Wass MCP

MCP server for web application security scanning

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "wass-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "wass-mcp"
      ]
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Documentation Overview

WASS-MCP

A Model Context Protocol (MCP) server for web application security scanning.

Features

MCP Protocol Support - Full compatibility with MCP clients (Claude, etc.)
Nikto Integration - Web server vulnerability scanning
Nuclei Integration - Template-based vulnerability scanning
Wapiti Integration - Web application vulnerability scanning
Shcheck Integration - Security headers analysis
Execution History - Persistent storage of scan results
Stateless Design - Survives server restarts without session errors
RESTful HTTP Transport - Streamable HTTP-based MCP protocol

Usage

Terminal

docker run -p 127.0.0.1:8989:8989 tb0hdan/wass-mcp

MCP Client Configuration

Example command to add WASS-MCP server to Claude MCP clients:

Terminal

claude mcp add wass-mcp --transport http http://127.0.0.1:8989

or Gemini:

bash

gemini mcp add wass-mcp --transport http http://127.0.0.1:8989

Available Tools

nikto

Perform web server vulnerability scans using Nikto.

Parameters:

Name	Type	Required	Description
`host`	string	Yes	Target hostname or IP address
`port`	integer	No	Target port (default: 80)
`vhost`	string	No	Virtual host header
`max_lines`	integer	No	Maximum output lines
`offset`	integer	No	Output line offset

Example:

config.json

{
  "host": "192.168.1.100",
  "port": 443
}

nuclei

Perform template-based vulnerability scanning using Nuclei.

Parameters:

Name	Type	Required	Description
`host`	string	Yes	Target hostname or IP address
`port`	integer	No	Target port (default: 80)
`vhost`	string	No	Virtual host header
`max_lines`	integer	No	Maximum output lines
`offset`	integer	No	Output line offset

Vulnerabilities Detected:

CVE detection via community templates
Misconfigurations
Exposed panels/dashboards
Default credentials
Technology detection
Security headers analysis
And many more via 8000+ community templates

Example:

config.json

{
  "host": "192.168.1.100",
  "port": 443
}

wapiti

Perform comprehensive web application vulnerability scans using Wapiti.

Parameters:

Name	Type	Required	Description
`host`	string	Yes	Target hostname or IP address
`port`	integer	No	Target port (default: 80)
`vhost`	string	No	Virtual host header
`max_lines`	integer	No	Maximum output lines
`offset`	integer	No	Output line offset

Vulnerabilities Detected:

SQL Injection / Blind SQL Injection
Cross-Site Scripting (XSS)
File Inclusion / Path Traversal
Command Execution
CRLF Injection
Server-Side Request Forgery (SSRF)
Open Redirects
HTTP Security Headers
Content Security Policy issues

Example:

config.json

{
  "host": "192.168.1.100",
  "port": 8080
}

shcheck_py

Analyze HTTP security headers using shcheck.py.

Parameters:

Name	Type	Required	Description
`host`	string	Yes	Target hostname or IP address
`port`	integer	No	Target port (default: 80)
`vhost`	string	No	Virtual host header
`max_lines`	integer	No	Maximum output lines
`offset`	integer	No	Output line offset

Headers Analyzed:

Content-Security-Policy
Strict-Transport-Security
X-Frame-Options
X-Content-Type-Options
Referrer-Policy
Permissions-Policy
And other security-relevant headers

Example:

config.json

{
  "host": "example.com",
  "port": 443
}

full_scan

Perform a comprehensive security scan using all available scanners in parallel.

Parameters:

Name	Type	Required	Description
`host`	string	Yes	Target hostname or IP address
`port`	integer	No	Target port (default: 80)
`vhost`	string	No	Virtual host header
`max_lines`	integer	No	Maximum output lines
`offset`	integer	No	Output line offset

Features:

Runs nikto, nuclei, wapiti and shcheck scanners in parallel
Merges results into a unified report
Includes timing and status for each scanner
Gracefully handles missing scanner binaries

Example:

config.json

{
  "host": "192.168.1.100",
  "port": 8080
}

history

Browse and manage tool execution history.

