wass-mcp

@tb0hdan/wass-mcp

0 Stars 2 次浏览 tb0hdan 更新于 2026-08-23

MCP server for web application security scanning

开发者工具

该服务暂未提供标准配置，请参考 README 手动接入

可用工具（5 个）

该服务在 MCP 协议中暴露的工具，AI 可按需调用

tavily_search 14 个参数需填 1 项 Search the web for current information on any topic. Use for news, facts, or data beyond your knowledge cutoff. Returns snippets and source URLs.

Search the web for current information on any topic. Use for news, facts, or data beyond your knowledge cutoff. Returns snippets and source URLs.

必填参数：query

tavily_extract 6 个参数需填 1 项 Extract content from URLs. Returns raw page content in markdown or text format.

Extract content from URLs. Returns raw page content in markdown or text format.

必填参数：urls

tavily_crawl 11 个参数需填 1 项 Crawl a website starting from a URL. Extracts content from pages with configurable depth and breadth.

Crawl a website starting from a URL. Extracts content from pages with configurable depth and breadth.

必填参数：url

tavily_map 8 个参数需填 1 项 Map a website's structure. Returns a list of URLs found starting from the base URL.

Map a website's structure. Returns a list of URLs found starting from the base URL.

必填参数：url

tavily_research 2 个参数需填 1 项 Perform comprehensive research on a given topic or question. Use this tool when you need to gather information from multiple sources to answer a question or complete a task. Returns a detailed response based on the research findings.

Perform comprehensive research on a given topic or question. Use this tool when you need to gather information from multiple sources to answer a question or complete a task. Returns a detailed response based on the research findings.

必填参数：input

服务介绍

WASS-MCP

A Model Context Protocol (MCP) server for web application security scanning.

Features

MCP Protocol Support - Full compatibility with MCP clients (Claude, etc.)
Nikto Integration - Web server vulnerability scanning
Nuclei Integration - Template-based vulnerability scanning
Wapiti Integration - Web application vulnerability scanning
Execution History - Persistent storage of scan results
Stateless Design - Survives server restarts without session errors
RESTful HTTP Transport - Streamable HTTP-based MCP protocol

Usage

docker run -p 127.0.0.1:8989:8989 tb0hdan/wass-mcp

MCP Client Configuration

Example command to add WASS-MCP server to Claude MCP clients:

claude mcp add wass-mcp --transport http http://127.0.0.1:8989

or Gemini:

gemini mcp add wass-mcp --transport http http://127.0.0.1:8989

Available Tools

nikto

Perform web server vulnerability scans using Nikto.

Parameters:

Name	Type	Required	Description
`host`	string	Yes	Target hostname or IP address
`port`	integer	No	Target port (default: 80)
`vhost`	string	No	Virtual host header
`max_lines`	integer	No	Maximum output lines
`offset`	integer	No	Output line offset

Example:

{
  "host": "192.168.1.100",
  "port": 443
}

nuclei

Perform template-based vulnerability scanning using Nuclei.

Parameters:

Name	Type	Required	Description
`host`	string	Yes	Target hostname or IP address
`port`	integer	No	Target port (default: 80)
`vhost`	string	No	Virtual host header
`max_lines`	integer	No	Maximum output lines
`offset`	integer	No	Output line offset

Vulnerabilities Detected:

CVE detection via community templates
Misconfigurations
Exposed panels/dashboards
Default credentials
Technology detection
Security headers analysis
And many more via 8000+ community templates

Example:

{
  "host": "192.168.1.100",
  "port": 443
}

wapiti

Perform comprehensive web application vulnerability scans using Wapiti.

Parameters:

Name	Type	Required	Description
`host`	string	Yes	Target hostname or IP address
`port`	integer	No	Target port (default: 80)
`vhost`	string	No	Virtual host header
`max_lines`	integer	No	Maximum output lines
`offset`	integer	No	Output line offset

Vulnerabilities Detected:

SQL Injection / Blind SQL Injection
Cross-Site Scripting (XSS)
File Inclusion / Path Traversal
Command Execution
CRLF Injection
Server-Side Request Forgery (SSRF)
Open Redirects
HTTP Security Headers
Content Security Policy issues

Example:

{
  "host": "192.168.1.100",
  "port": 8080
}

full_scan

Perform a comprehensive security scan using all available scanners in parallel.

