Skip to main content
Glama
SRC Hunter MCP Server

SRC Hunter MCP Server

by mUggles1

SRC Hunter MCP Server

轻量版漏洞赏金猎人工具链 - 无需外部工具,纯 Node.js 实现

🎯 特性

✅ 已实现(无需外部工具)

  • 子域名枚举:crt.sh API(免费、快速)

  • Web 指纹识别:技术栈检测、服务器信息

  • API 端点提取:从 HTML/JS 中提取 URL

  • 端口扫描:TCP 连接测试(常用端口)

  • 漏洞扫描:SQL 注入、XSS、文件遍历、安全头检查

  • 授权检查:域名白名单、操作审计日志

🔧 可选(需安装外部工具)

  • Subfinder/Amass:高级子域名枚举

  • Nmap:全面端口扫描

  • Nuclei:漏洞模板引擎

  • Dirsearch:目录爆破

Related MCP server: Bug Bounty MCP Server

📦 安装

1. 安装依赖

cd C:\Users\Q\.claude\mcp-servers\src-hunter
npm install
npm run build

2. 配置 Claude Code

已自动添加到 C:\Users\Q\.claude\mcp.json:

{
  "mcpServers": {
    "src-hunter": {
      "command": "node",
      "args": ["C:\\Users\\Q\\.claude\\mcp-servers\\src-hunter\\build\\index.js"],
      "description": "SRC Hunter: 漏洞赏金猎人工具链"
    }
  }
}

3. 重启 Claude Code

关闭并重新打开 Claude Code,MCP Server 将自动加载。

🚀 使用方法

授权管理

// 添加授权域名
authorize-target { "target": "example.com", "scope": "subdomain" }

// 查看授权列表
list-authorizations {}

// 撤销授权
revoke-authorization { "target": "example.com" }

侦察工具(轻量版)

// 子域名枚举(使用 crt.sh)
enumerate-subdomains-lite { "domain": "example.com" }

// Web 指纹识别
web-fingerprint-lite { "url": "https://example.com" }

// 提取 API 端点
extract-endpoints-lite { "url": "https://example.com" }

// 端口扫描
port-scan-lite { 
  "host": "example.com",
  "ports": [80, 443, 8080, 8443, 3000]
}

漏洞扫描(轻量版)

vuln-scan-lite {
  "url": "https://example.com",
  "check_sql": true,
  "check_xss": true,
  "check_files": true,
  "check_headers": true
}

查看审计日志

get-audit-log { "limit": 50 }

📊 工具对比

功能

轻量版

外部工具版

子域名枚举

crt.sh API

Subfinder + Amass

端口扫描

TCP 连接

Nmap 全功能

Web 指纹

基础检测

httpx 深度扫描

漏洞扫描

常见漏洞

Nuclei 5000+ 模板

安装难度

✅ 零依赖

⚠️ 需配置工具

速度

🚀 快速

🐢 较慢但全面

🔒 安全机制

1. 域名授权

所有操作必须先授权目标域名:

authorize-target { "target": "example.com", "scope": "full" }

作用域:

  • subdomain:仅子域名

  • full:完整扫描

  • read-only:只读侦察

2. 审计日志

所有操作自动记录:

  • 时间戳

  • 操作类型

  • 目标

  • 结果统计

  • 执行时长

日志位置:src-hunter-audit.log

3. 安全限制

  • 禁止扫描未授权域名

  • 端口扫描限制在常用端口

  • 漏洞扫描使用安全 payload

🛠️ 故障排除

MCP Server 未加载

# 检查编译是否成功
ls C:\Users\Q\.claude\mcp-servers\src-hunter\build\index.js

# 查看 Claude Code 日志
# 文件 → 偏好设置 → 开发者工具

工具无响应

# 测试 Node.js 环境
node --version  # 应该 >= 18

# 重新构建
npm run build

crt.sh API 限流

crt.sh 有速率限制,建议:

  • 增加请求间隔

  • 使用缓存结果

  • 切换到外部工具版(Subfinder)

📚 进阶配置

安装外部工具(可选)

如需更强大功能,运行:

# PowerShell 管理员模式
cd C:\Users\Q\.claude\mcp-servers\src-hunter\scripts
.\download-prebuilt-tools.ps1

这将安装:

  • Subfinder v2.6.6

  • httpx v1.6.8

  • Nuclei v3.3.8

详见:docs/TOOL-INSTALLATION.md

📖 相关文档

🤝 贡献

欢迎提交 Issue 和 Pull Request!

