Perufitlife/web-exposure-mcp

> An **MCP server** that lets an AI agent point at a **live deployed URL** and confirm whether sensitive files are actually being served to the public — exposed .git, .env secrets, JavaScript source maps, backup/SQL dumps, directory listing, and dotfiles — by **fetching the bytes and validating the content**. Other tools give you a checklist of *maybes*; this reports only what is genuinely reachable, with evidence.
> ⚡ **Run it in one line, no install, no API key:**
>
> 🤝 **Want it done for you?** Fixed-scope external-exposure audit — $99 / 24h: I verify every finding live and send a written report with the exact fixes and which credentials to rotate.
Why this exists
Publicly-served .git and .env files are routinely called *one of the most
common high-impact findings in external attack-surface management* — Acunetix,
Invicti and Legba all ship dedicated detections, and live HackerOne reports for
exposed .git/.env are filed continuously. June 2026 saw record
leaked-credential dumps, a large share sourced from **live, misconfigured
servers** rather than breached databases.
The MCP ecosystem already covers SSL, CORS, security-headers, SEO audits, and
**code/commit** secret scanning (GitHub MCP, GitGuardian) — but **no MCP server
probes a *deployed URL* for publicly-served secret files.** This fills that gap:
your agent can audit the live edge of any deployment, the way an attacker
actually sees it.
The hard part isn't requesting /.env — it's avoiding false positives. Most
modern sites answer 200 OK with index.html for *every* unknown path (SPA
catch-all). web-exposure-mcp therefore **reads the bytes and fingerprints the
content** (e.g. .git/config must parse as a git config, .env must contain
KEY=VALUE secret lines, an archive must start with the real magic bytes) —
so it flags facts, not guesses.
Tools (MCP)
| Tool | What it does |
|---|---|
| scan_web_exposure | Probe a live URL and return only the secret files genuinely served, with evidence. Args: url (required), only (optional check filter), timeout_ms. |
| list_exposure_checks | List every check id, severity and the paths it probes — feed ids into only. |
What it confirms
| Check id | Severity | Confirmed by |
|---|---|---|
| git_exposed | critical | /.git/config parses as a git config, or /.git/HEAD is a valid ref/sha |
| env_exposed | critical | dotenv served with ≥2 KEY=VALUE secret lines (not HTML) |
| source_map | high | .js.map parses as a source map with a sources[] array |
| backup_artifact | high | SQL-dump fingerprints, or ZIP/gzip **magic bytes** in the body |
| directory_listing | medium | the autoindex signature (Index of /…) is returned |
| dotfile_served | high | .htpasswd hashes, .npmrc/.netrc tokens, .aws/credentials, .ssh/id_rsa, .DS_Store, docker auth |
Every check fires **at most once** and only when the served bytes prove it.