Parameters:

Name	Type	Required	Description
`host`	string	Yes	Target hostname or IP address
`port`	integer	No	Target port (default: 80)
`vhost`	string	No	Virtual host header
`max_lines`	integer	No	Maximum output lines
`offset`	integer	No	Output line offset

Features:

Runs nikto, nuclei and wapiti scanners in parallel
Merges results into a unified report
Includes timing and status for each scanner
Gracefully handles missing scanner binaries

Example:

{
  "host": "192.168.1.100",
  "port": 8080
}

history

Browse and manage tool execution history.

Parameters:

Name	Type	Required	Description
`action`	string	Yes	One of: `list`, `get`, `delete`, `clear`
`id`	integer	For get/delete	Execution ID
`limit`	integer	No	Results per page (default: 10)
`offset`	integer	No	Pagination offset

Actions:

list - List execution history with pagination
get - Get full details of a specific execution
delete - Delete a specific execution by ID
clear - Delete all execution history

API Endpoints

Endpoint	Description
`POST /mcp`	MCP protocol endpoint
`GET /`	Service information (JSON)
`GET /debug/pprof/*`	Profiling endpoints

Development and advanced usage

Source build requirements

Go 1.25+
Nikto (apt install nikto or equivalent)
Nuclei (go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest)
Wapiti (apt install wapiti or equivalent)
SQLite3

# Clone the repository
git clone https://github.com/tb0hdan/wass-mcp.git
cd wass-mcp

# Build
make build

# Run
./build/wass-mcp

Starting the Server

# Default (localhost:8989)
./build/wass-mcp

# Custom bind address
./build/wass-mcp --bind 0.0.0.0:8080

# Custom database path
./build/wass-mcp --db /var/lib/wass-mcp/data.db

# Debug mode
./build/wass-mcp --debug

Configuration Options

Flag	Default	Description
`--bind`	`localhost:8989`	HTTP server bind address
`--db`	`./wass-mcp.db`	SQLite database file path
`--debug`	`false`	Enable debug logging
`--version`	-	Print version and exit

Linting

make lint

Testing

make test

Project Structure

wass-mcp/
├── cmd/wass-mcp/        # Application entry point
├── pkg/
│   ├── server/          # MCP server wrapper
│   ├── storage/         # Database layer (SQLite/GORM)
│   ├── models/          # Data models
│   ├── tools/           # MCP tool implementations
│   │   ├── nikto/       # Nikto web server scanner
│   │   ├── wapiti/      # Wapiti web app scanner
│   │   ├── nuclei/      # Nuclei template scanner
│   │   ├── fullscan/    # Parallel full scan
│   │   └── history/     # History management
│   └── types/           # Shared types and constants
├── docs/                # Documentation
└── build/               # Build output and coverage reports

Security Notice

This tool is intended for authorized security testing only. Ensure you have proper authorization before scanning any systems. Unauthorized scanning may be illegal in your jurisdiction.

Project notes

For complete project notes, design decisions, and architecture overview, please refer to the Project Notes document.

License

Contributing

Fork the repository
Create a feature branch (git checkout -b feature/new-tool)
Commit your changes (git commit -am 'Add new scanning tool')
Push to the branch (git push origin feature/new-tool)
Create a Pull Request

Acknowledgments

Model Context Protocol - Protocol specification
Nikto - Web server scanner
Nuclei - Template-based vulnerability scanner
Wapiti - Web application vulnerability scanner
GORM - Go ORM library

查看源码项目主页

可用工具 （5 个）

服务介绍

WASS-MCP

Features

Usage

MCP Client Configuration

Available Tools

nikto

nuclei

wapiti

full_scan

history

API Endpoints

Development and advanced usage

Source build requirements

Starting the Server

Configuration Options

Linting

Testing

Project Structure

Security Notice

Project notes

License

Contributing

Acknowledgments

相关 MCP 服务

开源版 与 企业版

企业版（含 FDE 交付）

技能定制开发服务

可用工具（5 个）

开源版与企业版