🔒 Nikto MCP Server

A secure MCP (Model Context Protocol) server that enables AI agents to interact with Nikto web server scanner for comprehensive web security scanning.

📋 Table of Contents

• ✨ Key Features
• ⚡ Quick Start
• 🚀 Prerequisites & Installation
• 🔧 Configuration
• 🛠️ Available Tools
• 🔒 Security Features
• 💡 Example Usage
• 🤝 Contributing
• License

✨ Key Features

• ✅ 100% TypeScript – fully typed, production-ready
• 📊 Multiple output formats – JSON (machine-readable) and rich CLI (human-readable)
• 🌐 Optional REST API for remote scan management
• 🛡️ Secure by default – sandboxed execution, sensible timeouts, and minimal privileges
• 🐳 Docker support with proper volume mounting and JSON output handling

⚡ Quick Start

# Install and run with MCP Inspector
npx @modelcontextprotocol/inspector nikto-mcp@latest

🚀 Prerequisites & Installation

Requirements:

• Node.js 20 or newer
• Nikto Scanner - Install and ensure it's accessible in your PATH
• MCP Client - VS Code, Cursor, Windsurf, Claude Desktop, Goose or any other MCP client

Basic Configuration:

{
  "mcpServers": {
    "niktomcp": {
      "command": "npx",
      "args": [
        "nikto-mcp@latest"
      ]
    }
  }
}

Install Nikto:

# macOS
brew install nikto

# Ubuntu/Debian  
sudo apt-get install nikto

# Or from source
git clone https://github.com/sullo/nikto

# For VS Code
code --add-mcp '{"name":"niktomcp","command":"npx","args":["nikto-mcp@latest"]}'

After installation, the Nikto MCP server will be available for use with your GitHub Copilot agent in VS Code.

{
  "mcpServers": {
    "niktomcp": {
      "command": "npx",
      "args": [
        "nikto-mcp@latest"
      ]
    }
  }
}

Follow Windsurf MCP documentation. Use following configuration:

{
  "mcpServers": {
    "niktomcp": {
      "command": "npx",
      "args": [
        "nikto-mcp@latest"
      ]
    }
  }
}

Follow the MCP install guide, use following configuration:

{
  "mcpServers": {
    "niktomcp": {
      "command": "npx",
      "args": [
        "nikto-mcp@latest"
      ]
    }
  }
}

Use the Claude Code CLI to add the Nikto MCP server:

claude mcp add nikto-mcp npx nikto-mcp

Open Qodo Gen chat panel in VSCode or IntelliJ → Connect more tools → + Add new MCP → Paste the following configuration:

{
  "mcpServers": {
    "niktomcp": {
      "command": "npx",
      "args": [
        "nikto-mcp@latest"
      ]
    }
  }
}

Click Save.

Follow the MCP install guide, use following configuration:

{
  "mcpServers": {
    "niktomcp": {
      "command": "npx",
      "args": [
        "nikto-mcp@latest"
      ]
    }
  }
}

🔧 Configuration

MCP Inspector (Development)

# Install and run with MCP Inspector
npx @modelcontextprotocol/inspector nikto-mcp@latest

MCP Client Configuration

Add to your MCP client configuration:

{
  "mcpServers": {
    "nikto": {
      "command": "node",
      "args": ["/absolute/path/to/nikto-mcp/index.js"],
      "env": {
        "NIKTO_BINARY": "/usr/local/bin/nikto",
        "LOG_LEVEL": "info"
      }
    }
  }
}

Testing with MCP Inspector (Dev)

# Install MCP Inspector
npm install -g @modelcontextprotocol/inspector

# Test the server
npx @modelcontextprotocol/inspector node index.js

Environment Variables

• NIKTO_MODE - Execution mode: local or docker (default: local)
• NIKTO_DOCKER_IMAGE - Docker image to use (default: ghcr.io/sullo/nikto:latest)
• NIKTO_DOCKER_NETWORK - Docker network mode (default: host)
• NIKTO_BINARY - Path to Nikto executable for local mode (default: nikto)
• LOG_LEVEL - Logging level: debug, info, warn, error (default: info)
• MCP_STDOUT_LOGS - Allow info/debug logs to stdout: allow or unset (default: discarded for MCP compatibility)
• SCAN_TIMEOUT - Maximum scan duration in seconds (default: 3600)
• MAX_CONCURRENT_SCANS - Maximum concurrent scans (default: 3)

Note: JSON output automatically uses unique filenames per scan (/tmp/nikto-scan-<uuid>.json) to prevent concurrent scan collisions.

