Web Application Penetration Testing MCP

by yallasec

4 stars

104 downloads

Not rated

GitHub

Other

Description

# Web Application Penetration Testing MCP A comprehensive tool for analyzing web applications with a focus on business logic security vulnerabilities. This Master Control Program (MCP) systematically crawls, analyzes, and identifies potential security issues beyond what standard…

About

Details

Author: yallasec
GitHub stars: 4
Downloads: 104
Categories: Other

- Automatically builds a tree structure of the entire web application
- Detects login/logout pages and supports cookie and bearer token authentication
- Identifies IDOR, calculation edge cases, and multi‑step workflow issues
- Discovers hidden fields and generates test values based on input field type
- Produces visual sitemaps in DOT format (viewable with Graphviz)

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name Web Application Penetration Testing MCP

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "web application penetration testing mcp": {
            "mcp_server_pt": {
                "command": "python",
                "args": [
                    "web_app_mcp.py",
                    "https://example.com"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "web application penetration testing mcp": {
            "mcp_server_pt": {
                "command": "python",
                "args": [
                    "web_app_mcp.py",
                    "https://example.com"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "web application penetration testing mcp": {
            "mcp_server_pt": {
                "command": "python",
                "args": [
                    "web_app_mcp.py",
                    "https://example.com"
                ]
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "web application penetration testing mcp": {
            "mcp_server_pt": {
                "command": "python",
                "args": [
                    "web_app_mcp.py",
                    "https://example.com"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "web application penetration testing mcp": {
            "mcp_server_pt": {
                "command": "python",
                "args": [
                    "web_app_mcp.py",
                    "https://example.com"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "web application penetration testing mcp": {
            "mcp_server_pt": {
                "command": "python",
                "args": [
                    "web_app_mcp.py",
                    "https://example.com"
                ]
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "web application penetration testing mcp": {
            "mcp_server_pt": {
                "command": "python",
                "args": [
                    "web_app_mcp.py",
                    "https://example.com"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "web application penetration testing mcp": {
            "mcp_server_pt": {
                "command": "python",
                "args": [
                    "web_app_mcp.py",
                    "https://example.com"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "web application penetration testing mcp": {
            "mcp_server_pt": {
                "command": "python",
                "args": [
                    "web_app_mcp.py",
                    "https://example.com"
                ]
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "web application penetration testing mcp": {
            "mcp_server_pt": {
                "command": "python",
                "args": [
                    "web_app_mcp.py",
                    "https://example.com"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "web application penetration testing mcp": {
            "mcp_server_pt": {
                "command": "python",
                "args": [
                    "web_app_mcp.py",
                    "https://example.com"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "web application penetration testing mcp": {
            "mcp_server_pt": {
                "command": "python",
                "args": [
                    "web_app_mcp.py",
                    "https://example.com"
                ]
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "web application penetration testing mcp": {
            "mcp_server_pt": {
                "command": "python",
                "args": [
                    "web_app_mcp.py",
                    "https://example.com"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "web application penetration testing mcp": {
            "mcp_server_pt": {
                "command": "python",
                "args": [
                    "web_app_mcp.py",
                    "https://example.com"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "web application penetration testing mcp": {
            "mcp_server_pt": {
                "command": "python",
                "args": [
                    "web_app_mcp.py",
                    "https://example.com"
                ]
            }
        }
    }
}

From the repository

Install by cloning the repository and running pip install -r requirements.txt. Then run python web_app_mcp.py <target_url>. Common options include --username and --password for authenticated scanning, --visual to generate a DOT‑format sitemap, --delay to rate‑limit requests, and --max-pages to limit crawl depth. Output is saved to mcp_results.json by default.

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "web application penetration testing mcp": {
            "mcp_server_pt": {
                "command": "python",
                "args": [
                    "web_app_mcp.py",
                    "https://example.com"
                ]
            }
        }
    }
}

McpServers

{
    "mcp_server_pt": {
        "command": "python",
        "args": [
            "web_app_mcp.py",
            "https://example.com"
        ]
    }
}

Web Application Penetration Testing MCP

A comprehensive tool for analyzing web applications with a focus on business logic security vulnerabilities. This Master Control Program (MCP) systematically crawls, analyzes, and identifies potential security issues beyond what standard scanners detect.

Overview

Web Application Penetration Testing MCP helps you understand the business context of web applications by building a complete map of the application structure and identifying potential security weak points, particularly in business logic implementation.

Key Features

Comprehensive Discovery

- Automatically builds a tree structure of the entire web application - Maps all links, forms, and interactive elements - Identifies input fields with their types and expected values

Authentication Handling

- Automatically detects login/logout pages - Can authenticate using credentials to access protected areas - Supports both cookie-based and bearer token authentication

Business Logic Analysis

- Identifies potential IDOR (Insecure Direct Object Reference) vulnerabilities - Detects mathematical/calculation edge cases - Maps multi-step workflows that could be manipulated - Discovers permission and access control issues

Advanced Input Analysis

- Identifies input field types (even when not explicitly defined) - Generates appropriate test values based on field type - Detects hidden fields that might contain sensitive values

Visualization Support

- Creates a visual sitemap using DOT format (viewable with Graphviz) - Highlights complex pages requiring more attention

Installation

```bash

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

Description

About

Details

Jump to

Setting up with Highlight

From the repository

Claude Desktop / Cursor

McpServers

Web Application Penetration Testing MCP

Overview

Key Features

Comprehensive Discovery

Authentication Handling

Business Logic Analysis

Advanced Input Analysis

Visualization Support

Installation

Install

More like this

Sequential Thinking

Filesystem

EverArt

Google Drive

Reactive Resume

FastMCP v2 🚀