# wass-mcp

An MCP server that runs Nikto, Nuclei, Wapiti and shcheck against a target and keeps the results in a history. Useful when you want a scan started from the agent chat.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 8
- Author: tb0hdan
- License: BSD-3-Clause · policy=link-only · description only; the file stays with the author
- Source: https://github.com/tb0hdan/wass-mcp
- Updated: 2026-03-18
- HTML: https://affpapa.org/en/nevibecode/mcp/wass-mcp

## What it does

Five tools come with it. `nikto` probes the web server, `nuclei` fires community templates, `wapiti` looks for SQL injection, XSS, SSRF and file inclusion, and `shcheck_py` reads the security headers. There is also `full_scan`, which runs all four at once and merges their output into one report with timing and status per scanner.

Under the hood it is an MCP wrapper, a SQLite storage layer on GORM, and a package per scanner. Execution history lives in the database, so restarts do not wipe past sessions. The transport is streamable HTTP on `POST /mcp`.

Docker is the quickest route: `docker run -p 127.0.0.1:8989:8989 tb0hdan/wass-mcp`. Building from source needs Go 1.25+ and all four scanner binaries on the machine — a missing one is skipped by `full_scan` rather than failing the run. The `--bind`, `--db` and `--debug` flags cover the listen address, the database file and logging.

## Requirements
- Needs: Docker

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- run Nuclei templates against a host and port
- catch SQL injection and XSS with Wapiti
- see which security headers a site is missing
- merge four scanner outputs into a single report
- reopen an earlier scan and read its output

## Example prompts
- Scan `192.168.1.100` on port 443 with `nuclei`
- Run `full_scan` against `example.com` and show the merged report
- List the last ten entries in the scan history

## Similar
- [mcp-security-hub](https://affpapa.org/en/nevibecode/skills/mcp-security-hub.md) — skill · 987 installs
- [dast-scanning](https://affpapa.org/en/nevibecode/skills/dast-scanning.md) — skill · 363 installs
- [vulnerability-scanning](https://affpapa.org/en/nevibecode/skills/devops-skills-vulnerability-scanning.md) — skill · 424 installs
- [V3 Swarm Coordination](https://affpapa.org/en/nevibecode/skills/v3-swarm-coordination.md) — skill · 1100 installs
- [dependency-check](https://affpapa.org/en/nevibecode/skills/dependency-check.md) — skill · 748 installs
- [litmus](https://affpapa.org/en/nevibecode/mcp/litmus.md) — MCP server · ★ 8

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md