MCP Server Pentest

自動化瀏覽器滲透測試，用於偵測XSS與SQL漏洞。

GitHub
22

你可以用 MCP Server Pentest 做什麼？

Automate browser-based vulnerability detection and interaction through your AI assistant.

  • Scan for reflected XSS — Test a URL parameter for reflected cross-site scripting using broser_url_reflected_xss.
  • Check for SQL injection — Probe a URL parameter for SQL injection flaws with browser_url_sql_injection.
  • Navigate and interact — Open pages, click elements, fill forms, and hover using browser_navigate, browser_click, browser_fill, etc.
  • Capture screenshots — Take full-page or element-specific screenshots via browser_screenshot.
  • Execute JavaScript in the browser — Run arbitrary scripts in the page context with browser_evaluate.

文件

MCP Server Pentest

Features

  • Full browser xss, sql vulnerability automatic detection
  • Screenshots of the entire page or specific elements
  • Comprehensive network interaction (navigation, clicks, form filling)
  • Console log monitoring
  • JavaScript execution in the browser context

Installation

Installing

npx playwright install firefox
yarn install 
npm run build

Configuration

The installation process will automatically add the following configuration to your Claude config file:

{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": [
        "-y",
        "/Users/...../dist/index.js"
      ],
      "disabled": false,
      "autoApprove": []
    }
  }
}

Components

Tools

broser_url_reflected_xss

Test whether the URL has an XSS vulnerability

{
  "url": "https://test.com",
  "paramName":"text"
}

browser_url_sql_injection

Test whether the URL has SQL injection vulnerabilities

{
  "url": "https://test.com",
  "paramName":"text"
}

browser_navigate

Navigate to any URL in the browser

{
  "url": "https://stealthbrowser.cloud"
}

browser_screenshot

Capture screenshots of the entire page or specific elements

{
  "name": "screenshot-name",     // required
  "selector": "#element-id",     // optional
  "fullPage": true              // optional, default: false
}

browser_click

Click elements on the page using CSS selector

{
  "selector": "#button-id"
}

browser_click_text

Click elements on the page by their text content

{
  "text": "Click me"
}

browser_hover

Hover over elements on the page using CSS selector

{
  "selector": "#menu-item"
}

browser_hover_text

Hover over elements on the page by their text content

{
  "text": "Hover me"
}

browser_fill

Fill out input fields

{
  "selector": "#input-field",
  "value": "Hello World"
}

browser_select

Select an option in a SELECT element using CSS selector

{
  "selector": "#dropdown",
  "value": "option-value"
}

browser_select_text

Select an option in a SELECT element by its text content

{
  "text": "Choose me",
  "value": "option-value"
}

browser_evaluate

Execute JavaScript in the browser console

{
  "script": "document.title"
}