📄 许可证

MIT License

Available Tools

18 tools
check-authorizationB

检查目标是否在授权测试范围内

Inputs: target (required).

directory-scanC

敏感目录扫描

Inputs: url (required), wordlist, extensions.

enumerate-subdomainsC

子域名枚举(使用 subfinder + amass)

Inputs: domain (required), tools, timeout_ms.

enumerate-subdomains-liteB

子域名枚举(使用 crt.sh API,无需外部工具)

Inputs: domain (required).

export-findingsB

导出漏洞发现(用于提交 SRC)

Inputs: scan_id (required).

extract-endpointsC

提取 API 端点(从 JS 文件分析)

Inputs: url (required), depth.

extract-endpoints-liteC

提取 API 端点(无需外部工具)

Inputs: url (required).

generate-reportC

生成侦察报告

Inputs: scan_id (required), format, include_raw.

get-rate-limitsA

获取当前的限流配置

Inputs: no named parameters.

port-scanC

端口扫描(使用 nmap)

Inputs: target (required), ports, scan_type.

port-scan-liteB

简单端口扫描(TCP 连接测试)

Inputs: host (required), ports (required).

reload-configC

重新加载配置(白名单/资产库)

Inputs: no named parameters.

search-assetsC

搜索可测试的资产(域名/IP/APP)

Inputs: keyword (required).

sync-src-assetsB

同步 SRC 平台的授权测试范围(爬取最新资产信息)

Inputs: force, platforms.

verify-cveC

验证特定 CVE 漏洞

Inputs: cve (required), target (required), safe_mode.

vuln-scan-liteB

轻量级漏洞扫描(内置 payload,无需外部工具)

Inputs: url (required), check_sql, check_xss, check_files, +1 more.

web-fingerprintC

Web 指纹识别(技术栈检测)

Inputs: url (required), deep.

web-fingerprint-liteC

Web 指纹识别(纯 Node.js 实现)

Inputs: url (required).

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

    TDQS

    B3/5.0

    Scored across 18 tools

    Disambiguation3/5

    Several tool pairs are near-duplicates: enumerate-subdomains-lite vs enumerate-subdomains, port-scan-lite vs port-scan, web-fingerprint-lite vs web-fingerprint, extract-endpoints-lite vs extract-endpoints. The 'lite' suffix helps somewhat, but agents may struggle to choose between the lite and full versions without deeper inspection.

    Naming Consistency4/5

    Tool names mostly follow a consistent verb-noun pattern (sync-, search-, check-, enumerate-, web-, extract-, port-, export-, verify-, generate-, get-, reload-). The 'lite' suffix is applied consistently, though the mix of hyphenated verbs and some noun-first names like 'web-fingerprint-lite' is a minor deviation.

    Tool Count4/5

    18 tools is on the higher end but still reasonable for a security reconnaissance and vulnerability scanning server. The count is justified by the breadth of the domain, though the lite/full duplication inflates the number slightly.

    Completeness4/5

    The toolset covers the main reconnaissance workflow: asset discovery, authorization checking, subdomain enumeration, fingerprinting, endpoint extraction, port scanning, vulnerability scanning, and report generation. Missing operations like target deletion or finding management are minor gaps, but the core SRC hunting lifecycle is well covered.

    Maintenance

    ActivitySlowing
    ResponsivenessNo recent community issues

    Related MCP Connectors

    Related MCP Servers

    • A
      license
      Not graded
      quality
      B
      maintenance
      Integrates 15+ static application security testing tools (Semgrep, Bandit, TruffleHog, etc.) with Claude Code AI, enabling automated vulnerability scanning and security analysis through natural language commands. Supports cross-platform operation with remote execution on dedicated security VMs.
      6
      MIT
    • A
      license
      A
      quality
      D
      maintenance
      Provides Claude Code with access to a comprehensive bug bounty knowledge base including techniques, payloads, wordlists, and real-world reports through 14 tools for searching, retrieving payloads, and assessing report quality.
      14
      21
      GPL 3.0
    • A
      license
      A
      quality
      C
      maintenance
      Turns Claude into a penetration testing copilot with 80 security tools, safety controls, and automatic reporting.
      80
      65
      MIT