Wass Mcp
Wraps four security scanning tools (Nikto, Nuclei, Wapiti, shcheck) in an MCP interface for web application security testing. You get individual tools for server vulnerability scans, template-based CVE detection, app-level injection testing, and security header analysis, plus a full_scan that runs all four in parallel. Each tool takes a host and optional port, returns paginated results, and logs to SQLite so you can query execution history later. Ships as a Docker container that listens on HTTP and survives restarts without losing state. Intended for authorized penetration testing and security assessments where you need to coordinate multiple scanners through a conversational interface rather than CLI invocations.
- GitHub stars
- 7
- tools
- 6
- last updated
- Feb 12, 2026
Tools
6 toolsPublic tool metadata for what this MCP can expose to an agent.
niktoPerform web server vulnerability scans using Nikto.
Perform web server vulnerability scans using Nikto.
No parameter schema in public metadata yet.
nucleiPerform template-based vulnerability scanning using Nuclei.
Perform template-based vulnerability scanning using Nuclei.
No parameter schema in public metadata yet.
wapitiPerform comprehensive web application vulnerability scans using Wapiti.
Perform comprehensive web application vulnerability scans using Wapiti.
No parameter schema in public metadata yet.
shcheck_pyAnalyze HTTP security headers using shcheck.py.
Analyze HTTP security headers using shcheck.py.
No parameter schema in public metadata yet.
full_scanPerform a comprehensive security scan using all available scanners in parallel.
Perform a comprehensive security scan using all available scanners in parallel.
No parameter schema in public metadata yet.
historyBrowse and manage tool execution history.
Browse and manage tool execution history.
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
WASS-MCP
A Model Context Protocol (MCP) server for web application security scanning.
Features
- MCP Protocol Support - Full compatibility with MCP clients (Claude, etc.)
- Nikto Integration - Web server vulnerability scanning
- Nuclei Integration - Template-based vulnerability scanning
- Wapiti Integration - Web application vulnerability scanning
- Shcheck Integration - Security headers analysis
- Execution History - Persistent storage of scan results
- Stateless Design - Survives server restarts without session errors
- RESTful HTTP Transport - Streamable HTTP-based MCP protocol
Usage
docker run -p 127.0.0.1:8989:8989 tb0hdan/wass-mcp
MCP Client Configuration
Example command to add WASS-MCP server to Claude MCP clients:
claude mcp add wass-mcp --transport http http://127.0.0.1:8989
or Gemini:
gemini mcp add wass-mcp --transport http http://127.0.0.1:8989
Available Tools
nikto
Perform web server vulnerability scans using Nikto.
Parameters:
Details
- Repository
- github.com/tb0hdan/wass-mcp
- Category
- Security & Pentesting
- Registry
- MCP registry, active
Related Security & Pentesting MCP servers
View all
Guardvibegoklab/guardvibeDeterministic security layer your AI can't be. 669 rules, 39 tools, CLI + doctor + host audit.6stars
Pincervouchlyai/pincer-mcpSecure grip for your agent's secrets - security-hardened MCP gateway with proxy token architecture6stars
Cybersecurity Vulnerability Intelmartc03/gov-mcp-serversCVE lookup via NIST NVD, CISA KEV, EPSS, and MITRE ATT&CK. 7 tools.0stars
FedRAMP 20x Requirementskevinrabun/fedramp20xmcpAn MCP server that provides access to FedRAMP 20x security requirements and controls.5stars
Promptrejectormcprevsmoke/promptrejectormcpSecurity gateway for AI agents: detects prompt injections, jailbreaks, and common vulnerabilities.2stars
MCP Gateway Scanwillianpinho/mcp-gateway-scanRead-only MCP/agent-gateway readiness scanner — scores a repo across 7 security dimensions.2stars