{
  "markdown": "# WASS-MCP\n\nA Model Context Protocol (MCP) server for web application security scanning.\n\n## Features\n\n- **MCP Protocol Support** - Full compatibility with MCP clients (Claude, etc.)\n- **Nikto Integration** - Web server vulnerability scanning\n- **Nuclei Integration** - Template-based vulnerability scanning\n- **Wapiti Integration** - Web application vulnerability scanning\n- **Shcheck Integration** - Security headers analysis\n- **Execution History** - Persistent storage of scan results\n- **Stateless Design** - Survives server restarts without session errors\n- **RESTful HTTP Transport** - Streamable HTTP-based MCP protocol\n\n\n## Usage\n\n```bash\ndocker run -p 127.0.0.1:8989:8989 tb0hdan/wass-mcp\n```\n\n### MCP Client Configuration\n\nExample command to add WASS-MCP server to Claude MCP clients:\n\n```bash\nclaude mcp add wass-mcp --transport http http://127.0.0.1:8989\n```\n\nor Gemini:\n\n```bash\ngemini mcp add wass-mcp --transport http http://127.0.0.1:8989\n```\n\n## Available Tools\n\n### nikto\n\nPerform web server vulnerability scans using Nikto.\n\n**Parameters:**\n\n| Name | Type | Required | Description |\n|------|------|----------|-------------|\n| `host` | string | Yes | Target hostname or IP address |\n| `port` | integer | No | Target port (default: 80) |\n| `vhost` | string | No | Virtual host header |\n| `max_lines` | integer | No | Maximum output lines |\n| `offset` | integer | No | Output line offset |\n\n**Example:**\n\n```json\n{\n  \"host\": \"192.168.1.100\",\n  \"port\": 443\n}\n```\n\n### nuclei\n\nPerform template-based vulnerability scanning using Nuclei.\n\n**Parameters:**\n\n| Name | Type | Required | Description |\n|------|------|----------|-------------|\n| `host` | string | Yes | Target hostname or IP address |\n| `port` | integer | No | Target port (default: 80) |\n| `vhost` | string | No | Virtual host header |\n| `max_lines` | integer | No | Maximum output lines |\n| `offset` | integer | No | Output line offset |\n\n**Vulnerabilities Detected:**\n- CVE detection via community templates\n- Misconfigurations\n- Exposed panels/dashboards\n- Default credentials\n- Technology detection\n- Security headers analysis\n- And many more via 8000+ community templates\n\n**Example:**\n\n```json\n{\n  \"host\": \"192.168.1.100\",\n  \"port\": 443\n}\n```\n\n### wapiti\n\nPerform comprehensive web application vulnerability scans using Wapiti.\n\n**Parameters:**\n\n| Name | Type | Required | Description |\n|------|------|----------|-------------|\n| `host` | string | Yes | Target hostname or IP address |\n| `port` | integer | No | Target port (default: 80) |\n| `vhost` | string | No | Virtual host header |\n| `max_lines` | integer | No | Maximum output lines |\n| `offset` | integer | No | Output line offset |\n\n**Vulnerabilities Detected:**\n- SQL Injection / Blind SQL Injection\n- Cross-Site Scripting (XSS)\n- File Inclusion / Path Traversal\n- Command Execution\n- CRLF Injection\n- Server-Side Request Forgery (SSRF)\n- Open Redirects\n- HTTP Security Headers\n- Content Security Policy issues\n\n**Example:**\n\n```json\n{\n  \"host\": \"192.168.1.100\",\n  \"port\": 8080\n}\n```\n\n### shcheck_py\n\nAnalyze HTTP security headers using shcheck.py.\n\n**Parameters:**\n\n| Name | Type | Required | Description |\n|------|------|----------|-------------|\n| `host` | string | Yes | Target hostname or IP address |\n| `port` | integer | No | Target port (default: 80) |\n| `vhost` | string | No | Virtual host header |\n| `max_lines` | integer | No | Maximum output lines |\n| `offset` | integer | No | Output line offset |\n\n**Headers Analyzed:**\n- Content-Security-Policy\n- Strict-Transport-Security\n- X-Frame-Options\n- X-Content-Type-Options\n- Referrer-Policy\n- Permissions-Policy\n- And other security-relevant headers\n\n**Example:**\n\n```json\n{\n  \"host\": \"example.com\",\n  \"port\": 443\n}\n```\n\n### full_scan\n\nPerform a comprehensive security scan using all available scanners in parallel.\n\n**Parameters:**\n\n| Name | Type | Required | Description |\n|------|------|----------|-------------|\n| `host` | string | Yes | Target hostname or IP address |\n| `port` | integer | No | Target port (default: 80) |\n| `vhost` | string | No | Virtual host header |\n| `max_lines` | integer | No | Maximum output lines |\n| `offset` | integer | No | Output line offset |\n\n**Features:**\n- Runs nikto, nuclei, wapiti and shcheck scanners in parallel\n- Merges results into a unified report\n- Includes timing and status for each scanner\n- Gracefully handles missing scanner binaries\n\n**Example:**\n\n```json\n{\n  \"host\": \"192.168.1.100\",\n  \"port\": 8080\n}\n```\n\n### history\n\nBrowse and manage tool execution history.