# nickpending/mcp-recon [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/nickpending/mcp-recon  
**GitHub Stars:** 30  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/nickpending-mcp-recon

## Description
Conversational recon interface and MCP server powered by httpx and asnmap. Supports various reconnaissance levels for domain analysis, security header inspection, certificate analysis, and ASN lookup.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `docker` (confidence: high):

```json
"mcpServers": {
  "mcp-recon": {
    "command": "docker",
    "args": ["run","mcp/recon"],
    "env": {
      "PDCP_API_KEY": ""
    }
  }
}
```

**Requires environment variables:** `PDCP_API_KEY` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What nickpending/mcp-recon MCP server does

The nickpending/mcp-recon MCP server turns natural-language requests into reconnaissance operations for web domains and network ownership data. It exposes three primary tools: `http_lite_recon`, `http_full_recon`, and `asn_lookup`.

`http_lite_recon` performs a faster HTTP-focused check and can return core details such as status code, page title, server information, and IP address. `http_full_recon` collects broader metadata, including page previews, response headers, TLS certificate information, technology detection, CDN details, and security observations. The full mode retrieves complete page content, so it should be used selectively.

`asn_lookup` provides a separate lookup path for IP addresses, ASNs, and organization names. It uses ProjectDiscovery's `asnmap` library to identify ownership information. The project also defines the MCP prompts `http_lite_scan` and `katana_command_generator`; the latter generates Katana crawl commands from reconnaissance goals and a requested level of thoroughness.

## How it works

The nickpending/mcp-recon MCP server communicates through the Model Context Protocol, allowing an MCP client to invoke reconnaissance tools and receive their results. The server is intended to run as a Docker container connected to the client over standard input and output.

HTTP reconnaissance is powered by ProjectDiscovery's `httpx`. The implementation works around an issue in which the library can read from standard input even when used as a library, which could interfere with MCP communication. ASN enrichment also has a fallback based on the official `asnmap` Go library because `httpx` may not always populate ASN data.

Natural-language requests can select the appropriate operation, but the README identifies the tool names explicitly. For troubleshooting, use the lightweight mode first and reduce the number of domains scanned if performance is poor.

## Setup and configuration

Build the container from the repository with:

```bash
git clone https://github.com/nickpending/mcp-recon.git
cd mcp-recon
docker build -t mcp/recon -f Dockerfile .
```

Register the container as an MCP server with a configuration equivalent to:

```json
{
  "command": "docker",
  "args": ["run", "--rm", "-i", "mcp/recon"]
}
```

An environment file can be passed to the container with Docker's `--env-file` option. The documented variable is `PDCP_API_KEY`, containing a ProjectDiscovery API key. The exact requirements for each reconnaissance operation are not specified in the supplied material.

Claude Desktop is named as a compatible client, and the server is also described as usable with other MCP-compatible tools.

## Tools and capabilities

- Run lightweight HTTP fingerprinting with `http_lite_recon`.
- Collect expanded HTTP, TLS, header, content, and technology metadata with `http_full_recon`.
- Query IP, ASN, or organization ownership with `asn_lookup`.
- Use the `http_lite_scan` MCP prompt for a quick HTTP scan.
- Generate Katana crawl commands with the `katana_command_generator` MCP prompt.

## Limitations and notes

Only scan domains you own or are authorized to test. Targets may block scans, and inaccessible domains can produce no results. Full reconnaissance retrieves complete page content and may have greater impact than a lightweight check. The README recommends rate limiting to avoid affecting target systems.

The server is designed around Docker rather than a documented direct binary or package installation. Its ASN fallback addresses silent enrichment failures, but the supplied documentation does not promise complete ASN data for every HTTP result. The project was formerly named Tellix, so older screenshots or references may use that name.

The repository is released under the MIT License.

_Full upstream README: https://allmcps.com/mcp/nickpending-mcp-recon/readme_