io.github.tb0hdan/wass-mcp

MCP server for web application security scanning
Open source Open in the app JSON README (API)
About

MCP server for web application security scanning
Details

Kind: MCP servers
Topic: Security & identity
Publisher: tb0hdan
Origin: official
Category: ferramentas
Transport: desconhecido
Version: 1.0.4
Stars: 7
Forks: 2
Last push: 2026-03-18T18:51:47Z
Repository state: ativo
Language: Go
License: BSD-3-Clause
Added: 2026-08-29 04:01:30
Updated: 2026-08-29 04:01:30
Origin id: io.github.tb0hdan/wass-mcp
README

# WASS-MCP

A Model Context Protocol (MCP) server for web application security scanning.

## Features

- **MCP Protocol Support** - Full compatibility with MCP clients (Claude, etc.)
- **Nikto Integration** - Web server vulnerability scanning
- **Nuclei Integration** - Template-based vulnerability scanning
- **Wapiti Integration** - Web application vulnerability scanning
- **Shcheck Integration** - Security headers analysis
- **Execution History** - Persistent storage of scan results
- **Stateless Design** - Survives server restarts without session errors
- **RESTful HTTP Transport** - Streamable HTTP-based MCP protocol


## Usage

```bash
docker run -p 127.0.0.1:8989:8989 tb0hdan/wass-mcp
```

### MCP Client Configuration

Example command to add WASS-MCP server to Claude MCP clients:

```bash
claude mcp add wass-mcp --transport http http://127.0.0.1:8989
```

or Gemini:

```bash
gemini mcp add wass-mcp --transport http http://127.0.0.1:8989
```

## Available Tools

### nikto

Perform web server vulnerability scans using Nikto.

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `host` | string | Yes | Target hostname or IP address |
| `port` | integer | No | Target port (default: 80) |
| `vhost` | string | No | Virtual host header |
| `max_lines` | integer | No | Maximum output lines |
| `offset` | integer | No | Output line offset |

**Example:**

```json
{
  "host": "192.168.1.100",
  "port": 443
}
```

### nuclei

Perform template-based vulnerability scanning using Nuclei.

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `host` | string | Yes | Target hostname or IP address |
| `port` | integer | No | Target port (default: 80) |
| `vhost` | string | No | Virtual host header |
| `max_lines` | integer | No | Maximum output lines |
| `offset` | integer | No | Output line offset |

**Vulnerabilities Detected:**
- CVE detection via community templates
- Misconfigurations
- Exposed panels/dashboards
- Default credentials
- Technology detection
- Security headers analysis
- And many more via 8000+ community templates

**Example:**

```json
{
  "host": "192.168.1.100",
  "port": 443
}
```

### wapiti

Perform comprehensive web application vulnerability scans using Wapiti.

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `host` | string | Yes | Target hostname or IP address |
| `port` | integer | No | Target port (default: 80) |
| `vhost` | string | No | Virtual host header |
| `max_lines` | integer | No | Maximum output lines |
| `offset` | integer | No | Output line offset |

**Vulnerabilities Detected:**
- SQL Injection / Blind SQL Injection
- Cross-Site Scripting (XSS)
- File Inclusion / Path Traversal
- Command Execution
- CRLF Injection
- Server-Side Request Forgery (SSRF)
- Open Redirects
- HTTP Security Headers
- Content Security Policy issues

**Example:**

```json
{
  "host": "192.168.1.100",
  "port": 8080
}
```

### shcheck_py

Analyze HTTP security headers using shcheck.py.

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `host` | string | Yes | Target hostname or IP address |
| `port` | integer | No | Target port (default: 80) |
| `vhost` | string | No | Virtual host header |
| `max_lines` | integer | No | Maximum output lines |
| `offset` | integer | No | Output line offset |

**Headers Analyzed:**
- Content-Security-Policy
- Strict-Transport-Security
- X-Frame-Options
- X-Content-Type-Options
- Referrer-Policy
- Permissions-Policy
- And other security-relevant headers

**Example:**

```json
{
  "host": "example.com",
  "port": 443
}
```

### full_scan

Perform a comprehensive security scan using all available scanners in parallel.

