mcpField
W
web-recon-agent

web-recon-agent

Local
github.com/joepangalloSecurity
Repository

About web-recon-agent

Owned-target web security assessment MCP server for authenticated, high-friction apps.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "joepangallo-web-recon-agent": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-web-recon-agent"
      ],
      "env": {
        "MCP_TARGET_ALLOWLIST": "<MCP_TARGET_ALLOWLIST>",
        "MCP_OWNED_TARGETS": "<MCP_OWNED_TARGETS>",
        "MCP_JOB_STORE_PATH": "<MCP_JOB_STORE_PATH>",
        "MCP_MAX_CONCURRENT": "<MCP_MAX_CONCURRENT>",
        "MCP_CONFIG_PATH": "<MCP_CONFIG_PATH>"
      }
    }
  }
}
Run commandnpx -y mcp-web-recon-agent
Environment variables to set
MCP_TARGET_ALLOWLISTComma-separated hostnames allowed for scanning. Required.
MCP_OWNED_TARGETSComma-separated hostnames you explicitly own to unlock active and owned-aggressive scan modes.
MCP_JOB_STORE_PATHOptional path for persisted job metadata. Defaults to mcp-jobs.json in the current working directory.
MCP_MAX_CONCURRENTOptional maximum number of concurrent scan jobs. Defaults to 2.
MCP_CONFIG_PATHOptional path to a JSON config file that overrides allowlist and concurrency settings.

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npmmcp-web-recon-agent0.8.1

Tools

8

Saved tool list · updated 2w ago

ParameterTypeRequiredDescription
browserbooleanNoEnable browser-based discovery
profilesstringNoPath to a profiles JSON file inside the repository root
targetUrlstringYesThe target URL to scan (must be in the allowlist)
scanPresetenumNoScan depth presetconservative | balanced | aggressive
passiveModelstringNoOverride passive agent model
baselineJobIdstringNoPrior completed job ID whose report.json should be used as the regression baseline
baselineReportstringNoPath to a baseline report.json under output/ for regression comparison
passiveProviderenumNoLLM provider for passive agentsclaude | openai

Details

The maintainer has not added details yet. Check the README in the repository.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.