English Français العربية

io.github.joepangallo/web-recon-agent

Official registry Security

Owned-target web security assessment MCP server for authenticated, high-friction apps.

Source code

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package mcp-web-recon-agent
Claude Code 
claude mcp add web-recon-agent -e 'MCP_TARGET_ALLOWLIST=<MCP_TARGET_ALLOWLIST>' -e 'MCP_OWNED_TARGETS=<MCP_OWNED_TARGETS>' -e 'MCP_JOB_STORE_PATH=<MCP_JOB_STORE_PATH>' -e 'MCP_MAX_CONCURRENT=<MCP_MAX_CONCURRENT>' -e 'MCP_CONFIG_PATH=<MCP_CONFIG_PATH>' -- npx -y mcp-web-recon-agent@0.8.1
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "web-recon-agent": {
            "command": "npx",
            "args": [
                "-y",
                "mcp-web-recon-agent@0.8.1"
            ],
            "env": {
                "MCP_TARGET_ALLOWLIST": "<MCP_TARGET_ALLOWLIST>",
                "MCP_OWNED_TARGETS": "<MCP_OWNED_TARGETS>",
                "MCP_JOB_STORE_PATH": "<MCP_JOB_STORE_PATH>",
                "MCP_MAX_CONCURRENT": "<MCP_MAX_CONCURRENT>",
                "MCP_CONFIG_PATH": "<MCP_CONFIG_PATH>"
            }
        }
    }
}

Environment variables

  • MCP_TARGET_ALLOWLIST required Comma-separated hostnames allowed for scanning. Required.
  • MCP_OWNED_TARGETS Comma-separated hostnames you explicitly own to unlock active and owned-aggressive scan modes.
  • MCP_JOB_STORE_PATH Optional path for persisted job metadata. Defaults to mcp-jobs.json in the current working directory.
  • MCP_MAX_CONCURRENT Optional maximum number of concurrent scan jobs. Defaults to 2.
  • MCP_CONFIG_PATH Optional path to a JSON config file that overrides allowlist and concurrency settings.

Frequently asked questions

What is io.github.joepangallo/web-recon-agent?

Owned-target web security assessment MCP server for authenticated, high-friction apps.

How do I install io.github.joepangallo/web-recon-agent?

It runs on your machine. In Claude Code: claude mcp add web-recon-agent -e 'MCP_TARGET_ALLOWLIST=<MCP_TARGET_ALLOWLIST>' -e 'MCP_OWNED_TARGETS=<MCP_OWNED_TARGETS>' -e 'MCP_JOB_STORE_PATH=<MCP_JOB_STORE_PATH>' -e 'MCP_MAX_CONCURRENT=<MCP_MAX_CONCURRENT>' -e 'MCP_CONFIG_PATH=<MCP_CONFIG_PATH>' -- npx -y mcp-web-recon-agent@0.8.1. For other clients, paste the JSON configuration from this page into their MCP settings.

Does io.github.joepangallo/web-recon-agent need an API key?

Yes. It expects MCP_TARGET_ALLOWLIST, which you set in its configuration.

Is io.github.joepangallo/web-recon-agent open source?

Its code is public on GitHub, but the repository does not declare a standard license.

Who maintains io.github.joepangallo/web-recon-agent?

It is published by joepangallo. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.