Web Security Scanner

🚀 MCP Server Penetration Testing

This project offers automated vulnerability detection and browser interaction capabilities for MCP servers.

🚀 Quick Start

This project provides a set of tools for MCP server penetration testing, including automated vulnerability detection and browser interaction functions.

✨ Features

• Automatic detection of XSS and SQL vulnerabilities across all browsers.
• Screenshot functionality for the entire page or specific elements.
• Comprehensive support for network interactions (navigation, clicking, form filling).
• Console log monitoring.
• Execution of JavaScript in the browser context.

📦 Installation

Installation Steps

npx playwright install firefox
yarn install 
npm run build 

📚 Documentation

Configuration Instructions

The following configuration will be automatically added to your Claude configuration file during installation:

{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": [
        "-y",
        "/Users/...../dist/index.js"
      ],
      "disabled": false,
      "autoApprove": []
    }
  }
}

Component Tools

Toolset

broser_url_reflected_xss

Test if a URL has a reflected XSS vulnerability.

{
  "url": "https://test.com",
  "paramName":"text"
}

browser_url_sql_injection

Test if a URL has an SQL injection vulnerability.

{
  "url": "https://test.com",
  "paramName":"text"
}

browser_navigate

Navigate to any URL in the browser.

{
  "url": "https://stealthbrowser.cloud"
}

browser_screenshot

Capture a screenshot of the page or a specific element.

{
  "name": "screenshot-name",     // Required
  "selector": "#element-id",     // Optional
  "fullPage": true              // Optional, default: false
}

browser_click

Click an element on the page using a CSS selector.

{
  "selector": "#button-id"
}

browser_click_text

Click an element on the page based on its text content.

{
  "text": "Click me"
}

browser_hover

Hover over an element on the page (using a CSS selector).

{
  "selector": "#menu-item"
}

browser_hover_text

Hover over an element on the page based on its text content.

{
  "text": "Hover me"
}

browser_fill

Fill in a form field.

{
  "selector": "#input-field",
  "value": "Hello World"
}

browser_select

Select an option from a dropdown list using a CSS selector.

{
  "selector": "#dropdown",
  "value": "option-value"
}

browser_select_text

Select an option from a dropdown list based on its text content.

{
  "text": "Choose me",
  "value": "option-value"
}

browser_evaluate

Execute JavaScript in the browser console.

{
  "script": "document.title"
}