ExposureGuard
Domain security scanning for AI agents. A-F grades, 8 checks, fix snippets.
Install
Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).
exposureguard-mcpclaude mcp add exposureguard -- uvx exposureguard-mcp==1.0.2
{
"mcpServers": {
"exposureguard": {
"command": "uvx",
"args": [
"exposureguard-mcp==1.0.2"
]
}
}
}
Documentation
From the project's README on GitHub, refreshed weekly. Links open on GitHub.
ExposureGuard MCP Server
An MCP (Model Context Protocol) server that connects AI assistants to the ExposureGuard domain security scanning API.
Tools
| Tool | Description |
|---|---|
scan_domain | Full security scan — 8 checks, A-F grade, score, findings, report URL (~8s) |
get_grade | Cached grade lookup (up to 24h old) — fast, no new scan triggered |
get_remediation | Copy-paste fix snippets for all failing checks |
get_dependencies | Third-party scripts/resources loaded by the domain |
Setup
1. Get an API Key
Sign up at getexposureguard.com and grab your API key from the dashboard.
2. Install
# Option A: pip install (recommended)
pip install -e /path/to/exposureguard-mcp
# Option B: just install deps
pip install mcp httpx
3. Configure Your AI Client
Claude Desktop
Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"exposureguard": {
"command": "python",
"args": ["-m", "exposureguard_mcp.server"],
"env": {
"EXPOSUREGUARD_API_KEY": "your-api-key-here"
}
}
}
}
If you installed as a package, you can also use:
{
"mcpServers": {
"exposureguard": {
"command": "exposureguard-mcp",
"env": {
"EXPOSUREGUARD_API_KEY": "your-api-key-here"
}
}
}
}
Cursor
Edit .cursor/mcp.json in your project root (or globally at ~/.cursor/mcp.json):
{
"mcpServers": {
"exposureguard": {
"command": "python",
"args": ["-m", "exposureguard_mcp.server"],
"env": {
"EXPOSUREGUARD_API_KEY": "your-api-key-here"
}
}
}
}
Windsurf
Edit ~/.codeium/windsurf/mcp_config.json:
{
"mcpServers": {
"exposureguard": {
"command": "python",
"args": ["-m", "exposureguard_mcp.server"],
"env": {
"EXPOSUREGUARD_API_KEY": "your-api-key-here"
}
}
}
}
VS Code (Copilot)
Edit .vscode/mcp.json in your project:
{
"servers": {
"exposureguard": {
"type": "stdio",
"command": "python",
"args": ["-m", "exposureguard_mcp.server"],
"env": {
"EXPOSUREGUARD_API_KEY": "your-api-key-here"
}
}
}
}
4. Usage Examples
Once connected, ask your AI assistant:
- "Scan example.com for security issues"
- "What's the security grade for cloudflare.com?"
- "Show me how to fix the security issues on my-site.com"
- "What third-party scripts does shopify.com load?"
Running Standalone
export EXPOSUREGUARD_API_KEY=your-api-key-here
python -m exposureguard_mcp.server
The server communicates over stdio using the MCP protocol — it's designed to be launched by an MCP client, not used interactively.
Rate Limits
Rate limits depend on your ExposureGuard plan. If you hit a 429 response, the server will return a message suggesting you upgrade at getexposureguard.com/pricing.
Publishing
PyPI
pip install build twine
python -m build
twine upload dist/*
Then users install with: pip install exposureguard-mcp
npm
npm publish
Then users install with: npx exposureguard-mcp
License
MIT
Frequently asked questions
What is ExposureGuard?
Domain security scanning for AI agents. A-F grades, 8 checks, fix snippets.
How do I install ExposureGuard?
It runs on your machine. In Claude Code: claude mcp add exposureguard -- uvx exposureguard-mcp==1.0.2. For other clients, paste the JSON configuration from this page into their MCP settings.
Does ExposureGuard need an API key?
Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.
Is ExposureGuard open source?
Its code is public on GitHub, but the repository does not declare a standard license.
Who maintains ExposureGuard?
It is published by ExposureGuard. AI.tn lists it but does not maintain or endorse it.
From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.