\n\n**Parameters:**\n\n| Name | Type | Required | Description |\n|------|------|----------|-------------|\n| `action` | string | Yes | One of: `list`, `get`, `delete`, `clear` |\n| `id` | integer | For get/delete | Execution ID |\n| `limit` | integer | No | Results per page (default: 10) |\n| `offset` | integer | No | Pagination offset |\n\n**Actions:**\n\n- `list` - List execution history with pagination\n- `get` - Get full details of a specific execution\n- `delete` - Delete a specific execution by ID\n- `clear` - Delete all execution history\n\n## API Endpoints\n\n| Endpoint | Description |\n|----------|-------------|\n| `POST /mcp` | MCP protocol endpoint |\n| `GET /` | Service information (JSON) |\n| `GET /debug/pprof/*` | Profiling endpoints |\n\n## Development and advanced usage\n\n### Source build requirements\n\n- Go 1.25+\n- Nikto (`apt install nikto` or equivalent)\n- Nuclei (`go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest`)\n- Wapiti (`apt install wapiti` or equivalent)\n- Shcheck (`pip install shcheck` or from [GitHub](https://github.com/santoru/shcheck))\n- SQLite3\n- \n```bash\n# Clone the repository\ngit clone https://github.com/tb0hdan/wass-mcp.git\ncd wass-mcp\n\n# Build\nmake build\n\n# Run\n./build/wass-mcp\n```\n\n### Starting the Server\n\n```bash\n# Default (localhost:8989)\n./build/wass-mcp\n\n# Custom bind address\n./build/wass-mcp --bind 0.0.0.0:8080\n\n# Custom database path\n./build/wass-mcp --db /var/lib/wass-mcp/data.db\n\n# Debug mode\n./build/wass-mcp --debug\n```\n\n### Configuration Options\n\n| Flag | Default | Description |\n|------|---------|-------------|\n| `--bind` | `localhost:8989` | HTTP server bind address |\n| `--db` | `./wass-mcp.db` | SQLite database file path |\n| `--debug` | `false` | Enable debug logging |\n| `--version` | - | Print version and exit |\n\n\n### Linting\n\n```bash\nmake lint\n```\n\n### Testing\n\n```bash\nmake test\n```\n\n### Project Structure\n\n```\nwass-mcp/\n├── cmd/wass-mcp/        # Application entry point\n├── pkg/\n│   ├── server/          # MCP server wrapper\n│   ├── storage/         # Database layer (SQLite/GORM)\n│   ├── models/          # Data models\n│   ├── tools/           # MCP tool implementations\n│   │   ├── nikto/       # Nikto web server scanner\n│   │   ├── wapiti/      # Wapiti web app scanner\n│   │   ├── nuclei/      # Nuclei template scanner\n│   │   ├── shcheck/     # Security headers checker\n│   │   ├── fullscan/    # Parallel full scan\n│   │   └── history/     # History management\n│   └── types/           # Shared types and constants\n├── docs/                # Documentation\n└── build/               # Build output and coverage reports\n```\n\n## Security Notice\n\nThis tool is intended for **authorized security testing only**. Ensure you have proper authorization before scanning any systems. Unauthorized scanning may be illegal in your jurisdiction.\n\n## Project notes\n\nFor complete project notes, design decisions, and architecture overview, please refer to the [Project Notes](docs/PROJECT_NOTES.md) document.\n\n## License\n\nBSD 3-Clause License - Copyright (c) 2026, Bohdan Turkynevych. See [LICENSE](LICENSE) for details.\n\n## Contributing\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature/new-tool`)\n3. Commit your changes (`git commit -am 'Add new scanning tool'`)\n4. Push to the branch (`git push origin feature/new-tool`)\n5. Create a Pull Request\n\n## Acknowledgments\n\n- [Model Context Protocol](https://modelcontextprotocol.io/) - Protocol specification\n- [Nikto](https://cirt.net/Nikto2) - Web server scanner\n- [Nuclei](https://github.com/projectdiscovery/nuclei) - Template-based vulnerability scanner\n- [Wapiti](https://wapiti-scanner.github.io/) - Web application vulnerability scanner\n- [Shcheck](https://github.com/santoru/shcheck) - Security headers checker\n- [GORM](https://gorm.io/) - Go ORM library\n",
  "bytes": 8317,
  "sha": "6bfcca8705a64e7d38c3731f04afe53ddc198f56213f2ae3bcc598f78db4e72f",
  "repo_slug": "tb0hdan/wass-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_tb0hdan_wass_mcp_b6df636b/readme"
}