Parameters:

Name	Type	Required	Description
`action`	string	Yes	One of: `list`, `get`, `delete`, `clear`
`id`	integer	For get/delete	Execution ID
`limit`	integer	No	Results per page (default: 10)
`offset`	integer	No	Pagination offset

Actions:

list - List execution history with pagination
get - Get full details of a specific execution
delete - Delete a specific execution by ID
clear - Delete all execution history

API Endpoints

Endpoint	Description
`POST /mcp`	MCP protocol endpoint
`GET /`	Service information (JSON)
`GET /debug/pprof/*`	Profiling endpoints

Development and advanced usage

Source build requirements

Go 1.25+
Nikto (apt install nikto or equivalent)
Nuclei (go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest)
Wapiti (apt install wapiti or equivalent)
Shcheck (pip install shcheck or from GitHub)
SQLite3

bash

# Clone the repository
git clone https://github.com/tb0hdan/wass-mcp.git
cd wass-mcp

# Build
make build

# Run
./build/wass-mcp

Starting the Server

bash

# Default (localhost:8989)
./build/wass-mcp

# Custom bind address
./build/wass-mcp --bind 0.0.0.0:8080

# Custom database path
./build/wass-mcp --db /var/lib/wass-mcp/data.db

# Debug mode
./build/wass-mcp --debug

Configuration Options

Flag	Default	Description
`--bind`	`localhost:8989`	HTTP server bind address
`--db`	`./wass-mcp.db`	SQLite database file path
`--debug`	`false`	Enable debug logging
`--version`	-	Print version and exit

Linting

bash

make lint

Testing

bash

make test

Project Structure

Code

wass-mcp/
├── cmd/wass-mcp/        # Application entry point
├── pkg/
│   ├── server/          # MCP server wrapper
│   ├── storage/         # Database layer (SQLite/GORM)
│   ├── models/          # Data models
│   ├── tools/           # MCP tool implementations
│   │   ├── nikto/       # Nikto web server scanner
│   │   ├── wapiti/      # Wapiti web app scanner
│   │   ├── nuclei/      # Nuclei template scanner
│   │   ├── shcheck/     # Security headers checker
│   │   ├── fullscan/    # Parallel full scan
│   │   └── history/     # History management
│   └── types/           # Shared types and constants
├── docs/                # Documentation
└── build/               # Build output and coverage reports

Security Notice

This tool is intended for authorized security testing only. Ensure you have proper authorization before scanning any systems. Unauthorized scanning may be illegal in your jurisdiction.

Project notes

For complete project notes, design decisions, and architecture overview, please refer to the Project Notes document.

License

Contributing

Fork the repository
Create a feature branch (git checkout -b feature/new-tool)
Commit your changes (git commit -am 'Add new scanning tool')
Push to the branch (git push origin feature/new-tool)
Create a Pull Request

Acknowledgments

Model Context Protocol - Protocol specification
Nikto - Web server scanner
Nuclei - Template-based vulnerability scanner
Wapiti - Web application vulnerability scanner
Shcheck - Security headers checker
GORM - Go ORM library

Read the full README →View source on GitHub →

Related MCP Servers

View all in Developer Tools View all alternatives

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Wass MCP

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "wass-mcp": { "command": "npx", "args": ["-y", "wass-mcp"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/wass-mcp?style=directory)](https://allmcps.com/mcp/wass-mcp)

HTML Embed

<a href="https://allmcps.com/mcp/wass-mcp"><img src="https://allmcps.com/api/badge/wass-mcp?style=directory" alt="Wass MCP on AllMCPs" /></a>

Technical Specs & Signals

CategoryDeveloper Tools

25Quality signal: Emerging · 25/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership8/20

Documentation & tools10/30

Adoption & activity1/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

★ Spotlight Slot

Feature Your MCP Server

Get maximum visibility for your server across our directory, search results, and detail pages.

Spotlight Your Server

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge and attach your website — proof is checked automatically, then reviewed by our team.

