ProjectDiscovery MCP Server

A Model Context Protocol (MCP) server that integrates ProjectDiscovery security tools for automated bug bounty reconnaissance and vulnerability scanning.

Features

This MCP server provides comprehensive security reconnaissance capabilities:

Individual Tools

• subfinder - Subdomain discovery using passive sources

• dnsx - DNS resolution and probing

• naabu - Fast port scanning

• httpx - HTTP/HTTPS probing and analysis

• katana - Web crawling and endpoint discovery

• nuclei - Vulnerability scanning with YAML templates

Automated Workflow

• Bug Hunting workflow - End-to-end reconnaissance pipeline that chains all tools together

Workflow Diagram

Execution Time: ~2 minutes (varies by target size)

Output: JSON report with:

• Total subdomains, resolved hosts, open ports

• Live HTTP services with status codes and titles

• Crawled endpoints and paths

• Vulnerabilities categorized by severity (critical/high/medium/low)

Prerequisites

Before using this MCP server, you must install the ProjectDiscovery tools:

Installation

Usage

With Claude Desktop

Add to your Claude Desktop configuration (claude_desktop_config.json):

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json

With VS Code

Create or update .vscode/mcp.json in your workspace:

Standalone Testing

Available Tools

1. subfinder

Discover subdomains for a target domain.

Input:

• domain (string, required): Target domain (e.g., "example.com")

• silent (boolean, optional): Show only subdomains in output

Example:

2. dnsx

Resolve DNS records for domains.

Input:

• domains (array of strings, required): List of domains to resolve

• recordType (string, optional): DNS record type (A, AAAA, CNAME, etc.)

Example:

3. naabu

Scan for open ports on hosts.

Input:

• hosts (array of strings, required): List of hosts to scan

• ports (string, optional): Ports to scan (e.g., "80,443" or "1-1000")

• topPorts (number, optional): Scan top N ports

Example:

4. httpx

Probe HTTP/HTTPS servers.

Input:

• urls (array of strings, required): List of URLs or hosts

• followRedirects (boolean, optional): Follow HTTP redirects

• screenshot (boolean, optional): Take screenshots

Example:

5. katana

Crawl websites and discover endpoints.

Input:

• urls (array of strings, required): List of URLs to crawl

• depth (number, optional): Crawl depth (default: 2)

• scope (string, optional): Crawl scope regex pattern

Example:

6. nuclei

Scan for vulnerabilities using templates.

Input:

• targets (array of strings, required): List of targets

• templates (array of strings, optional): Specific templates to use

• severity (array of strings, optional): Filter by severity (critical, high, medium, low, info)

Example:

7. Bug hunting workflow

Execute complete automated reconnaissance workflow.

Input:

• domain (string, required): Target domain

• portScan (boolean, optional): Include port scanning (default: true)

• crawl (boolean, optional): Include web crawling (default: true)

• vulnerabilityScan (boolean, optional): Include vulnerability scanning (default: true)

• severityFilter (array of strings, optional): Nuclei severity filter

Rate Limiting Options:

• maxCrawlUrls (number, optional): Maximum URLs to crawl (default: 10)

• maxScanUrls (number, optional): Maximum URLs to scan with Nuclei (default: 20)

• maxTopPorts (number, optional): Maximum top ports for Naabu (default: 100)

• batchSize (number, optional): Batch size for DNS/HTTP requests (default: 50)

• delayBetweenBatches (number, optional): Delay in milliseconds between batches (default: 1000)

• crawlDepth (number, optional): Crawl depth for Katana (default: 2)

Example:

Example (Conservative Rate Limiting):

Workflow Steps:

1. Subdomain Discovery - Find all subdomains

2. DNS Resolution - Resolve subdomains to IPs

3. Port Scanning - Identify open ports (optional)

4. HTTP Probing - Find live web services

5. Web Crawling - Discover endpoints (optional)

6. Vulnerability Scanning - Detect security issues (optional)

Rate Limiting

The bug bounty workflow includes configurable rate limiting to prevent overwhelming target infrastructure and respect responsible disclosure practices.

Rate Limiting Parameters

Usage Examples

Aggressive Scan (use responsibly):

Conservative Scan (recommended for production sites):

Stealth Scan (minimal footprint):

Best Practices

• Start Conservative: Begin with lower limits and increase gradually

• Respect Target Infrastructure: Use appropriate delays to avoid overwhelming servers

• Bug Bounty Programs: Always follow the program's rules of engagement

• Production Systems: Use extended delays and lower batch sizes

• Monitor Logs: Check stderr output for rate limiting status messages

Example Usage

Once configured with an MCP client like Claude Desktop, you can use natural language:

"Use the bug_bounty_workflow tool to scan example.com for vulnerabilities"

"Find all subdomains for hackerone.com using subfinder"

"Scan the top 100 ports on example.com with naabu"

"Crawl https://example.com and find all endpoints with katana"

Development

Credits

Built with:

• Model Context Protocol SDK

• ProjectDiscovery Tools

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.