@yallasec
Basic information
No overview available yet
Add this server to your MCP-compatible client using the configuration below.
{
"mcpServers": {
"mcp_server_pt": {
"command": "python",
"args": [
"web_app_mcp.py",
"https://example.com"
]
}
}
}Tool list not available yet
This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.
We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.
Web Application Penetration Testing MCP is a command-line tool that systematically crawls, analyzes, and identifies security vulnerabilities in web applications, with a primary focus on business logic flaws that standard scanners often miss. It builds a complete map of the application’s structure, maps links, forms, and interactive elements, and surfaces potential issues such as IDOR, calculation edge cases, and permission problems. It is intended for penetration testers and security researchers who need deeper, context-aware analysis of web apps.
Install by cloning the repository and running pip install -r requirements.txt. Then run python web_app_mcp.py <target_url>. Common options include --username and --password for authenticated scanning, --visual to generate a DOT‑format sitemap, --delay to rate‑limit requests, and --max-pages to limit crawl depth. Output is saved to mcp_results.json by default.
It focuses on business logic vulnerabilities: IDOR, calculation edge cases, multi‑step workflow manipulation, and permission/access control issues. It also identifies hidden fields and generates context‑aware test values.
Use the `--username` and `--password` flags to provide login credentials, or pass a cookie string with `--cookies`. The tool automatically detects login/logout pages and handles cookie‑based and bearer token authentication.
A JSON file (`mcp_results.json` by default) containing the complete application structure, authentication mechanisms, identified input fields, multi‑step workflows, potential edge cases, and business logic analysis results.
Yes. Use the `--visual` flag to produce a `sitemap.dot` file. Convert it to PNG with Graphviz: `dot -Tpng sitemap.dot -o sitemap.png`.
Use `--delay` to set the delay between requests (default 0.5 seconds) and `--max-pages` to limit how many pages are crawled (default 100). You can also specify a starting path and use `--max-depth` to limit nested traversal.
Couples therapist Figs O'Sullivan (LMFT, 17 years, endorsed by Sue Johnson, creator of EFT) inside your AI. Ask relationship questions answered from his clinical writing, name the pattern in a fight, get a three-step rep
Health by Dr Brad works out a health plan from your own results: which screening is due at your age, and evidence-based suggestions, each with the reason and the published guideline or study behind it. Your record is one
A free remote MCP server for The Living Bread. Bible passages read word for word from a stored public domain text with an evidence label, keyword search and cross references, real churches, gatherings and prayer groups w
Model Context Protocol Servers
DeepMark helps teachers deliver rapid, consistent marking with meaningful feedback for every student — in a fraction of the time. What once took a week, now takes one free period.
Comments