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 💻 Developer Tools →Best MCP servers for Developers →Alternatives to Wass MCP →Install in Claude Desktop Install in Cursor Install in VS Code

Wass MCP

MCP server for web application security scanning

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "wass-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "wass-mcp"
      ]
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Documentation Overview

WASS-MCP

A Model Context Protocol (MCP) server for web application security scanning.

Features

MCP Protocol Support - Full compatibility with MCP clients (Claude, etc.)
Nikto Integration - Web server vulnerability scanning
Nuclei Integration - Template-based vulnerability scanning
Wapiti Integration - Web application vulnerability scanning
Shcheck Integration - Security headers analysis
Execution History - Persistent storage of scan results
Stateless Design - Survives server restarts without session errors
RESTful HTTP Transport - Streamable HTTP-based MCP protocol

Usage

Terminal

docker run -p 127.0.0.1:8989:8989 tb0hdan/wass-mcp

MCP Client Configuration

Example command to add WASS-MCP server to Claude MCP clients:

Terminal

claude mcp add wass-mcp --transport http http://127.0.0.1:8989

or Gemini:

bash

gemini mcp add wass-mcp --transport http http://127.0.0.1:8989

Available Tools

nikto

Perform web server vulnerability scans using Nikto.

Parameters:

Name	Type	Required	Description
`host`	string	Yes	Target hostname or IP address
`port`	integer	No	Target port (default: 80)
`vhost`	string	No	Virtual host header
`max_lines`	integer	No	Maximum output lines
`offset`	integer	No	Output line offset

Example:

config.json

{
  "host": "192.168.1.100",
  "port": 443
}

nuclei

Perform template-based vulnerability scanning using Nuclei.

Parameters:

Name	Type	Required	Description
`host`	string	Yes	Target hostname or IP address
`port`	integer	No	Target port (default: 80)
`vhost`	string	No	Virtual host header
`max_lines`	integer	No	Maximum output lines
`offset`	integer	No	Output line offset

Vulnerabilities Detected:

CVE detection via community templates
Misconfigurations
Exposed panels/dashboards
Default credentials
Technology detection
Security headers analysis
And many more via 8000+ community templates

Example:

config.json

{
  "host": "192.168.1.100",
  "port": 443
}

wapiti

Perform comprehensive web application vulnerability scans using Wapiti.

Parameters:

Name	Type	Required	Description
`host`	string	Yes	Target hostname or IP address
`port`	integer	No	Target port (default: 80)
`vhost`	string	No	Virtual host header
`max_lines`	integer	No	Maximum output lines
`offset`	integer	No	Output line offset

Vulnerabilities Detected:

SQL Injection / Blind SQL Injection
Cross-Site Scripting (XSS)
File Inclusion / Path Traversal
Command Execution
CRLF Injection
Server-Side Request Forgery (SSRF)
Open Redirects
HTTP Security Headers
Content Security Policy issues

Example:

config.json

{
  "host": "192.168.1.100",
  "port": 8080
}

shcheck_py

Analyze HTTP security headers using shcheck.py.

Parameters:

Name	Type	Required	Description
`host`	string	Yes	Target hostname or IP address
`port`	integer	No	Target port (default: 80)
`vhost`	string	No	Virtual host header
`max_lines`	integer	No	Maximum output lines
`offset`	integer	No	Output line offset

Headers Analyzed:

Content-Security-Policy
Strict-Transport-Security
X-Frame-Options
X-Content-Type-Options
Referrer-Policy
Permissions-Policy
And other security-relevant headers

Example:

config.json

{
  "host": "example.com",
  "port": 443
}

full_scan

Perform a comprehensive security scan using all available scanners in parallel.

Parameters:

Name	Type	Required	Description
`host`	string	Yes	Target hostname or IP address
`port`	integer	No	Target port (default: 80)
`vhost`	string	No	Virtual host header
`max_lines`	integer	No	Maximum output lines
`offset`	integer	No	Output line offset

Features:

Runs nikto, nuclei, wapiti and shcheck scanners in parallel
Merges results into a unified report
Includes timing and status for each scanner
Gracefully handles missing scanner binaries

Example:

config.json

{
  "host": "192.168.1.100",
  "port": 8080
}

history

Browse and manage tool execution history.

