Content
# web-exposure-mcp
> An **MCP server** that lets an AI agent point at a **live deployed URL** and confirm whether sensitive files are actually being served to the public — exposed `.git`, `.env` secrets, JavaScript source maps, backup/SQL dumps, directory listing, and dotfiles — by **fetching the bytes and validating the content**. Other tools give you a checklist of *maybes*; this reports only what is genuinely reachable, with evidence.
> ⚡ **Run it in one line, no install, no API key:**
> ```bash
> npx web-exposure-mcp # MCP server (stdio) for your AI client
> npx -p web-exposure-mcp web-exposure-scan --url https://your-site.com # one-shot CLI
> ```
> 🤝 **Want it done for you?** [Fixed-scope external-exposure audit — $99 / 24h](https://buy.stripe.com/3cIeVdgikfj47yx9LkcAo0m): I verify every finding live and send a written report with the exact fixes and which credentials to rotate.
[](https://www.npmjs.com/package/web-exposure-mcp) [](https://www.npmjs.com/package/web-exposure-mcp)   
```
$ npx -p web-exposure-mcp web-exposure-scan --url https://demo.example.com
2 critical, 2 high, 1 medium — 5 CONFIRMED via anonymous fetch (39 requests)
CRITICAL /.git/config valid .git served — full source history downloadable
CRITICAL /.env 5 env vars served — API_KEY, DATABASE_URL, JWT_SECRET…
HIGH /main.js.map valid source map — 142 original sources reconstructable
HIGH /backup.sql SQL dump content served
MEDIUM /uploads/ directory listing enabled (Index of /uploads)
```
## Why this exists
Publicly-served `.git` and `.env` files are routinely called *one of the most
common high-impact findings in external attack-surface management* — Acunetix,
Invicti and Legba all ship dedicated detections, and live HackerOne reports for
exposed `.git`/`.env` are filed continuously. June 2026 saw record
leaked-credential dumps, a large share sourced from **live, misconfigured
servers** rather than breached databases.
The MCP ecosystem already covers SSL, CORS, security-headers, SEO audits, and
**code/commit** secret scanning (GitHub MCP, GitGuardian) — but **no MCP server
probes a *deployed URL* for publicly-served secret files.** This fills that gap:
your agent can audit the live edge of any deployment, the way an attacker
actually sees it.
The hard part isn't requesting `/.env` — it's avoiding false positives. Most
modern sites answer `200 OK` with `index.html` for *every* unknown path (SPA
catch-all). `web-exposure-mcp` therefore **reads the bytes and fingerprints the
content** (e.g. `.git/config` must parse as a git config, `.env` must contain
`KEY=VALUE` secret lines, an archive must start with the real magic bytes) —
so it flags facts, not guesses.
## Tools (MCP)
| Tool | What it does |
|---|---|
| `scan_web_exposure` | Probe a live URL and return only the secret files genuinely served, with evidence. Args: `url` (required), `only` (optional check filter), `timeout_ms`. |
| `list_exposure_checks` | List every check id, severity and the paths it probes — feed ids into `only`. |
## What it confirms
| Check id | Severity | Confirmed by |
|---|---|---|
| `git_exposed` | critical | `/.git/config` parses as a git config, or `/.git/HEAD` is a valid ref/sha |
| `env_exposed` | critical | dotenv served with ≥2 `KEY=VALUE` secret lines (not HTML) |
| `source_map` | high | `.js.map` parses as a source map with a `sources[]` array |
| `backup_artifact` | high | SQL-dump fingerprints, or ZIP/gzip **magic bytes** in the body |
| `directory_listing` | medium | the autoindex signature (`Index of /…`) is returned |
| `dotfile_served` | high | `.htpasswd` hashes, `.npmrc`/`.netrc` tokens, `.aws/credentials`, `.ssh/id_rsa`, `.DS_Store`, docker auth |
Every check fires **at most once** and only when the served bytes prove it.
Read-only: the scanner never writes anything to the target, follows no
redirects into other hosts, and reads at most 64 KB per file (so it fingerprints
a multi-GB backup without downloading it).
## Add to your AI client
Claude Desktop / Cursor / any MCP client — add to your `mcpServers` config:
```json
{
"mcpServers": {
"web-exposure": {
"command": "npx",
"args": ["-y", "web-exposure-mcp"]
}
}
}
```
Then ask your agent: *“Scan https://staging.myapp.com for publicly exposed
secret files.”*
## CLI usage
```bash
# Probe a live deployment
npx -p web-exposure-mcp web-exposure-scan --url https://your-site.com
# Run only specific checks
npx -p web-exposure-mcp web-exposure-scan --url https://your-site.com --only git_exposed,env_exposed
# Tighter per-request timeout
npx -p web-exposure-mcp web-exposure-scan --url https://your-site.com --timeout 8000
```
Output is JSON on stdout (pipe into CI) and a one-line summary on stderr.
## Install (optional)
```bash
npm i -g web-exposure-mcp
web-exposure-mcp # start the MCP server (stdio)
web-exposure-scan --url https://site.com # one-shot scan
```
Zero dependencies, pure Node ≥18. Every request goes straight from the tool to
the target you name — nothing leaves your machine.
## Sister tools
Same active-probe philosophy — confirm the real issue by fetching it, not by
trusting a checklist. All MIT:
[supabase-security](https://github.com/Perufitlife/supabase-security-skill) ·
[strapi-security](https://github.com/Perufitlife/strapi-security) ·
[pocketbase-security](https://github.com/Perufitlife/pocketbase-security-skill) ·
[firebase-security](https://github.com/Perufitlife/firebase-security-skill) ·
[appwrite-security](https://github.com/Perufitlife/appwrite-security-skill) ·
[nhost-security](https://github.com/Perufitlife/nhost-security-skill)
## License
MIT © [Renzo Madueno](https://github.com/Perufitlife)
---
📚 Part of [**Awesome Backend Security Auditors**](https://github.com/Perufitlife/awesome-backend-security) — the full collection of keyless active-probe auditors.
