wass-mcp — MCP server for web app security scanning
An MCP server that runs Nikto, Nuclei, Wapiti and shcheck against a target and keeps the results in a history. Useful when you want a scan started from the agent chat.
Open on GitHubWhat wass-mcp does
Five tools come with it. nikto probes the web server, nuclei fires community templates, wapiti looks for SQL injection, XSS, SSRF and file inclusion, and shcheck_py reads the security headers. There is also full_scan, which runs all four at once and merges their output into one report with timing and status per scanner.
Under the hood it is an MCP wrapper, a SQLite storage layer on GORM, and a package per scanner. Execution history lives in the database, so restarts do not wipe past sessions. The transport is streamable HTTP on POST /mcp.
Docker is the quickest route: docker run -p 127.0.0.1:8989:8989 tb0hdan/wass-mcp. Building from source needs Go 1.25+ and all four scanner binaries on the machine — a missing one is skipped by full_scan rather than failing the run. The --bind, --db and --debug flags cover the listen address, the database file and logging.
What it helps with
- run Nuclei templates against a host and port
- catch SQL injection and XSS with Wapiti
- see which security headers a site is missing
- merge four scanner outputs into a single report
- reopen an earlier scan and read its output
Example prompts for the agent
- Scan
192.168.1.100on port 443 withnuclei - Run
full_scanagainstexample.comand show the merged report - List the last ten entries in the scan history
How to install wass-mcp
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about wass-mcp
How do I install wass-mcp in Claude Code?
Start the server first: docker run -p 127.0.0.1:8989:8989 tb0hdan/wass-mcp. Then register it with the client: claude mcp add wass-mcp --transport http http://127.0.0.1:8989.
What does wass-mcp do?
It runs Nikto, Nuclei, Wapiti and shcheck against a host you name and hands the output back to the agent. A parallel mode covers all scanners at once, and every execution is stored in SQLite.
What is needed to build it from source?
Go 1.25+ and the scanners themselves: Nikto, Nuclei, Wapiti, shcheck, plus SQLite3. Build and run go through make build and ./build/wass-mcp.
