{
  "$schema": "https://static.modelcontextprotocol.io/schemas/mcp-server-card/v1.json",
  "version": "1.0",
  "protocolVersion": "2025-06-18",
  "serverInfo": {
    "name": "zoomeye",
    "title": "ZoomEye Cyberspace Search Engine",
    "version": "1.0.0"
  },
  "description": "ZoomEye is a cyberspace search engine that indexes global internet devices, websites, services and components. Search network assets via dork queries for CVE impact assessment, Bug Bounty asset discovery, attack surface analysis, and global exposure monitoring. Supports 40+ search fields including device fingerprints, SSL/TLS certs, HTTP headers, geolocation, and advanced fields like vul.cve, is_bugbounty, is_new, is_changed.",
  "iconUrl": "https://www.zoomeye.org/favicon.ico",
  "documentationUrl": "https://www.zoomeye.org/doc",
  "transport": {
    "type": "streamable-http",
    "endpoint": "/api"
  },
  "capabilities": {
    "tools": { "listChanged": true }
  },
  "authentication": {
    "required": true,
    "schemes": ["bearer"]
  },
  "instructions": "ZoomEye provides browser-side WebMCP tools via document.modelContext for dork syntax reference and search URL construction. No API key required for syntax reference tools. For backend API access, authentication is required via Cube-Authorization bearer token header.",
  "tools": [
    {
      "name": "zoomeye_syntax_reference",
      "title": "ZoomEye Search Syntax Reference",
      "description": "Get ZoomEye dork search syntax, fields, operators, rules, and natural-language-to-dork conversion examples. Covers 40+ search fields: device & service fingerprints (app, service, device, os, title), IP/domain/org (ip, cidr, port, asn), geolocation (country, subdivisions, city), SSL/TLS certificates (ssl, ssl.cert.*, ssl.jarm, ssl.ja3s), HTTP headers & body, protocol banners, favicon hashes, and advanced fields (vul.cve, is_bugbounty, bugbounty.source, is_changed, is_new). Does not call any backend API.",
      "inputSchema": {
        "type": "object",
        "properties": {
          "field": {
            "type": "string",
            "description": "Optional field name to look up details. E.g. app, port, ssl, vul.cve, is_bugbounty, ssl.jarm."
          },
          "category": {
            "type": "string",
            "description": "Optional category filter. E.g. 'Geolocation', 'HTTP Headers & Body', 'SSL/TLS Certificates', 'Device & Service Fingerprints', 'IP, Domain & Organization', 'Protocol Banners, Hashes & Time', 'Additional Fields'."
          },
          "mode": {
            "type": "string",
            "enum": ["examples"],
            "description": "Set to 'examples' to output natural-language-to-dork conversion examples."
          }
        }
      }
    },
    {
      "name": "zoomeye_build_search_url",
      "title": "Build ZoomEye Search URL",
      "description": "Build a ZoomEye search page URL from a valid dork query. Constructs the URL only, does not call any backend API. Supports v4 (IPv4 devices, default), v6 (IPv6), web (websites/domains), and all (everything) search types.",
      "inputSchema": {
        "type": "object",
        "properties": {
          "dork": {
            "type": "string",
            "description": "A valid ZoomEye dork query string. Examples: country=\"US\" && service=\"ssh\", vul.cve=\"CVE-2021-44228\", is_bugbounty=true && app=\"GitLab\", service=\"redis\" && is_new=true."
          },
          "sub_type": {
            "type": "string",
            "enum": ["v4", "v6", "web", "all"],
            "description": "Search data type. v4=IPv4 devices (default), v6=IPv6, web=websites/domains, all=everything."
          }
        },
        "required": ["dork"]
      }
    }
  ]
}