Investigations, Now With Context
One of the hardest parts of managing an attack surface is maintaining visibility over assets and risks while keeping the investigative thread alive. Analysts today spend hours jumping between dashboards, APIs, and multiple security tools just to stitch context together.
The new Censys ASM MCP Server changes that. It makes ASM queries and API interactions easy. Instead of fragmented, one-off lookups, it enables continuous, context-rich investigations inside your AI assistant of choice. You can start broad — “What new assets appeared in my attack surface with critical risks in the last 24 hours?” — then immediately refine: “Show only the ones in AWS,” followed by “Which have internet-facing RDP?” The MCP Server remembers where you are in the investigation, carrying the thread forward like a trusted co-analyst.
The result: you spend less time re-querying, and more time driving an investigation forward, thus improving your Mean Time to Detect (MTTD) the risks and vulnerabilities.
Why MCP Matters for ASM
The MCP (Model Context Protocol) is more than a way to talk to APIs in natural language. It’s a framework that allows different security tools to share state and context through AI agents.
With the Censys ASM MCP Server:
- Stay in context: Follow an investigation thread across multiple questions.
- Structure investigations and automate: Collect data at scale such as pulling inventories, risks and asset details without requiring complex queries. Structure results into usable context and let your analysts ask follow-up questions in plain language and refine the investigation without starting over.
- Go beyond ASM: Link Censys ASM with the Censys Platform MCP Server (and your other MCP-supported tools) to blend datasets and accelerate discovery. For example, start with ASM to see new assets, then pivot into the Censys Platform to pull certificate history or service details instantly.
This isn’t about replacing dashboards. It’s about transforming your AI assistant into a security co-pilot that can stitch together insights across systems and hand you a ready-made picture.
What You Can Do With ASM MCP Today
The ASM MCP Server unlocks a wide range of tasks that analysts typically juggle across multiple dashboards and APIs. With natural language prompts, you can for example:
- Discover change at scale – Identify new assets added to your attack surface in the last 24 hours and see which carry critical risks.
- Monitor certificates – List all hosts with expiring or expired certificates, then group them by business unit or risk severity.
- Investigate in depth – Pull risk data for a single IP or hostname, then pivot into certificate or service history via the Censys Platform MCP without leaving your AI workspace.
- Summarize and prioritize – Aggregate risks across your inventory and have your AI assistant structure them into a digestible summary for triage.
What once required pivots across multiple dashboards and API queries is now condensed into a single, fluid workflow — one question leading to the next, with the MCP server carrying context forward and structuring results into actionable insights.
Why This Matters for Security Teams
The true value isn’t in saving a few clicks — it’s in transforming how teams work:
- Analysts stay focused on investigation, not mechanics.
- Context and findings aren’t lost in translation between tools.
- Cross-tool workflows emerge, where ASM data is combined with scanning, certificate, vulnerability or threat datasets without exporting and re-joining manually.
The MCP Server unlocks a new way of working: AI-driven investigations feel more natural, faster, and less error-prone.
Start Exploring
The ASM MCP Server is more than just a new feature — it’s a new way of working. By turning your AI assistant into an investigative co-pilot, it transforms raw attack surface data into structured, actionable insights that flow naturally from question to question. This is the future of ASM: faster investigations, continuous context, and smarter decisions made in minutes instead of hours.
If you’re a Censys ASM customer, you can get started with the ASM MCP Server today. If you are new to Censys, schedule a demo to see how ASM and the MCP Server can help transform your attack surface investigations.
