web recon agent for VS Code

io.github.joepangallo/web-recon-agent

Owned-target web security assessment MCP server for authenticated, high-friction apps.

client:VS Code transport:stdio runtime:npm

Install web recon agent in VS Code

.vscode/mcp.json

{
  "inputs": [
    {
      "type": "promptString",
      "id": "mcp-target-allowlist",
      "description": "MCP_TARGET_ALLOWLIST",
      "password": true
    },
    {
      "type": "promptString",
      "id": "mcp-owned-targets",
      "description": "MCP_OWNED_TARGETS",
      "password": true
    },
    {
      "type": "promptString",
      "id": "mcp-job-store-path",
      "description": "MCP_JOB_STORE_PATH",
      "password": true
    },
    {
      "type": "promptString",
      "id": "mcp-max-concurrent",
      "description": "MCP_MAX_CONCURRENT",
      "password": true
    },
    {
      "type": "promptString",
      "id": "mcp-config-path",
      "description": "MCP_CONFIG_PATH",
      "password": true
    }
  ],
  "servers": {
    "web-recon-agent": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "mcp-web-recon-agent"
      ],
      "env": {
        "MCP_TARGET_ALLOWLIST": "${input:mcp-target-allowlist}",
        "MCP_OWNED_TARGETS": "${input:mcp-owned-targets}",
        "MCP_JOB_STORE_PATH": "${input:mcp-job-store-path}",
        "MCP_MAX_CONCURRENT": "${input:mcp-max-concurrent}",
        "MCP_CONFIG_PATH": "${input:mcp-config-path}"
      }
    }
  }
}

VS Code prompts for each input the first time the server starts, so no secret is written to the file. VS Code docs

web recon agent in other clients

web recon agent MCP server