WhatWeb MCP Server: web technology fingerprinting for AI agents

WhatWeb MCP server lets Claude Code, Cursor, and any MCP client fingerprint websites and identify their CMS, web server, frameworks, and analytics tools. It runs WhatWeb in a hardened Docker container and returns a structured report in one tool call.

Sales and prospecting teams use it to qualify leads; security teams use it for recon.

The server publishes three tools: whatweb_scan (scan a target at five aggression levels), get_scan_results (fetch a previous scan by ID), and list_active_scans (see what is running). Scans run in a sandboxed container with a non-root user, memory and CPU limits, and flag-injection validation on every target.

Quickstart (Docker)

The image is multi-arch (linux/amd64 and linux/arm64), so the same tag works on Apple Silicon, x86 servers, and ARM cloud instances.

docker pull devkind/whatweb-mcp:latest

Ready-paste config for Claude Code or Cursor, saved as .mcp.json in your project root (or ~/.cursor/mcp.json):

{
  "mcpServers": {
    "whatweb": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "--memory=512m", "--cpus=0.5", "--pids-limit=100", "devkind/whatweb-mcp:latest"]
    }
  }
}

Then ask your agent: "What technologies does example.com run?"

Related MCP server: pentest-mcp-server

Example tool call and output

{ "tool": "whatweb_scan", "arguments": { "target": "https://example.com", "aggression": "normal" } }

{
  "scan_id": "a1b2c3d4",
  "target": "https://example.com",
  "status": "completed",
  "http_status": 200,
  "stats": { "total_technologies": 3 },
  "technologies": [
    { "name": "nginx", "version": "1.25.3", "string": null },
    { "name": "WordPress", "version": "6.4.3", "string": "wp-content" },
    { "name": "jQuery", "version": "3.7.1", "string": "jquery.js" }
  ],
  "error": null
}

Aggression levels map to WhatWeb's -a flag: stealthy/passive (1, one request), polite (2), normal (3), aggressive (4, potentially intrusive, so use only on targets you are authorized to test).

How it works

The container installs WhatWeb from the official upstream repository on an Alpine Ruby base, then runs a Python MCP server (mcp SDK, stdio transport). Each scan shells out with an argument array (no shell interpolation), writes WhatWeb's JSON log to an ephemeral /app/output, and parses it into typed results. Up to 100 scan results are kept in memory for follow-up questions in the same session. Tests cover target validation, JSON parsing, result-store bounds, and a live MCP stdio JSON-RPC handshake. Run them with pytest. Also installable from source without Docker: pip install -r requirements.txt && python3 server.py (requires WhatWeb on your PATH).

Roadmap

• Submit to the official MCP Registry and Smithery

• Batch scanning (multiple targets in one call)

• Optional CSV/JSON export tool

• Scheduled re-scans with diffing (alert when a target's stack changes)

Built by

Built by Devkind. Maintained by Kazim Ali.

License

MIT. See CONTRIBUTING.md and SECURITY.md. WhatWeb itself is licensed by its upstream authors. Scan only targets you are authorized to scan.