🐳 Docker Support

The MCP server supports running Nikto via Docker for better isolation and consistency.

Docker Mode Configuration

{
  "mcpServers": {
    "nikto": {
      "command": "node",
      "args": ["/absolute/path/to/nikto-mcp/index.js"],
      "env": {
        "NIKTO_MODE": "docker",
        "NIKTO_DOCKER_IMAGE": "ghcr.io/sullo/nikto:latest",
        "NIKTO_DOCKER_NETWORK": "host",
        "LOG_LEVEL": "info"
      }
    }
  }
}

Building and Running with Docker

# Build the MCP server with embedded Nikto
docker build -t nikto-mcp .

# Run the containerized MCP server
docker run --rm -i nikto-mcp

# Run with custom configuration
docker run --rm -i \
  -e NIKTO_MODE=local \
  -e LOG_LEVEL=debug \
  nikto-mcp

🛠️ Available Tools

scan - Run Nikto Security Scan

The enhanced scan tool supports comprehensive Nikto command-line options for flexible web security scanning.

Basic Usage

{
  "target": "https://example.com"
}

Advanced Options

{
  "target": "https://example.com",
  "port": 8443,
  "ssl": true,
  "nolookup": true,
  "vhost": "internal.example.com",
  "timeout": 1800,
  "outputFormat": "json",
  "dryRun": false
}

Supported Parameters

| Parameter | Type | Required | Default | Description | |-----------|------|----------|---------|-------------| | target | string | ✅ | - | Target URL, IP address, or hostname | | port | number | ❌ | 80 | Port number (1-65535) | | ssl | boolean | ❌ | false | Force SSL/HTTPS mode | | nossl | boolean | ❌ | false | Disable SSL (mutually exclusive with ssl) | | nolookup | boolean | ❌ | false | Disable DNS lookups | | timeout | number | ❌ | 3600 | Request timeout in seconds | | vhost | string | ❌ | - | Virtual host for Host header | | outputFormat | enum | ❌ | "json" | Output format: "json" or "text" | | dryRun | boolean | ❌ | false | Test command generation without execution |

Example Commands Generated

• Basic: nikto -h https://example.com -timeout 3600 -nointeractive
• Advanced: nikto -h example.com -p 8443 -ssl -nolookup -vhost internal.example.com -timeout 1800 -Format json -nointeractive

scan_status - Check Scan Status

Get the current status and results of a running scan.

{
  "scanId": "uuid-of-scan"
}

stop_scan - Stop Running Scan

Terminate a currently running scan.

{
  "scanId": "uuid-of-scan"
}

🔒 Security Features

• 🛡️ Input sanitization to prevent command injection
• ✅ Comprehensive validation of targets, ports, and hostnames
• 🔐 Sandboxed execution with configurable timeouts and concurrent limits
• ⚠️ Safe defaults and conflict prevention between options

💡 Example Usage

See examples/scan-demo.js for comprehensive examples of all supported options and use cases:

node examples/scan-demo.js

🤝 Contributing

1. Fork the repository
2. Create your feature branch (git checkout -b feature/awesome)
3. Commit your changes (git commit -am 'Add some feature')
4. Push to the branch (git push origin feature/awesome)
5. Open a Pull Request

Bug reports and feature requests are welcome via GitHub Issues.

📄 License

This project is licensed under the GNU General Public License v3.0.

Commercial licenses are available for organizations that wish to use this software under different terms. For more information, please contact: weldpua2008