Web Recon Agent
Run allowlisted, owned-target web recon and security assessment from your coding agent before or after shipping authenticated apps.
Overview
io.github.joepangallo/web-recon-agent is a MCP server for the Ship phase that runs allowlisted web security assessment jobs against owned or authorized targets.
What is this MCP server?
- Requires MCP_TARGET_ALLOWLIST hostnames before any scan runs
- MCP_OWNED_TARGETS unlocks active and owned-aggressive modes for hosts you control
- stdio npm package mcp-web-recon-agent (v0.8.1)
- Optional MCP_MAX_CONCURRENT caps parallel jobs (default 2)
- Optional MCP_JOB_STORE_PATH persists job metadata (default mcp-jobs.json)
- Package version 0.8.1
- Default MCP_MAX_CONCURRENT is 2
- Transport: stdio via npm identifier mcp-web-recon-agent
What problem does it solve?
Solo builders hardening login-heavy apps lack a safe, agent-callable way to run recon without drifting onto unauthorized hosts.
Who is it for?
Indie developers shipping SaaS with auth who control staging domains and want MCP-driven security passes on an explicit hostname list.
Skip if: Builders scanning third-party sites, bug-bounty targets without written scope, or teams that need a managed SaaS scanner with no local ops.
What do I get? / Deliverables
After you register the server with allowlists and optional owned-target flags, your agent can launch bounded concurrent assessment jobs with persisted metadata.
- Agent-invokable scan jobs against allowlisted hosts
- Optional persisted job history via MCP_JOB_STORE_PATH
- Concurrency-bounded parallel assessments (default max 2)
Recommended MCP Servers
Journey fit
Security assessment and reconnaissance belong in Ship where solo builders harden and verify what they are about to release or already run in production. Matches the security subphase because the server is explicitly framed as web security assessment for high-friction, authenticated targets—not generic browsing or docs lookup.
How it compares
MCP security recon integration, not a Claude skill or a passive documentation search server.
Common Questions / FAQ
Who is io.github.joepangallo/web-recon-agent for?
It is for developers and agent workflows that need owned-target web security assessment on authenticated apps, with mandatory hostname allowlisting.
When should I use io.github.joepangallo/web-recon-agent?
Use it during Ship security work when you have defined hosts in MCP_TARGET_ALLOWLIST and optionally MCP_OWNED_TARGETS for stronger modes on property you control.
How do I add io.github.joepangallo/web-recon-agent to my agent?
Add the stdio npm package mcp-web-recon-agent to your MCP client config, set MCP_TARGET_ALLOWLIST (required), then restart the agent so tools load over stdio.