The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the Wass MCP listing page.
A Model Context Protocol (MCP) server for web application security scanning.
Example command to add WASS-MCP server to Claude MCP clients:
or Gemini:
Perform web server vulnerability scans using Nikto.
Parameters:
| Name | Type | Required | Description |
|---|---|---|---|
host | string | Yes | Target hostname or IP address |
port | integer | No | Target port (default: 80) |
vhost | string | No | Virtual host header |
max_lines | integer | No | Maximum output lines |
offset | integer | No | Output line offset |
Example:
Perform template-based vulnerability scanning using Nuclei.
Parameters:
| Name | Type | Required | Description |
|---|---|---|---|
host | string | Yes | Target hostname or IP address |
port | integer | No | Target port (default: 80) |
vhost | string | No | Virtual host header |
max_lines | integer | No | Maximum output lines |
offset | integer | No | Output line offset |
Vulnerabilities Detected:
Example:
Perform comprehensive web application vulnerability scans using Wapiti.
Parameters:
| Name | Type | Required | Description |
|---|---|---|---|
host | string | Yes | Target hostname or IP address |
port | integer | No | Target port (default: 80) |
vhost | string | No | Virtual host header |
max_lines | integer | No | Maximum output lines |
offset | integer | No | Output line offset |
Vulnerabilities Detected:
Example:
Analyze HTTP security headers using shcheck.py.
Parameters:
| Name | Type | Required | Description |
|---|---|---|---|
host | string | Yes | Target hostname or IP address |
port | integer | No | Target port (default: 80) |
vhost | string | No | Virtual host header |
max_lines | integer | No | Maximum output lines |
offset | integer | No | Output line offset |
Headers Analyzed:
Example:
Perform a comprehensive security scan using all available scanners in parallel.
Parameters:
| Name | Type | Required | Description |
|---|---|---|---|
host | string | Yes | Target hostname or IP address |
port | integer | No | Target port (default: 80) |
vhost | string | No | Virtual host header |
max_lines | integer | No | Maximum output lines |
offset | integer | No | Output line offset |
Features:
Example:
Browse and manage tool execution history.
Parameters:
| Name | Type | Required | Description |
|---|---|---|---|
action | string | Yes | One of: list, get, delete, clear |
id | integer | For get/delete | Execution ID |
limit | integer | No | Results per page (default: 10) |
offset | integer | No | Pagination offset |
Actions:
list - List execution history with paginationget - Get full details of a specific executiondelete - Delete a specific execution by IDclear - Delete all execution history| Endpoint | Description |
|---|---|
POST /mcp | MCP protocol endpoint |
GET / | Service information (JSON) |
GET /debug/pprof/* | Profiling endpoints |
apt install nikto or equivalent)go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest)apt install wapiti or equivalent)pip install shcheck or from GitHub)| Flag | Default | Description |
|---|---|---|
--bind | localhost:8989 | HTTP server bind address |
--db | ./wass-mcp.db | SQLite database file path |
--debug | false | Enable debug logging |
--version | - | Print version and exit |
This tool is intended for authorized security testing only. Ensure you have proper authorization before scanning any systems. Unauthorized scanning may be illegal in your jurisdiction.
For complete project notes, design decisions, and architecture overview, please refer to the Project Notes document.
BSD 3-Clause License - Copyright (c) 2026, Bohdan Turkynevych. See LICENSE for details.
git checkout -b feature/new-tool)git commit -am 'Add new scanning tool')git push origin feature/new-tool)