# attack_surface_monitor Surveillance surface d'attaque — Gapup agent-payable C-suite expertise (RISK). Returns a structured, audited deliverable. Answers: Which Internet-facing assets of combine a critical CVE, an exposed service, and no WAF — top findings to fix in 14 days? · What is the attack surface of : subdomains, open ports, SSL/TLS grades, and associated CVEs? · Give me a CISO-ready ASM report with blast radius estimate and SLA-driven remediation plan for . · What is the email phishing risk for ? Assess SPF/DMARC posture and recommend improvements. · During M&A due diligence, what are the top cyber exposures on 's Internet-facing infrastructure? Reference case: Velora Payments — 8 assets exposés · 2 critiques (CVE-2023-44487 HTTP/2 RapidReset, Admin panel ouvert) · . Inputs are validated server-side — send the documented case fields. Agent View of the PolicyLayer registry record for `attack_surface_monitor`. HTML page: https://policylayer.com/tools/io-github-getgapup-gapup-mcp/attack-surface-monitor ## Facts - Tool: `attack_surface_monitor` - Server: Gapup Mcp (`https://mcp.gapup.io/mcp`) — https://policylayer.com/tools/io-github-getgapup-gapup-mcp.md - Homepage: https://github.com/getgapup/gapup-mcp-public - Risk category: Read (Low risk) - Registry record: grade F, identity unverified - Server auth posture: open - Server rate-limited: no - Parameters: 6 (2 required) - Recommended policy verdict: Allowed ## Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `async` | boolean | no | If true, returns a job_id immediately (<200ms) instead of waiting for the result. Poll the result with job_result(job_id). Use for slow tools to avoid client ti | | `focus` | string | no | | | `domain` | string | yes | | | `exclusions` | array | no | | | `scope_cidrs` | array | no | | | `include_email_surface` | boolean | yes | | Parameters from the server's own tool schema. ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "attack_surface_monitor", "arguments": { "domain": "", "include_email_surface": false } } } ``` ## Why attack_surface_monitor is rated Low Despite the intimidating name and C-suite risk framing, attack_surface_monitor is fundamentally a reconnaissance and assessment tool that gathers information about a target domain's security configuration and vulnerabilities. It does not execute exploits, modify systems, delete data, or trigger payments. From the tool's own definition: "Tool returns 'structured, audited deliverable' answering questions about 'Internet-facing assets', 'attack surface', 'subdomains, open ports, SSL/TLS grades', 'CVEs', 'phishing risk', 'SPF/DMARC posture', and produces 'ASM report' and 'remediation plan'." Risk signals: Admin/system-level operation ## Use case AI agents call attack_surface_monitor to retrieve information from Gapup Mcp without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere. ## Recommended policy (PolicyLayer) Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Gapup Mcp: ```json { "version": "1", "default": "deny", "tools": { "attack_surface_monitor": {} } } ``` ## Other tools on Gapup Mcp (270) - `adversarial_input_stress_tester` — Execute — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/adversarial-input-stress-tester.md - `dora_operational_resilience_stress_tes` — Execute — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/dora-operational-resilience-stress-tes.md - `financial_model_3statement` — Execute — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/financial-model-3statement.md - `gl_reconciler` — Execute — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/gl-reconciler.md - `lgpd_data_subject_rights_automator` — Execute — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/lgpd-data-subject-rights-automator.md - `monte_carlo_portfolio` — Execute — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/monte-carlo-portfolio.md - `process_mining` — Execute — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/process-mining.md - `ugc_moderation_classifier` — Execute — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/ugc-moderation-classifier.md - `workflow_orchestrator` — Execute — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/workflow-orchestrator.md - `abm_architect` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/abm-architect.md - `account_expansion_mapper` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/account-expansion-mapper.md - `anti_demissions_hr` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/anti-demissions-hr.md - `audit_pre_flight` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/audit-pre-flight.md - `budget_variance_ai` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/budget-variance-ai.md - `capacity_planning` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/capacity-planning.md - `capital_strategy` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/capital-strategy.md - `churn_defender` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/churn-defender.md - `competitor_moves` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/competitor-moves.md - `competitor_recommendations` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/competitor-recommendations.md - `content_engine` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/content-engine.md - `cross_sell_reco` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/cross-sell-reco.md - `customer_voice_synth` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/customer-voice-synth.md - `cyber_risk_auditor` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/cyber-risk-auditor.md - `deal_structurer` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/deal-structurer.md - `discovery_prep` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/discovery-prep.md - `diversity_inclusion_metrics` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/diversity-inclusion-metrics.md - `earnings_reviewer` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/earnings-reviewer.md - `enps_auto` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/enps-auto.md - `event_marketing` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/event-marketing.md - `fraud_detector` — Financial — https://policylayer.com/tools/io-github-getgapup-gapup-mcp/fraud-detector.md - …and 240 more: https://policylayer.com/tools/io-github-getgapup-gapup-mcp.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-getgapup-gapup-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-getgapup-gapup-mcp