MCP For Claude Marketplace
Censys

Censys MCP Connector for Claude

A+

Search internet-connected hosts, SSL certificates and attack surface — discover exposed services and vulnerabilities.

9 tools Official Updated Oct 1, 2026 Official Vinkius Partner
More Details Connect to Claude

Connect to Censys and explore the world's largest internet scanning platform through natural conversation.

What you can do

  • Host Search — Search internet-facing hosts by service, port, OS, location and more
  • Host Details — Get comprehensive info on any IP including all services and certificates
  • Host History — View how a host's services and ports have changed over time
  • Certificate Search — Find SSL/TLS certificates by issuer, subject, validity and more
  • Certificate Details — Get full parsed certificate data by fingerprint
  • Certificate Hosts — Find all hosts using a specific certificate
  • Aggregation — Analyze distributions of services, countries and ASNs
  • Host Diff — Compare two hosts to identify infrastructure differences

How it works

  1. Subscribe to this server
  2. Enter your Censys API ID and Secret
  3. Start exploring internet exposure data from Claude, Cursor, or any MCP-compatible client

Who is this for?

  • Security Researchers — discover exposed services, track vulnerabilities and analyze attack surfaces
  • Sysadmins — monitor their organization's external exposure and identify misconfigurations
  • Threat Hunters — track certificate usage, find related infrastructure and identify suspicious hosts
internet-scanningattack-surfacessl-certificatesthreat-intelligencenetwork-securityip-lookup

9 tools expose this connector's capabilities to your AI agent.

get_certificate_hosts

Useful for finding all domains sharing a certificate (SANs). Returns IP addresses, ports and timestamps. Pagination via cursor. Get hosts using a specific certificate

get_host_history

Shows how the host's services, ports and certificates have changed over time. Returns timestamps, services observed and changes detected. Pagination via cursor. Get historical scan data for a specific IP

view_host_diff

Useful for identifying changes between hosts or finding similar infrastructure. Compare two hosts to see differences

get_account_info

Useful for checking remaining API quota and account limits. Get your Censys account information

get_certificate

Returns the full parsed certificate including subject, issuer, validity, key info, extensions, CT logs and raw PEM data. Get detailed info for a specific certificate by fingerprint

get_host

Returns all open ports, service banners, TLS certificates, operating system detection, geolocation, autonomous system info and last updated timestamps. Get detailed info for a specific IP address

search_certificates

Supports query syntax: issuer names, subject fields, serial numbers, validity dates, key algorithms, certificate transparency logs and more. Returns fingerprints, subjects, issuers, validity periods and key info. Search for SSL/TLS certificates

search_hosts

Supports powerful query syntax: service names (e.g. "nginx"), ports (e.g. "services.port:443"), protocols, operating systems, autonomous systems, geographic locations and more. Returns IP addresses, open ports, services, banners and locations. Pagination via cursor. Search for internet-connected hosts

aggregate_hosts

Groups results by a specified field (e.g. "services.port", "location.country", "autonomous_system.name") and returns bucket counts. Useful for understanding the distribution of services, countries or ASNs matching a query. Aggregate host search results by a specific field

See how to talk to your AI agent using Censys.

Find all nginx servers in Brazil.

Found 15,000+ hosts running nginx in Brazil. Top ports: 80 (HTTP), 443 (HTTPS), 8080 (HTTP alternate). Common OS: Ubuntu, Debian, CentOS. Sample IPs include servers in São Paulo, Rio de Janeiro and Brasília regions.

Get details for IP 8.8.8.8.

8.8.8.8 (Google Public DNS): Open ports 53 (DNS), 443 (HTTPS/DoH). Services: DNS server, DNS over HTTPS. Location: Mountain View, CA, US. ASN: AS15169 (Google LLC). Last updated: 2 hours ago.

Find certificates issued by Let's Encrypt expiring this month.

Found 500+ Let's Encrypt certificates expiring this month. Top issuers: R3, E1, E5. Common subjects include domains ending in .com, .org and .net. Most use RSA 2048-bit or ECDSA P-256 keys.

Sign up for a free account at [**censys.io**](https://censys.io), go to your account page and generate API credentials. Free tier includes limited queries per day.

Related Connectors

IPinfo

IPinfo MCP

10 tools Official

Enrich IP addresses with geolocation, ASN, and WHOIS data directly from your AI agent using IPinfo's industry-leading intelligence.

A+ View details →
CrowdSec

CrowdSec MCP

3 tools Official

Automate threat intelligence via CrowdSec — query local decisions, stream security updates, and check global IP reputation directly from any AI agent.

A+ View details →
CrowdStrike Falcon

CrowdStrike Falcon MCP

8 tools Official

Detect threats, manage endpoints, investigate incidents, and query telemetry from CrowdStrike Falcon — the #1 endpoint detection and response platform.

A+ View details →
BattleMetrics

BattleMetrics MCP

12 tools Official

Global game server tracking and player analytics — monitor servers, search players, and audit bans via AI.

A+ View details →