MCP External Recon Server

🚀 External Reconnaissance MCP Server

A Model Context Protocol (MCP) server for performing active external reconnaissance activities on domain names. This tool offers a simple suite of reconnaissance features, including DNS record enumeration, subdomain discovery, email security analysis, and SSL certificate checks.

🚀 Quick Start

This project is a Proof-of-Concept (PoC) created in my tutorial "Building Your First Offensive Security MCP Server" here.

⚠️ Important Note

This tool is for demonstration purposes only and is not production-ready. Use it at your own risk. Only run the MCP server if you trust the environment. Although it is a relatively harmless tool, it executes OS commands. Do not target systems without proper authorization.

✨ Features

• DNS Reconnaissance
  • Comprehensive DNS record enumeration (A, AAAA, MX, NS, SOA, TXT, SRV)
  • DNS zone transfer attempts
  • Subdomain enumeration and brute-forcing
• Domain Information
  • WHOIS queries
  • HTTP header analysis
• Email Security Assessment

System Requirements

Your system needs to have the following tools installed:

• dig (DNS lookup utility)
• whois
• dnsrecon

Required Files

A subdomain dictionary is provided for brute-forcing. You can add more or replace it with your own dictionary. (Note that there are currently limitations for very long dictionaries).

• dns-wordlist.txt

📦 Installation

For using the pre-built server, refer to: https://modelcontextprotocol.io/quickstart/user

1. Download the Claude desktop version.
2. Install uv:

curl -LsSf https://astral.sh/uv/install.sh | sh

3. Download this repository and add it to the Claude desktop version configuration:
   • Open Claude desktop version > Settings > Developer > Edit Configuration. This will create a configuration file at the following paths:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

Open this configuration file and replace the file content with the following using any text editor:

{
    "mcpServers": {
        "external-recon": {
            "command": "/ABSOLUTE/PATH/TO/PARENT/FOLDER/uv",
            "args": [
                "--directory",
                "/ABSOLUTE/PATH/TO/PARENT/FOLDER/mcp-external-recon-server",
                "run",
                "external-recon.py"
            ]
        }
    }
}

4. Restart the Claude desktop version. You should now see two icons in the chat bar. One hammer icon shows the available tools, and another connection icon shows the defined prompts and the required input (domain name).

5. Select the external reconnaissance settings and provide the target domain name, then let Claude perform the external reconnaissance and start working!

🔒 Security Considerations

1. Only target authorized systems.
2. Follow responsible disclosure guidelines.
3. Respect the resources of the target system.

🤝 Contribution

Contributions are welcome! Please feel free to submit pull requests.

📄 Disclaimer

This tool is for educational and authorized testing purposes only. Users must ensure they have proper authorization for the target systems.