Owned-target web security assessment MCP server for authenticated, high-friction apps.
Connect Runs on your machine
claude mcp add web-recon-agent -e MCP_TARGET_ALLOWLIST=<MCP_TARGET_ALLOWLIST> -e MCP_OWNED_TARGETS=<MCP_OWNED_TARGETS> -e MCP_JOB_STORE_PATH=<MCP_JOB_STORE_PATH> -e MCP_MAX_CONCURRENT=<MCP_MAX_CONCURRENT> -e MCP_CONFIG_PATH=<MCP_CONFIG_PATH> -- npx -y [email protected]{
"mcpServers": {
"web-recon-agent": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"MCP_TARGET_ALLOWLIST": "<MCP_TARGET_ALLOWLIST>",
"MCP_OWNED_TARGETS": "<MCP_OWNED_TARGETS>",
"MCP_JOB_STORE_PATH": "<MCP_JOB_STORE_PATH>",
"MCP_MAX_CONCURRENT": "<MCP_MAX_CONCURRENT>",
"MCP_CONFIG_PATH": "<MCP_CONFIG_PATH>"
}
}
}
}{
"mcpServers": {
"web-recon-agent": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"MCP_TARGET_ALLOWLIST": "<MCP_TARGET_ALLOWLIST>",
"MCP_OWNED_TARGETS": "<MCP_OWNED_TARGETS>",
"MCP_JOB_STORE_PATH": "<MCP_JOB_STORE_PATH>",
"MCP_MAX_CONCURRENT": "<MCP_MAX_CONCURRENT>",
"MCP_CONFIG_PATH": "<MCP_CONFIG_PATH>"
}
}
}
}{
"servers": {
"web-recon-agent": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"MCP_TARGET_ALLOWLIST": "<MCP_TARGET_ALLOWLIST>",
"MCP_OWNED_TARGETS": "<MCP_OWNED_TARGETS>",
"MCP_JOB_STORE_PATH": "<MCP_JOB_STORE_PATH>",
"MCP_MAX_CONCURRENT": "<MCP_MAX_CONCURRENT>",
"MCP_CONFIG_PATH": "<MCP_CONFIG_PATH>"
}
}
}
}Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools
This server runs locally, so its tools are listed by your MCP client once it starts.
Environment variables
| Name | Description |
|---|---|
MCP_TARGET_ALLOWLISTRequired | Comma-separated hostnames allowed for scanning. Required. |
MCP_OWNED_TARGETSOptional | Comma-separated hostnames you explicitly own to unlock active and owned-aggressive scan modes. |
MCP_JOB_STORE_PATHOptional | Optional path for persisted job metadata. Defaults to mcp-jobs.json in the current working directory. |
MCP_MAX_CONCURRENTOptional | Optional maximum number of concurrent scan jobs. Defaults to 2. |
MCP_CONFIG_PATHOptional | Optional path to a JSON config file that overrides allowlist and concurrency settings. |
Details
| Package | [email protected] (NPM, stdio) |
| First published | 25 Mar 2026 |
| Last updated | 25 Mar 2026 |
| Registry name | io.github.joepangallo/web-recon-agent |
More security servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.