MCP-Server-for-Ethical-Hacking

ReubenReny03/MCP-Server-for-Ethical-Hacking

3.2

If you are the rightful owner of MCP-Server-for-Ethical-Hacking and would like to certify it and/or have it hosted online, please leave a comment on the right or send an email to dayong@mcphub.com.

The WebSec MCP Server is a Model Context Protocol server designed to perform safe-by-default website security checks and provide a controlled interface for AI assistants to assess the security posture of authorized sites.

Tools
7
Resources
0
Prompts
0

WebSec MCP Server

A Model Context Protocol (MCP) server that performs safe-by-default website security checks (HTTP headers, security header audit, TLS info, DNS resolve, robots.txt, shallow crawl) and an explicit-consent gated light nmap scan.

Purpose

Provide AI assistants a controlled interface to assess security posture of sites you own or are authorized to test.

Features

Current Tools

  • http_headers — Fetch HTTP status/version/headers for a URL.
  • security_headers_audit — Heuristic check for common security headers with recommended fixes.
  • tls_info — Show TLS certificate subject/issuer/SAN count/expiry via native TLS.
  • dns_resolve — Resolve A/AAAA addresses for a hostname.
  • robots_txt — Fetch /robots.txt with metadata and a snippet.
  • crawl_links — Single-page crawl to list up to N same-origin links/assets.
  • nmap_top_ports — Opt-in light nmap -sV --top-ports N scan (requires ALLOW_ACTIVE_SCANS=true and confirm="I_own_this").

Prerequisites

  • Docker Desktop with MCP Toolkit (so you have docker mcp).
  • Claude Desktop (or any MCP-capable client) and the Docker MCP Gateway configuration.
  • Network egress from the container to your targets.
  • Authorization to test any non-local target.

Usage Examples (in Claude Desktop)

  • “Run http_headers on https://example.com”
  • “Audit security headers for https://example.com”
  • “Get TLS details for host example.com port 443”
  • “Resolve DNS for api.example.com”
  • “Show robots.txt for example.com”
  • “Crawl up to 30 links on https://app.example.com”
  • “Run nmap_top_ports on mydevbox.local with top_ports=100 and confirm=I_own_this”

Architecture