# Censys

Search Censys for internet-exposed hosts, certificates, and services, host lookups...

- Repository: https://github.com/taracodlabs/aiden (868 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-10-19
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add taracodlabs/aiden --skill censys -g -a claude-code -y`
Codex: `npx skills add taracodlabs/aiden --skill censys -g -a codex -y`
Cursor: `npx skills add taracodlabs/aiden --skill censys -g -a cursor -y`
Gemini CLI: `npx skills add taracodlabs/aiden --skill censys -g -a gemini-cli -y`

## Description

Search Censys for internet-exposed hosts, certificates, and services, host lookups, queries, and certificate analysis

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Censys, Internet Asset Discovery

Censys continuously scans the public internet and indexes detailed metadata about every reachable host: open ports, running services, TLS certificates, and BGP routing information. Complementary to Shodan with different scanner vantage points and richer certificate data.

**Requires:** `CENSYS_API_ID` and `CENSYS_API_SECRET`, free tier at https://search.censys.io/register (0.4 req/sec, 250 queries/month).

## When to Use

- Look up what Censys sees on a specific IP address
- Discover internet-exposed assets for a given organisation or ASN
- Investigate TLS certificates, find all hosts sharing a certificate or subject
- Security audit: verify which services are visible from the public internet
- User asks "what does Censys show for IP X", "find hosts with this certificate", "look up ASN exposure"

## How to Use

### Look up a specific host by IP

```powershell
$ip       = "8.8.8.8"
$id       = $env:CENSYS_API_ID
$secret   = $env:CENSYS_API_SECRET
$b64      = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("${id}:${secret}"))
$headers  = @{ Authorization = "Basic $b64" }

$result = Invoke-RestMethod -Uri "https://search.censys.io/api/v2/hosts/$ip" -Headers $headers
$r      = $result.result
Write-Host "IP:           $($r.ip)"
Write-Host "AS:           $($r.autonomous_system.name) (ASN $($r.autonomous_system.asn))"
Write-Host "Country:      $($r.location.country)"
Write-Host "Open ports:"
$r.services | ForEach-Object {
    Write-Host "  $($_.port)/$($_.transport_protocol), $($_.service_name)"
}
```

### Search with a query string

```powershell
$query    = "services.service_name: HTTP and location.country_code: IN"
$b64      = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("$($env:CENSYS_API_ID):$($env:CENSYS_API_SECRET)"))
$headers  = @{ Authorization = "Basic $b64" }
$encoded  = [Uri]::EscapeDataString($query)

The rest: https://github.com/taracodlabs/aiden/blob/HEAD/workspace-templates/skills/censys/SKILL.md