Web Security Scanner

by 9olidity

12 stars

Not rated

GitHub

About

Enables automated web security testing for XSS and SQL injection vulnerabilities through Playwright-powered browser automation with screenshot capture and comprehensive error handling.

Details

Author: 9olidity
Repository: 9olidity/MCP-Server-Pentest
GitHub stars: 12
License: MIT License
Categories: Productivity, Design, Developer Tools, AI, Security, Infrastructure, Automation

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below
Plugin Name Web Security Scanner

Command (node, npx, python, etc.) npx
Arguments
- Argument 1 -y
- Argument 2 /Users/...../dist/index.js
Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "web security scanner": {
            "env": {},
            "args": [
                "-y",
                "/Users/...../dist/index.js"
            ],
            "command": "npx",
            "disabled": false,
            "autoApprove": []
        }
    }
}

JSON

{
    "mcpServers": {
        "web security scanner": {
            "env": {},
            "args": [
                "/c",
                "npx",
                "-y",
                "/Users/...../dist/index.js"
            ],
            "command": "cmd",
            "disabled": false,
            "autoApprove": []
        }
    }
}

JSON

{
    "mcpServers": {
        "web security scanner": {
            "env": {},
            "args": [
                "-y",
                "/Users/...../dist/index.js"
            ],
            "command": "npx",
            "disabled": false,
            "autoApprove": []
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "web security scanner": {
            "env": {},
            "args": [
                "-y",
                "/Users/...../dist/index.js"
            ],
            "command": "npx",
            "disabled": false,
            "autoApprove": []
        }
    }
}

JSON

{
    "mcpServers": {
        "web security scanner": {
            "env": {},
            "args": [
                "/c",
                "npx",
                "-y",
                "/Users/...../dist/index.js"
            ],
            "command": "cmd",
            "disabled": false,
            "autoApprove": []
        }
    }
}

JSON

{
    "mcpServers": {
        "web security scanner": {
            "env": {},
            "args": [
                "-y",
                "/Users/...../dist/index.js"
            ],
            "command": "npx",
            "disabled": false,
            "autoApprove": []
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "web security scanner": {
            "env": {},
            "args": [
                "-y",
                "/Users/...../dist/index.js"
            ],
            "command": "npx",
            "disabled": false,
            "autoApprove": []
        }
    }
}

JSON

{
    "mcpServers": {
        "web security scanner": {
            "env": {},
            "args": [
                "/c",
                "npx",
                "-y",
                "/Users/...../dist/index.js"
            ],
            "command": "cmd",
            "disabled": false,
            "autoApprove": []
        }
    }
}

JSON

{
    "mcpServers": {
        "web security scanner": {
            "env": {},
            "args": [
                "-y",
                "/Users/...../dist/index.js"
            ],
            "command": "npx",
            "disabled": false,
            "autoApprove": []
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "web security scanner": {
            "env": {},
            "args": [
                "-y",
                "/Users/...../dist/index.js"
            ],
            "command": "npx",
            "disabled": false,
            "autoApprove": []
        }
    }
}

JSON

{
    "mcpServers": {
        "web security scanner": {
            "env": {},
            "args": [
                "/c",
                "npx",
                "-y",
                "/Users/...../dist/index.js"
            ],
            "command": "cmd",
            "disabled": false,
            "autoApprove": []
        }
    }
}

JSON

{
    "mcpServers": {
        "web security scanner": {
            "env": {},
            "args": [
                "-y",
                "/Users/...../dist/index.js"
            ],
            "command": "npx",
            "disabled": false,
            "autoApprove": []
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "web security scanner": {
            "env": {},
            "args": [
                "-y",
                "/Users/...../dist/index.js"
            ],
            "command": "npx",
            "disabled": false,
            "autoApprove": []
        }
    }
}

