MCP Recon

What nickpending/mcp-recon MCP server does

The nickpending/mcp-recon MCP server turns natural-language requests into reconnaissance operations for web domains and network ownership data. It exposes three primary tools: http_lite_recon, http_full_recon, and asn_lookup.

http_lite_recon performs a faster HTTP-focused check and can return core details such as status code, page title, server information, and IP address. http_full_recon collects broader metadata, including page previews, response headers, TLS certificate information, technology detection, CDN details, and security observations. The full mode retrieves complete page content, so it should be used selectively.

asn_lookup provides a separate lookup path for IP addresses, ASNs, and organization names. It uses ProjectDiscovery's asnmap library to identify ownership information. The project also defines the MCP prompts http_lite_scan and katana_command_generator; the latter generates Katana crawl commands from reconnaissance goals and a requested level of thoroughness.

How it works

The nickpending/mcp-recon MCP server communicates through the Model Context Protocol, allowing an MCP client to invoke reconnaissance tools and receive their results. The server is intended to run as a Docker container connected to the client over standard input and output.

HTTP reconnaissance is powered by ProjectDiscovery's httpx. The implementation works around an issue in which the library can read from standard input even when used as a library, which could interfere with MCP communication. ASN enrichment also has a fallback based on the official asnmap Go library because httpx may not always populate ASN data.

Natural-language requests can select the appropriate operation, but the README identifies the tool names explicitly. For troubleshooting, use the lightweight mode first and reduce the number of domains scanned if performance is poor.

Setup and configuration

Build the container from the repository with:

git clone https://github.com/nickpending/mcp-recon.git
cd mcp-recon
docker build -t mcp/recon -f Dockerfile .

Register the container as an MCP server with a configuration equivalent to:

{
  "command": "docker",
  "args": ["run", "--rm", "-i", "mcp/recon"]
}

An environment file can be passed to the container with Docker's --env-file option. The documented variable is PDCP_API_KEY, containing a ProjectDiscovery API key. The exact requirements for each reconnaissance operation are not specified in the supplied material.

Claude Desktop is named as a compatible client, and the server is also described as usable with other MCP-compatible tools.

Tools and capabilities

• Run lightweight HTTP fingerprinting with http_lite_recon.
• Collect expanded HTTP, TLS, header, content, and technology metadata with http_full_recon.
• Query IP, ASN, or organization ownership with asn_lookup.
• Use the http_lite_scan MCP prompt for a quick HTTP scan.
• Generate Katana crawl commands with the katana_command_generator MCP prompt.

Limitations and notes

Only scan domains you own or are authorized to test. Targets may block scans, and inaccessible domains can produce no results. Full reconnaissance retrieves complete page content and may have greater impact than a lightweight check. The README recommends rate limiting to avoid affecting target systems.

The server is designed around Docker rather than a documented direct binary or package installation. Its ASN fallback addresses silent enrichment failures, but the supplied documentation does not promise complete ASN data for every HTTP result. The project was formerly named Tellix, so older screenshots or references may use that name.

The repository is released under the MIT License.