Recon Kit Mcp
Gives Claude clean reconnaissance primitives instead of making it parse nmap output. Six tools: a unified recon_report that grades DNS, TLS, and HTTP headers together, plus standalone dns_recon with SPF/DMARC/DKIM checks, tls_check that flags weak ciphers and known vulnerabilities, http_headers_audit for CSP and HSTS posture, subdomain_enum capped at 512 candidates, and a port_scan limited to 1024 ports per call. Everything returns structured JSON with severity-graded findings and remediation advice, so your agent can reason over security gaps instead of screen scraping. Designed for authorized testing only: pentesting your own infrastructure, CTF practice, or learning. The built-in security_recon prompt walks through a full audit sorted by severity.
- GitHub stars
- 1
- tools
- 13
- transport
- STDIO
- last updated
- Jun 22, 2026
Tools
13 toolsPublic tool metadata for what this MCP can expose to an agent.
recon_reportStart here. One call → DNS, TLS, and HTTP headers checked together, with an overall grade
Start here. One call → DNS, TLS, and HTTP headers checked together, with an overall grade
No parameter schema in public metadata yet.
dns_reconDNS + WHOIS + email security (SPF/DMARC/DKIM), graded
DNS + WHOIS + email security (SPF/DMARC/DKIM), graded
No parameter schema in public metadata yet.
subdomain_enumDiscover subdomains via DNS brute-force and/or Certificate Transparency logs
Discover subdomains via DNS brute-force and/or Certificate Transparency logs
No parameter schema in public metadata yet.
subdomain_takeoverCheck subdomains for a dangling-CNAME takeover risk against known services
Check subdomains for a dangling-CNAME takeover risk against known services
No parameter schema in public metadata yet.
tls_checkCertificate, protocols, ciphers, and known TLS vulnerabilities, graded
Certificate, protocols, ciphers, and known TLS vulnerabilities, graded
No parameter schema in public metadata yet.
http_headers_auditHTTP security headers (CSP, HSTS, X-Frame-Options, …), graded
HTTP security headers (CSP, HSTS, X-Frame-Options, …), graded
No parameter schema in public metadata yet.
cookie_auditRedirect chain + cookie flags (Secure / HttpOnly / SameSite), graded
Redirect chain + cookie flags (Secure / HttpOnly / SameSite), graded
No parameter schema in public metadata yet.
cors_checkCORS policy probe — flags arbitrary-Origin reflection and wildcard misuse
CORS policy probe — flags arbitrary-Origin reflection and wildcard misuse
No parameter schema in public metadata yet.
tech_detectFingerprint the web stack (server, CDN/WAF, language, framework, CMS, JS) from one GET
Fingerprint the web stack (server, CDN/WAF, language, framework, CMS, JS) from one GET
No parameter schema in public metadata yet.
http_methods_auditReport which HTTP methods a server allows and grade the risk (TRACE/PUT/DELETE)
Report which HTTP methods a server allows and grade the risk (TRACE/PUT/DELETE)
No parameter schema in public metadata yet.
well_known_auditFetches & parses security.txt (RFC 9116) and robots.txt
Fetches & parses security.txt (RFC 9116) and robots.txt
No parameter schema in public metadata yet.
ip_infoResolves the host and enriches its IP via RDAP (owner, country, CIDR, abuse)
Resolves the host and enriches its IP via RDAP (owner, country, CIDR, abuse)
No parameter schema in public metadata yet.
port_scanTCP port scan of one host (≤1024 ports/call), open ports + services
TCP port scan of one host (≤1024 ports/call), open ports + services
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
recon-mcp
English | 繁體中文
An MCP server that gives AI coding agents — Claude Code, Codex, Cline, and any MCP client — safe, structured network and security reconnaissance tools.
Most MCP servers wrap CRUD APIs. recon-mcp instead exposes the kind of
read-only recon an engineer reaches for when investigating an asset, and returns
clean JSON — with a graded verdict — so the agent can reason over results
instead of parsing console output.
Details
- Repository
- github.com/nan786521/recon-mcp
- Category
- Security & Pentesting
- Package
recon-kit-mcp- Transport
- STDIO
- Registry
- MCP registry, active
Related Security & Pentesting MCP servers
View all
mcp-armorstudiomeyer-io/mcp-armorSecurity sidecar for MCP servers: 11 read-only control-plane tools for prompt-injection checks.1stars
Mcpnode-man/dechonet-mcp30 security tools for AI agents: phishing links, exposure maps, DNS, SSL, PQC, history, pivots.1stars
GhostFreeshane-js/ghostfreeMCP server that scans your repo's dependencies for security vulnerabilities based on published CVEs.1stars
Securityscorecard Mcpcallmarcus/security-scorecard-mcpCommunity-built, comprehensive MCP server for the SecurityScorecard API (unofficial).0stars
Obsidian Mcp Securedewtech-technologies/obsidian-mcp-secureSecure MCP server for Obsidian with OWASP Top 10 controls and full audit logging.0starsTubemind Secure Mcpdewtech-technologies/tubemind-secure-mcpSecure MCP server for YouTube intelligence — 18 tools, OAuth2, OWASP Top 10 controls.0stars