x=hub

your toolset

    build deployment
    sign in

    ai-surface

    projectother scanned
    io.github.apisec-inc/ai-surface · v
    deploy just this

    Find and govern AI attack surfaces in application code, at PR time and inside your AI coding tool (MCP server, Claude Code hook). Free, OSS, runs offline.

    run it

    on your own machines, one way per deploy method
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # once, as root:
docker build -t mcp-local/ai-surface:main 'https://github.com/apisec-inc/ai-surface.git#main'

#!/usr/bin/env bash
# ai-surface (io.github.apisec-inc/ai-surface), recipe docker (generated).
# Generated by Hub for toolset "my-agent"; started by mcp-my-agent-ai-surface.service.
set -euo pipefail
export HOST=127.0.0.1 PORT=8101
exec docker run --rm --name mcp-my-agent-ai-surface -p 127.0.0.1:${PORT}:8000 mcp-local/ai-surface:main

[Unit]
Description=MCP server ai-surface (toolset my-agent), generated by Hub
After=network-online.target docker.service
Wants=network-online.target

[Service]
Type=simple
User=mcp
Group=mcp
SupplementaryGroups=docker
EnvironmentFile=/etc/mcp/my-agent.env
Environment=HOME=/var/lib/mcp/ai-surface
WorkingDirectory=/var/lib/mcp/ai-surface
ExecStart=/opt/mcp/my-agent/bin/ai-surface.sh
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/mcp/ai-surface

[Install]
WantedBy=multi-user.target
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    docker build -t ai-surface 'https://github.com/apisec-inc/ai-surface.git#main'
docker run --rm -p 127.0.0.1:8101:8000 ai-surface
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # Generated by Hub for toolset "my-agent" (2026-10-18T18:46:34+00:00).
# Each package server runs behind a stdio->HTTP bridge and listens on localhost only.
#   cp .env.example .env    # fill the ${VAR}s
#   docker compose up -d && bash smoke.sh
# Remote servers are not here: clients reach them directly (see clients/).
name: mcp-my-agent
services:
  ai-surface:
    build:
      context: https://github.com/apisec-inc/ai-surface.git#main
    ports:
    - 127.0.0.1:8101:8000
    restart: unless-stopped
    x-note: 'CHANGE_ME: built from the repository''s Dockerfile, assuming it serves streamable HTTP at
      :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.'
volumes:
  npm-cache: {}
  uv-cache: {}
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # Generated by Hub for toolset "my-agent" (2026-10-18T18:46:34+00:00).
#   kubectl create namespace mcp
#   kubectl -n mcp create secret generic mcp-credentials --from-env-file=.env
#   kubectl apply -f kubernetes.yaml
# Services are cluster-internal: <name>.mcp.svc.cluster.local:8000/mcp. Put an ingress
# with auth in front before exposing any of them.
apiVersion: v1
kind: Namespace
metadata:
  name: mcp
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ai-surface
  namespace: mcp
  labels: &id001
    app: ai-surface
spec:
  replicas: 1
  selector:
    matchLabels: *id001
  template:
    metadata:
      labels: *id001
    spec:
      containers:
      - name: ai-surface
        image: CHANGE_ME
        ports:
        - containerPort: 8000
          name: http
        env: []
---
apiVersion: v1
kind: Service
metadata:
  name: ai-surface
  namespace: mcp
spec:
  selector:
    app: ai-surface
  ports:
  - port: 8000
    targetPort: http
    name: http
    generated from the record, not tested yet
    CHANGE_ME: built from the repository's Dockerfile, assuming it serves streamable HTTP at :8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.
    # Generated by Hub for toolset "my-agent" (2026-10-18T18:46:34+00:00).
# Credentials come from the Secret 'mcp-credentials' (kubectl create secret generic ... --from-env-file=.env).
# Each server under `servers` is one Deployment + Service; the keys after it configure
# upstream charts a worker verified.
servers:
  ai-surface:
    enabled: true
    replicas: 1
    port: 8000
    path: /mcp
    container:
      name: ai-surface
      image: CHANGE_ME
      ports:
      - containerPort: 8000
        name: http
      env: []

# helm install my-agent helm/my-agent -n mcp

    Scanned github.com/apisec-inc/ai-surface at 7e57dc930fb2 with [email protected][email protected] on 2026-10-17 before the build: 0 dependencies, no known vulnerabilities, nothing in the code that looks malicious.

    in the cloud

    one click: the provider's deploy form opens filled in, in your own account
    koyeb
    deploy to koyeb

    Clients connect to the service's https://…koyeb.app address plus /mcp.

    cloud run
    run on google cloud

    Cloud Shell clones the repository, builds its Dockerfile and deploys it to Cloud Run.

    Cloud Run sends requests to $PORT (8080); the recipe expects :8000, so the server has to read PORT, or set the container port on the service afterwards.

    connect to it

    copy what your client needs
    {
  "mcpServers": {
    "ai-surface": {
      "command": "CHANGE_ME",
      "args": []
    }
  }
}
    #!/usr/bin/env bash
# Registers every server with Claude Code (run once; `claude mcp list` to check).
set -euo pipefail
set -a; [ -f .env ] && source .env; set +a
claude mcp add ai-surface -- CHANGE_ME

    {
  "mcpServers": {
    "ai-surface": {
      "command": "CHANGE_ME",
      "args": []
    }
  }
}
    {
  "servers": {
    "ai-surface": {
      "type": "stdio",
      "command": "CHANGE_ME",
      "args": []
    }
  }
}
    name: my-agent
target: local
servers:
- hub: io.github.apisec-inc/ai-surface
    • not probed yet: tools unpinned, ingest lists them
    • no tested recipe for target 'local' yet: build it from https://github.com/apisec-inc/AI-Surface by hand, or wait for the worker

    tools

    Probe result: faileddocker: the container exited: ::group::ai-surface scan /github/workspace AI surfaces detected: 0 Risk indicators: 0 ::endgroup::

    runs · 1

    the latest tests of this entry by the hub and its workers, newest first
    dateworkermethodstatussandboxreason
    2026-10-17 19:16 local-mac-vm docker failed gvisor docker: the container exited: ::group::ai-surface scan /github/workspace AI surfaces detected: 0 Risk indicators: 0 ::endgroup::