MCP Server Pt

🚀 Web Application Penetration Testing MCP

A comprehensive tool for analyzing security vulnerabilities in web applications, with a particular focus on business logic security vulnerabilities. This Master Control Program (MCP) systematically crawls, analyzes, and identifies potential security issues that standard scanners often miss.

🚀 Quick Start

Web Application Penetration Testing MCP helps you understand the business context of web applications. It constructs a complete map of the application's structure and identifies potential security weaknesses, especially vulnerabilities in business logic implementation.

✨ Features

Comprehensive Discovery

• Automatically build a tree structure of the entire web application.
• Map all links, forms, and interactive elements.
• Identify input fields, their types, and expected values.

Authentication Handling

• Automatically detect login/logout pages.
• Access protected areas using credential authentication.
• Support authentication based on Cookies and Bearer Tokens.

Business Logic Analysis

• Identify potential Insecure Direct Object Reference (IDOR) vulnerabilities.
• Detect mathematical/computational boundary cases.
• Map multi-step workflows that may be tampered with.
• Discover permission and access control issues.

Advanced Input Analysis

• Identify input field types (even if not explicitly defined).
• Generate appropriate test values based on field types.
• Detect hidden fields that may contain sensitive values.

Visualization Support

• Create a visual sitemap in DOT format (viewable via Graphviz).
• Highlight complex pages that require more attention.

📦 Installation

# Clone the repository
git clone https://github.com/yourusername/web-app-penetration-testing-mcp.git

# Navigate to the directory
cd web-app-penetration-testing-mcp

# Install dependencies - using uv
pip install -r requirements.txt

💻 Usage Examples

Basic Usage

# Basic usage
python web_app_mcp.py https://example.com

# Scan with authentication
python web_app_mcp.py https://example.com --username user@example.com --password mysecretpassword

# Create a visual sitemap
python web_app_mcp.py https://example.com --visual

# Control crawling speed and depth
python web_app_mcp.py https://example.com --delay 1.0 --max-pages 200

Command-line Arguments

📚 Documentation

The tool saves the output results as a JSON file, which includes discovered vulnerabilities, security warnings, and recommended repair measures.

🤝 Contribution

Contributions are welcome! Please feel free to submit a Pull Request.

📄 License

This project is open-sourced under the MIT License - see the LICENSE file for details.