JSON

{
    "mcpServers": {
        "web security scanner": {
            "env": {},
            "args": [
                "/c",
                "npx",
                "-y",
                "/Users/...../dist/index.js"
            ],
            "command": "cmd",
            "disabled": false,
            "autoApprove": []
        }
    }
}

JSON

{
    "mcpServers": {
        "web security scanner": {
            "env": {},
            "args": [
                "-y",
                "/Users/...../dist/index.js"
            ],
            "command": "npx",
            "disabled": false,
            "autoApprove": []
        }
    }
}

From the repository

The installation process will automatically add the following configuration to your Claude config file:

{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": [
        "-y",
        "/Users/...../dist/index.js"
      ],
      "disabled": false,
      "autoApprove": []
    }
  }
}

npx playwright install firefox
yarn install 
npm run build

`broser_url_reflected_xss`

Test whether the URL has an XSS vulnerability. Parameters: url (string), paramName (string)

`browser_url_sql_injection`

Test whether the URL has SQL injection vulnerabilities. Parameters: url (string), paramName (string)

`browser_navigate`

Navigate to any URL in the browser. Parameters: url (string)

`browser_screenshot`

Capture screenshots of the entire page or specific elements. Parameters: name (string, required), selector (string, optional), fullPage (boolean, optional, default: false)

`browser_click`

Click elements on the page using CSS selector. Parameters: selector (string)

`browser_click_text`

Click elements on the page by their text content. Parameters: text (string)

`browser_hover`

Hover over elements on the page using CSS selector. Parameters: selector (string)

`browser_hover_text`

Hover over elements on the page by their text content. Parameters: text (string)

`browser_fill`

Fill out input fields. Parameters: selector (string), value (string)

`browser_select`

Select an option in a SELECT element using CSS selector. Parameters: selector (string), value (string)

`browser_select_text`

Select an option in a SELECT element by its text content. Parameters: text (string), value (string)

`browser_evaluate`

Execute JavaScript in the browser console. Parameters: script (string)

`broser_url_reflected_xss`

Test whether the URL has an XSS vulnerability

{
  "url": "https://test.com",
  "paramName":"text"
}

`browser_url_sql_injection`

Test whether the URL has SQL injection vulnerabilities

{
  "url": "https://test.com",
  "paramName":"text"
}

`browser_navigate`

Navigate to any URL in the browser

{
  "url": "https://stealthbrowser.cloud"
}

`browser_screenshot`

Capture screenshots of the entire page or specific elements

{
  "name": "screenshot-name",     // required
  "selector": "#element-id",     // optional
  "fullPage": true              // optional, default: false
}

`browser_click`

Click elements on the page using CSS selector

{
  "selector": "#button-id"
}

`browser_click_text`

Click elements on the page by their text content

{
  "text": "Click me"
}

`browser_hover`

Hover over elements on the page using CSS selector

{
  "selector": "#menu-item"
}

`browser_hover_text`

Hover over elements on the page by their text content

{
  "text": "Hover me"
}

`browser_fill`

Fill out input fields

{
  "selector": "#input-field",
  "value": "Hello World"
}

`browser_select`

Select an option in a SELECT element using CSS selector

{
  "selector": "#dropdown",
  "value": "option-value"
}

`browser_select_text`

Select an option in a SELECT element by its text content

{
  "text": "Choose me",
  "value": "option-value"
}

`browser_evaluate`

Execute JavaScript in the browser console

{
  "script": "document.title"
}

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "web security scanner": {
            "env": {},
            "args": [
                "-y",
                "/Users/...../dist/index.js"
            ],
            "command": "npx",
            "disabled": false,
            "autoApprove": []
        }
    }
}

Linux

{
    "env": [],
    "args": [
        "-y",
        "/Users/...../dist/index.js"
    ],
    "command": "npx",
    "disabled": false,
    "autoApprove": []
}

Macos

{
    "env": [],
    "args": [
        "-y",
        "/Users/...../dist/index.js"
    ],
    "command": "npx",
    "disabled": false,
    "autoApprove": []
}