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `host` | string | Yes | Target hostname or IP address |
| `port` | integer | No | Target port (default: 80) |
| `vhost` | string | No | Virtual host header |
| `max_lines` | integer | No | Maximum output lines |
| `offset` | integer | No | Output line offset |

**Features:**
- Runs nikto, nuclei, wapiti and shcheck scanners in parallel
- Merges results into a unified report
- Includes timing and status for each scanner
- Gracefully handles missing scanner binaries

**Example:**

```json
{
  "host": "192.168.1.100",
  "port": 8080
}
```

### history

Browse and manage tool execution history.

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `action` | string | Yes | One of: `list`, `get`, `delete`, `clear` |
| `id` | integer | For get/delete | Execution ID |
| `limit` | integer | No | Results per page (default: 10) |
| `offset` | integer | No | Pagination offset |

**Actions:**

- `list` - List execution history with pagination
- `get` - Get full details of a specific execution
- `delete` - Delete a specific execution by ID
- `clear` - Delete all execution history

## API Endpoints

| Endpoint | Description |
|----------|-------------|
| `POST /mcp` | MCP protocol endpoint |
| `GET /` | Service information (JSON) |
| `GET /debug/pprof/*` | Profiling endpoints |

## Development and advanced usage

### Source build requirements

- Go 1.25+
- Nikto (`apt install nikto` or equivalent)
- Nuclei (`go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest`)
- Wapiti (`apt install wapiti` or equivalent)
- Shcheck (`pip install shcheck` or from [GitHub](https://github.com/santoru/shcheck))
- SQLite3
- 
```bash
# Clone the repository
git clone https://github.com/tb0hdan/wass-mcp.git
cd wass-mcp

# Build
make build

# Run
./build/wass-mcp
```

### Starting the Server

```bash
# Default (localhost:8989)
./build/wass-mcp

# Custom bind address
./build/wass-mcp --bind 0.0.0.0:8080

# Custom database path
./build/wass-mcp --db /var/lib/wass-mcp/data.db

# Debug mode
./build/wass-mcp --debug
```

### Configuration Options

| Flag | Default | Description |
|------|---------|-------------|
| `--bind` | `localhost:8989` | HTTP server bind address |
| `--db` | `./wass-mcp.db` | SQLite database file path |
| `--debug` | `false` | Enable debug logging |
| `--version` | - | Print version and exit |


### Linting

```bash
make lint
```

### Testing

```bash
make test
```

### Project Structure

```
wass-mcp/
├── cmd/wass-mcp/        # Application entry point
├── pkg/
│   ├── server/          # MCP server wrapper
│   ├── storage/         # Database layer (SQLite/GORM)
│   ├── models/          # Data models
│   ├── tools/           # MCP tool implementations
│   │   ├── nikto/       # Nikto web server scanner
│   │   ├── wapiti/      # Wapiti web app scanner
│   │   ├── nuclei/      # Nuclei template scanner
│   │   ├── shcheck/     # Security headers checker
│   │   ├── fullscan/    # Parallel full scan
│   │   └── history/     # History management
│   └── types/           # Shared types and constants
├── docs/                # Documentation
└── build/               # Build output and coverage reports
```

## Security Notice

This tool is intended for **authorized security testing only**. Ensure you have proper authorization before scanning any systems. Unauthorized scanning may be illegal in your jurisdiction.

## Project notes

For complete project notes, design decisions, and architecture overview, please refer to the [Project Notes](docs/PROJECT_NOTES.md) document.

## License

BSD 3-Clause License - Copyright (c) 2026, Bohdan Turkynevych. See [LICENSE](LICENSE) for details.

## Contributing

1. Fork the repository
2. Create a feature branch (`git checkout -b feature/new-tool`)
3. Commit your changes (`git commit -am 'Add new scanning tool'`)
4. Push to the branch (`git push origin feature/new-tool`)
5. Create a Pull Request

## Acknowledgments

- [Model Context Protocol](https://modelcontextprotocol.io/) - Protocol specification
- [Nikto](https://cirt.net/Nikto2) - Web server scanner
- [Nuclei](https://github.com/projectdiscovery/nuclei) - Template-based vulnerability scanner
- [Wapiti](https://wapiti-scanner.github.io/) - Web application vulnerability scanner
- [Shcheck](https://github.com/santoru/shcheck) - Security headers checker
- [GORM](https://gorm.io/) - Go ORM library
io.github.tb0hdan/wass-mcp

About

Details

README

More
