AI-Surface MCP Server
apisec-inc/AI-Surface
[](https://agentrank-ai.com/tool/apisec-inc--AI-Surface/?utm_source=badge&utm_medium=readme&utm_campaign=agentrank_badge) Find and govern AI attack surfaces in application code, at PR time and inside your AI coding tool (MCP server, Claude Code hook). Free, OSS, runs offline.
claude mcp add agentrank -- npx -y agentrank-mcp-server Overview
apisec-inc/AI-Surface is a Python MCP server licensed under MIT. Find and govern AI attack surfaces in application code, at PR time and inside your AI coding tool (MCP server, Claude Code hook). Free, OSS, runs offline. Topics: ai-security, devops, devsecops, github-action, llm, mcp, static-analysis, ai-agents, ai-bom, ai-governance, appsec, attack-surface, llm-security, owasp, security-scanner, ai-coding, claude-code, cursor, mcp-server, model-context-protocol.
Ranked #9439 out of 24846 indexed tools.
Ecosystem
Score Breakdown
136 stars → growing community
Last commit 1mo ago → moderate activity
0/3 issues closed → many open issues
1 contributor → solo project
No dependents → no downstream usage
Weights: Freshness 20% · Issue Health 20% · Dependents 22% · Stars 10% · Contributors 8% · How we score →
How to Improve
Badge all embed codes →
[](https://agentrank-ai.com/tool/apisec-inc--AI-Surface/?utm_source=badge&utm_medium=readme&utm_campaign=agentrank_badge) <a href="https://agentrank-ai.com/tool/apisec-inc--AI-Surface/?utm_source=badge&utm_medium=readme&utm_campaign=agentrank_badge"><img src="https://agentrank-ai.com/api/v1/badge/apisec-inc--AI-Surface" alt="AgentRank"></a> Matched Queries
From the README
<div align="center"> # ai-surface **Find the AI attack surface your code is about to ship. Locally, offline, before the PR merges.** </div> `ai-surface` maps the AI attack surface in your codebase: LLM calls, agents, MCP servers, RAG/vector stores, model gateways, self-hosted runtimes, provider keys, and the HTTP APIs that expose them. Run it locally, in CI, or inside your AI coding tool to see what AI surfaces a change introduces, generate an AI-BOM, and gate new high-risk findings before merge. Most layers of a codebase already have a check that runs before merge: Trivy for container images, Gitleaks for committed secrets, an SCA for dependencies. The AI layer, the agents, MCP servers, RAG, and LLM calls, has not had one. `ai-surface` is that check. Every risky finding carries a verdict: **confirmed risk** (an unambiguous fact of the code as written, like a financial-action tool with no approval step) or **likely risk** (inferred, wants a human look). Every scan ends on a scoreRead full README on GitHub →
Get the weekly AgentRank digest
Top movers, new tools, ecosystem insights — straight to your inbox.