Web Recon Agent

Official

by joepangallo

Owned-target web security assessment MCP server for authenticated, high-friction apps.

Perform authenticated security assessments on owned web applications.

Install

Configuration

Environment variables

MCP_TARGET_ALLOWLISTrequired

Comma-separated hostnames allowed for scanning. Required.

MCP_OWNED_TARGETS

Comma-separated hostnames you explicitly own to unlock active and owned-aggressive scan modes.

MCP_JOB_STORE_PATH

Optional path for persisted job metadata. Defaults to mcp-jobs.json in the current working directory.

MCP_MAX_CONCURRENT

Optional maximum number of concurrent scan jobs. Defaults to 2.

MCP_CONFIG_PATH

Optional path to a JSON config file that overrides allowlist and concurrency settings.

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "web-recon-agent": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-web-recon-agent@0.8.1"
      ],
      "env": {
        "MCP_TARGET_ALLOWLIST": "<YOUR_MCP_TARGET_ALLOWLIST>",
        "MCP_OWNED_TARGETS": "<YOUR_MCP_OWNED_TARGETS>",
        "MCP_JOB_STORE_PATH": "<YOUR_MCP_JOB_STORE_PATH>",
        "MCP_MAX_CONCURRENT": "<YOUR_MCP_MAX_CONCURRENT>",
        "MCP_CONFIG_PATH": "<YOUR_MCP_CONFIG_PATH>"
      }
    }
  }
}