Go MCP Request

🚀 MCP HTTP Request Tool (Go Version)

The MCP (Model Context Protocol) server is a full-featured HTTP client designed for API testing, web automation, and security testing. It comes with comprehensive HTTP tools and detailed logging capabilities. Written in Go, it offers better performance and easier deployment.

🚀 Quick Start

The MCP HTTP Request Tool is a powerful utility for various testing scenarios. It provides a wide range of features and easy-to-use interfaces.

✨ Features

• Full HTTP Method Support: GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS
• Advanced Security Testing: A raw request tool for penetration testing, SQL injection, and XSS testing
• Full Parameter Support: All methods support Headers, Cookies, Body, and timeout settings
• Automatic Logging: All requests and responses are automatically logged to ~/mcp_requests_logs/
• Exactness Guarantee: The raw mode preserves every character exactly
• MCP Compatibility: Compatible with Claude Code, Cursor, and other MCP clients

📦 Installation

Option 1: Download the Binary

Download the latest binary from the releases page.

Option 2: Build from Source

git clone https://github.com/pengcunfu/go-mcp-request.git
cd go-mcp-request
go build -o mcp-request main.go

💻 Usage Examples

Using in Cursor/Claude Code

Add it to your MCP configuration file (~/.cursor/mcp_servers.json or similar):

{
  "mcpServers": {
    "mcp-request": {
      "command": "./mcp-request",
      "type": "stdio"
    }
  }
}

Or if the binary is in your PATH:

{
  "mcpServers": {
    "mcp-request": {
      "command": "mcp-request",
      "type": "stdio"
    }
  }
}

Available Tools

1. http_get - A full-featured GET request
2. http_post - A full-featured POST request
3. http_put - A full-featured PUT request
4. http_delete - A full-featured DELETE request
5. http_patch - A full-featured PATCH request
6. http_head - A full-featured HEAD request
7. http_options - A full-featured OPTIONS request
8. http_raw_request - A raw HTTP request for security testing

Basic Usage

# Basic GET request
http_get("https://api.example.com/users")

# POST request with data and headers
http_post(
    url="https://api.example.com/login",
    body='{"username":"test","password":"test"}',
    headers={"Content-Type": "application/json"}
)

# Use raw request for security testing
http_raw_request(
    url="https://vulnerable-site.com/search",
    method="POST", 
    raw_body="q=test' OR 1=1--",
    headers={"Content-Type": "application/x-www-form-urlencoded"}
)

📚 Documentation

Security Testing Features

The http_raw_request tool is designed specifically for security testing:

• Absolute Precision: Every character is preserved exactly.
• No Encoding: Special characters (', ", \, %, &, =) are sent as they are.
• Full Headers: Long cookies or tokens are not truncated.
• Raw Payload: Perfect for SQL injection, XSS, and CSRF testing.

Logging

All HTTP requests and responses are automatically logged:

• Location: ~/mcp_requests_logs/
• Format: JSON format, including timestamps and full request/response details
• Filename: requests_YYYYMMDD_HHMMSS.log

To view the logs:

tail -f ~/mcp_requests_logs/requests_*.log

System Requirements

• Go ≥ 1.21 (required when building from source)
• No runtime dependencies, single binary

📄 License

This project is licensed under the MIT License.

🔗 Contribution

Contributions are welcome! This tool is intended for defensive security testing and legitimate API testing purposes only.