Windows

{
    "env": [],
    "args": [
        "/c",
        "npx",
        "-y",
        "/Users/...../dist/index.js"
    ],
    "command": "cmd",
    "disabled": false,
    "autoApprove": []
}

<h1 align="center">MCP Server Pentest</h1>

Features

Installation

Installing

npx playwright install firefox
yarn install 
npm run build

Configuration

The installation process will automatically add the following configuration to your Claude config file:

{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": [
        "-y",
        "/Users/...../dist/index.js"
      ],
      "disabled": false,
      "autoApprove": []
    }
  }
}

Components

Tools

`broser_url_reflected_xss`

Test whether the URL has an XSS vulnerability

{
  "url": "https://test.com",
  "paramName":"text"
}

`browser_url_sql_injection`

Test whether the URL has SQL injection vulnerabilities

{
  "url": "https://test.com",
  "paramName":"text"
}

`browser_navigate`

Navigate to any URL in the browser

{
  "url": "https://stealthbrowser.cloud"
}

`browser_screenshot`

Capture screenshots of the entire page or specific elements

{
  "name": "screenshot-name",     // required
  "selector": "#element-id",     // optional
  "fullPage": true              // optional, default: false
}

`browser_click`

Click elements on the page using CSS selector

{
  "selector": "#button-id"
}

`browser_click_text`

Click elements on the page by their text content

{
  "text": "Click me"
}

`browser_hover`

Hover over elements on the page using CSS selector

{
  "selector": "#menu-item"
}

`browser_hover_text`

Hover over elements on the page by their text content

{
  "text": "Hover me"
}

`browser_fill`

Fill out input fields

{
  "selector": "#input-field",
  "value": "Hello World"
}

`browser_select`

Select an option in a SELECT element using CSS selector

{
  "selector": "#dropdown",
  "value": "option-value"
}

`browser_select_text`

Select an option in a SELECT element by its text content

{
  "text": "Choose me",
  "value": "option-value"
}

`browser_evaluate`

Execute JavaScript in the browser console

{
  "script": "document.title"
}

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Details

Jump to

Setting up with Highlight

From the repository

broser_url_reflected_xss

browser_url_sql_injection

browser_navigate

browser_screenshot

browser_click

browser_click_text

browser_hover

browser_hover_text

browser_fill

browser_select

browser_select_text

browser_evaluate

broser_url_reflected_xss

browser_url_sql_injection

browser_navigate

browser_screenshot

browser_click

browser_click_text

browser_hover

browser_hover_text

browser_fill

browser_select

browser_select_text

browser_evaluate

Claude Desktop / Cursor

Linux

Macos

Windows

Features

Installation

Installing

Configuration

Components

Tools

broser_url_reflected_xss

browser_url_sql_injection

browser_navigate

browser_screenshot

browser_click

browser_click_text

browser_hover

browser_hover_text

browser_fill

browser_select

browser_select_text

browser_evaluate

Install

More like this

Time

Sentry

Github

Git

GitLab

Context 7

`broser_url_reflected_xss`

`browser_url_sql_injection`

`browser_navigate`

`browser_screenshot`

`browser_click`

`browser_click_text`

`browser_hover`

`browser_hover_text`

`browser_fill`

`browser_select`

`browser_select_text`

`browser_evaluate`

`broser_url_reflected_xss`

`browser_url_sql_injection`

`browser_navigate`

`browser_screenshot`

`browser_click`

`browser_click_text`

`browser_hover`

`browser_hover_text`

`browser_fill`

`browser_select`

`browser_select_text`

`browser_evaluate`

`broser_url_reflected_xss`

`browser_url_sql_injection`

`browser_navigate`

`browser_screenshot`

`browser_click`

`browser_click_text`

`browser_hover`

`browser_hover_text`

`browser_fill`

`browser_select`

`browser_select_text`

`browser_evaluate`