Parameters:

Name	Type	Required	Description
`action`	string	Yes	One of: `list`, `get`, `delete`, `clear`
`id`	integer	For get/delete	Execution ID
`limit`	integer	No	Results per page (default: 10)
`offset`	integer	No	Pagination offset

Actions:

list - List execution history with pagination
get - Get full details of a specific execution
delete - Delete a specific execution by ID
clear - Delete all execution history

API Endpoints

Endpoint	Description
`POST /mcp`	MCP protocol endpoint
`GET /`	Service information (JSON)
`GET /debug/pprof/*`	Profiling endpoints

Development and advanced usage

Source build requirements

Go 1.25+
Nikto (apt install nikto or equivalent)
Nuclei (go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest)
Wapiti (apt install wapiti or equivalent)
Shcheck (pip install shcheck or from GitHub)
SQLite3

bash

# Clone the repository
git clone https://github.com/tb0hdan/wass-mcp.git
cd wass-mcp

# Build
make build

# Run
./build/wass-mcp

Starting the Server

bash

# Default (localhost:8989)
./build/wass-mcp

# Custom bind address
./build/wass-mcp --bind 0.0.0.0:8080

# Custom database path
./build/wass-mcp --db /var/lib/wass-mcp/data.db

# Debug mode
./build/wass-mcp --debug

Configuration Options

Flag	Default	Description
`--bind`	`localhost:8989`	HTTP server bind address
`--db`	`./wass-mcp.db`	SQLite database file path
`--debug`	`false`	Enable debug logging
`--version`	-	Print version and exit

Linting

bash

make lint

Testing

bash

make test

Project Structure

Code

wass-mcp/
├── cmd/wass-mcp/        # Application entry point
├── pkg/
│   ├── server/          # MCP server wrapper
│   ├── storage/         # Database layer (SQLite/GORM)
│   ├── models/          # Data models
│   ├── tools/           # MCP tool implementations
│   │   ├── nikto/       # Nikto web server scanner
│   │   ├── wapiti/      # Wapiti web app scanner
│   │   ├── nuclei/      # Nuclei template scanner
│   │   ├── shcheck/     # Security headers checker
│   │   ├── fullscan/    # Parallel full scan
│   │   └── history/     # History management
│   └── types/           # Shared types and constants
├── docs/                # Documentation
└── build/               # Build output and coverage reports

Security Notice

This tool is intended for authorized security testing only. Ensure you have proper authorization before scanning any systems. Unauthorized scanning may be illegal in your jurisdiction.

Project notes

For complete project notes, design decisions, and architecture overview, please refer to the Project Notes document.

License

Contributing

Fork the repository
Create a feature branch (git checkout -b feature/new-tool)
Commit your changes (git commit -am 'Add new scanning tool')
Push to the branch (git push origin feature/new-tool)
Create a Pull Request

Acknowledgments

Model Context Protocol - Protocol specification
Nikto - Web server scanner
Nuclei - Template-based vulnerability scanner
Wapiti - Web application vulnerability scanner
Shcheck - Security headers checker
GORM - Go ORM library

Read the full README →View source on GitHub →

Related MCP Servers

View all in Developer Tools View all alternatives

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Wass MCP

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "wass-mcp": { "command": "npx", "args": ["-y", "wass-mcp"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/wass-mcp?style=directory)](https://allmcps.com/mcp/wass-mcp)

HTML Embed

<a href="https://allmcps.com/mcp/wass-mcp"><img src="https://allmcps.com/api/badge/wass-mcp?style=directory" alt="Wass MCP on AllMCPs" /></a>

Technical Specs & Signals

CategoryDeveloper Tools

25Quality signal: Emerging · 25/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership8/20

Documentation & tools10/30

Adoption & activity1/15

Community engagement0/10

★ Spotlight Slot

Feature Your MCP Server

Get maximum visibility for your server across our directory, search results, and detail pages.

Spotlight Your Server

Own this project?

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 💻 Developer Tools →Best MCP servers for Developers →Alternatives to Wass MCP →Install in Claude Desktop Install in Cursor Install in VS Code