
adversarial-corporate-opacity-mcp	Infrastructure correlation for hidden entity relationships

Integrations

This MCP server runs on the Apify platform and supports scheduling, webhooks, API access, and dataset export for security platform integration.