# Censys MCP for AI Agents AI Agent Connect > Censys MCP lets you search for internet-connected hosts, SSL certificates, and your organization's attack surface. Use it to find exposed services, track vulnerabilities, and analyze certificate distributions through your AI client. It turns complex security data into actionable insights without you needing to juggle multiple tabs. ## Overview - **Category:** fort-knox - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_s8bUKfbc9OS3leqa10RhKd63iRfAGn5ERJCnUH87/ai-agent-connect - **Tags:** internet-scanning, attack-surface, ssl-certificates, threat-intelligence, network-security, ip-lookup ## Description Imagine you need to figure out every server in a specific country running a certain version of Nginx. Right now, you're probably jumping between search filters, manually exporting CSVs, and trying to spot patterns in a mess of raw data. This Connector changes that by letting you just ask your AI client to do the heavy lifting. Instead of clicking through pages of results, you get a direct line to the world's largest internet scanning platform. You can ask about specific IP histories, find every host sharing a single certificate, or see how a target's infrastructure has shifted over the last few months. Whether you're hunting for a specific vulnerability or just trying to map out a competitor's footprint, this tool puts that data front and center. It's a core part of the Vinkius catalog, making it easy to plug into your existing setup so you can focus on the actual security work rather than the data gathering. ## Tools ### get_host Pull open ports, service banners, and OS info for a specific IP address. This gives you a snapshot of a host's exposure. ### get_certificate Get full parsed data for a specific certificate using its fingerprint. This provides a deep look at the certificate's metadata. ### get_certificate_hosts Find all domains and IPs that share a specific SSL certificate. It's a fast way to find related assets. ### get_host_history See how a host's ports and certificates have changed over time. This is great for spotting infrastructure drift. ### search_hosts Search for internet-connected hosts using service names, ports, or locations. This is your primary way to find targets. ### view_host_diff Compare two hosts to identify differences in their infrastructure. Use this to find discrepancies between environments. ### aggregate_hosts Group results by fields like country or port to see distribution patterns. This helps you understand the layout of a target's infrastructure. ### get_account_info Check your remaining API quota and account limits quickly. This helps you stay within your plan's limits. ### search_certificates Search for SSL/TLS certificates using issuers, subjects, or validity dates. Use this to find specific certificate types. ## Prompt Examples **Prompt:** ``` Find all nginx servers in Brazil. ``` **Response:** ``` ### Nginx Servers in Brazil I found several clusters of Nginx servers across various regions in Brazil. **Top Locations:** * São Paulo * Rio de Janeiro * Brasília **Common Ports:** * **80** (HTTP) * **443** (HTTPS) * **8080** (HTTP Alternate) **Common OS Detected:** * Ubuntu * Debian * CentOS *Note: These results are based on the latest internet scan data.* ``` **Prompt:** ``` Get details for IP 8.8.8.8. ``` **Response:** ``` **Host Details: 8.8.8.8 (Google Public DNS)** * **Open Ports:** 53 (DNS), 443 (HTTPS/DoH) * **Services:** DNS server, DNS over HTTPS * **Location:** Mountain View, CA, US * **ASN:** AS15169 (Google LLC) * **Last Updated:** 2 hours ago * **OS Detection:** Linux This host is primarily used for public DNS resolution. ``` **Prompt:** ``` Find certificates issued by Let's Encrypt expiring this month. ``` **Response:** ``` ### Let's Encrypt Certificates Expiring This Month I've identified several certificates from Let's Encrypt that are set to expire within the next 30 days. | Subject | Issuer | Expiration Date | | :--- | :--- | :--- | | example-domain.com | R3 | 2024-05-20 | | test-site.org | E1 | 2024-05-22 | | dev-app.net | E5 | 2024-05-25 | **Summary:** Most of these use RSA 2048-bit or ECDSA P-256 keys. ``` ## Capabilities ### Search internet-connected hosts Find hosts based on specific services, ports, operating systems, or geographic locations. ### Pull detailed host info Get service banners, TLS certificates, and OS detection for any specific IP address. ### Track infrastructure history See how a host's ports and certificates have changed over time. ### Find shared certificates Identify every domain and IP address that uses a specific SSL certificate fingerprint. ### Analyze data distributions Group search results by country, ASN, or port to see broader trends. ### Compare host configurations Identify differences between two hosts to find infrastructure discrepancies. ### Query SSL certificate data Search for certificates by issuer, subject, validity dates, and more. ## Use Cases ### Finding regional server clusters A researcher wants to find all Nginx servers in Brazil. They ask the agent to search_hosts with specific filters for the region and service. ### Monitoring infrastructure drift A sysadmin needs to see if a server's ports have changed in the last month. They use get_host_history to see what the scanner saw. ### Identifying certificate leaks A threat hunter wants to see every domain using a stolen certificate. They use get_certificate_hosts to get the full list of domains and IPs. ### Comparing production environments A security auditor wants to compare two production servers for config drift. They use view_host_diff to see the differences in infrastructure. ## Benefits - Stop manual data entry by using search_hosts to find targets instantly. - Spot infrastructure shifts faster with get_host_history to see what changed. - Identify shared assets quickly using get_certificate_hosts to find related domains. - Get a clear picture of global trends with aggregate_hosts to see port distributions. - Find specific vulnerabilities by using search_certificates to filter by issuer or date. - Compare environments easily with view_host_diff to see setup discrepancies. ## How It Works The bottom line is you get instant access to global internet scanning data through natural conversation. 1. Subscribe to the Censys MCP and grab your API credentials. 2. Input your API ID and Secret into your AI client's configuration. 3. Ask your agent to find specific hosts or scan for exposed services. ## Frequently Asked Questions **Can the Censys MCP find exposed databases?** Yes, it can. You can ask your agent to search for specific service ports and banners associated with common database software to find exposed instances. **How does the Censys MCP help with certificate leaks?** It allows you to find every host using a specific certificate fingerprint. This helps you identify if a certificate has been deployed on unauthorized domains. **Can I use the Censys MCP to see historical changes?** Yes, you can. It tracks how the ports, services, and certificates on a specific IP address have changed over time based on previous scans. **Does the Censys MCP support geographic searches?** Yes, it does. You can filter search results by country, region, or specific geographic locations to find internet-connected hosts in those areas. **Can the Censys MCP help with attack surface mapping?** Absolutely. It provides a way to query global internet data to see what services, ports, and certificates are publicly visible for any target. **Is the Censys MCP good for finding specific OS versions?** Yes, it returns OS detection data along with service banners for any IP you query, helping you identify the software running on a remote host. **How do I get Censys API credentials?** Sign up for a free account at [**censys.io**](https://censys.io), go to your account page and generate API credentials. Free tier includes limited queries per day. **What kind of hosts can I find?** Censys scans the entire IPv4 space regularly. You can find web servers, databases, SSH servers, mail servers, IoT devices, industrial control systems and any internet-facing service. **What query syntax is supported?** Censys supports powerful query syntax: service name (services.service_name: HTTP), port (services.port:443), certificate fields (parsed.subject.country: US), OS detection (metadata.os: Linux), ASN, geographic location and boolean operators (AND, OR, NOT).