Web Recon Agent

Local MCP server for owned-target web security assessment, letting an assistant run scan jobs against hostnames you allowlist.

What you can do

• Run web security scan jobs against hostnames you have allowlisted, aimed at authenticated, high-friction applications.
• Unlock active and owned-aggressive scan modes for hostnames you explicitly declare as owned.
• Persist job metadata to a JSON file so scan jobs can be tracked across sessions.
• Tune scanning through a JSON config file that overrides allowlist and concurrency settings.
• Limit how many scan jobs run at once via a concurrency setting.

When to use it

Use it when you want an AI assistant to help assess the security of web applications you own or are authorized to test, especially authenticated apps that resist ordinary scanning. It is not meant for scanning third-party sites.

Requirements

Runs as a local stdio process installed from the npm package mcp-web-recon-agent, so Node.js is needed. MCP_TARGET_ALLOWLIST is required and lists the hostnames allowed for scanning. Optional settings: MCP_OWNED_TARGETS for owned hostnames, MCP_CONFIG_PATH for a JSON config file, MCP_JOB_STORE_PATH for job metadata, and MCP_MAX_CONCURRENT for concurrency. No authentication is declared.