WASS-MCP

A Model Context Protocol (MCP) server for web application security scanning.

Features

• MCP Protocol Support - Full compatibility with MCP clients (Claude, etc.)

• Nikto Integration - Web server vulnerability scanning

• Nuclei Integration - Template-based vulnerability scanning

• Wapiti Integration - Web application vulnerability scanning

• Shcheck Integration - Security headers analysis

• Execution History - Persistent storage of scan results

• Stateless Design - Survives server restarts without session errors

• RESTful HTTP Transport - Streamable HTTP-based MCP protocol

Related MCP server: OWASP MCP Server

Usage

docker run -p 127.0.0.1:8989:8989 tb0hdan/wass-mcp

MCP Client Configuration

Example command to add WASS-MCP server to Claude MCP clients:

claude mcp add wass-mcp --transport http http://127.0.0.1:8989

or Gemini:

gemini mcp add wass-mcp --transport http http://127.0.0.1:8989

Available Tools

nikto

Perform web server vulnerability scans using Nikto.

Parameters:

Example:

{
  "host": "192.168.1.100",
  "port": 443
}

nuclei

Perform template-based vulnerability scanning using Nuclei.

Parameters:

Vulnerabilities Detected:

• CVE detection via community templates

• Misconfigurations

• Exposed panels/dashboards

• Default credentials

• Technology detection

• Security headers analysis

• And many more via 8000+ community templates

Example:

{
  "host": "192.168.1.100",
  "port": 443
}

wapiti

Perform comprehensive web application vulnerability scans using Wapiti.

Parameters:

Vulnerabilities Detected:

• SQL Injection / Blind SQL Injection

• Cross-Site Scripting (XSS)

• File Inclusion / Path Traversal

• Command Execution

• CRLF Injection

• Server-Side Request Forgery (SSRF)

• Open Redirects

• HTTP Security Headers

• Content Security Policy issues

Example:

{
  "host": "192.168.1.100",
  "port": 8080
}

shcheck_py

Analyze HTTP security headers using shcheck.py.

Parameters:

Headers Analyzed:

• Content-Security-Policy

• Strict-Transport-Security

• X-Frame-Options

• X-Content-Type-Options

• Referrer-Policy

• Permissions-Policy

• And other security-relevant headers

Example:

{
  "host": "example.com",
  "port": 443
}

full_scan

Perform a comprehensive security scan using all available scanners in parallel.

Parameters:

Features:

• Runs nikto, nuclei, wapiti and shcheck scanners in parallel

• Merges results into a unified report

• Includes timing and status for each scanner

• Gracefully handles missing scanner binaries

Example:

{
  "host": "192.168.1.100",
  "port": 8080
}

history

Browse and manage tool execution history.

Parameters:

Actions:

• list - List execution history with pagination

• get - Get full details of a specific execution

• delete - Delete a specific execution by ID

• clear - Delete all execution history

API Endpoints

Development and advanced usage

Source build requirements

• Go 1.25+

• Nikto (apt install nikto or equivalent)

• Nuclei (go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest)

• Wapiti (apt install wapiti or equivalent)

• Shcheck (pip install shcheck or from GitHub)

• SQLite3

# Clone the repository
git clone https://github.com/tb0hdan/wass-mcp.git
cd wass-mcp

# Build
make build

# Run
./build/wass-mcp

Starting the Server

# Default (localhost:8989)
./build/wass-mcp

# Custom bind address
./build/wass-mcp --bind 0.0.0.0:8080

# Custom database path
./build/wass-mcp --db /var/lib/wass-mcp/data.db

# Debug mode
./build/wass-mcp --debug

Configuration Options

Linting

make lint

Testing

make test

Project Structure

wass-mcp/
├── cmd/wass-mcp/        # Application entry point
├── pkg/
│   ├── server/          # MCP server wrapper
│   ├── storage/         # Database layer (SQLite/GORM)
│   ├── models/          # Data models
│   ├── tools/           # MCP tool implementations
│   │   ├── nikto/       # Nikto web server scanner
│   │   ├── wapiti/      # Wapiti web app scanner
│   │   ├── nuclei/      # Nuclei template scanner
│   │   ├── shcheck/     # Security headers checker
│   │   ├── fullscan/    # Parallel full scan
│   │   └── history/     # History management
│   └── types/           # Shared types and constants
├── docs/                # Documentation
└── build/               # Build output and coverage reports

Security Notice

This tool is intended for authorized security testing only. Ensure you have proper authorization before scanning any systems. Unauthorized scanning may be illegal in your jurisdiction.

Project notes

For complete project notes, design decisions, and architecture overview, please refer to the Project Notes document.

License

BSD 3-Clause License - Copyright (c) 2026, Bohdan Turkynevych. See LICENSE for details.

Contributing

1. Fork the repository

2. Create a feature branch (git checkout -b feature/new-tool)

3. Commit your changes (git commit -am 'Add new scanning tool')

4. Push to the branch (git push origin feature/new-tool)

5. Create a Pull Request

Acknowledgments

• Model Context Protocol - Protocol specification

• Nikto - Web server scanner

• Nuclei - Template-based vulnerability scanner

• Wapiti - Web application vulnerability scanner

• Shcheck - Security headers checker

• GORM - Go ORM library