Nikto MCP Server for AI Scanner Integration

Overview

This project implements an MCP (Model Context Protocol) server that exposes Nikto web-scanning as a programmable tool for AI agents and automation pipelines. By running a centralized MCP server you can give AI agents (or orchestration systems) a consistent, secure interface to launch Nikto scans, collect results in structured formats, and manage scan artifacts — without giving agents direct access to raw system processes or networked scanners.

The server is useful for teams that want to integrate vulnerability discovery into automated workflows (CI/CD, triage agents, red-team tooling) while retaining central control over scan policies, resource limits, authentication, and logging. It supports running Nikto either via a local Node environment (npx) or through Docker containers, making deployment flexible to fit different infrastructure and security postures.

Features

• Exposes Nikto as an MCP-compatible tool that agents can discover and invoke
• Supports backend execution via npx (local Node) or Docker container
• Returns scan output in JSON and raw report formats for downstream processing
• Configurable resource and timeout limits to reduce blast radius
• API key / token-based access control with optional TLS support
• Scan artifact storage and retrieval (logs, reports)
• Simple manifest endpoint so agents can auto-discover available tools and invocation schema

Installation / Configuration

The server can be deployed locally for development or in a container for production. Below are two common approaches.

Clone the repository:

git clone https://github.com/weldpua2008/nikto-mcp.git
cd nikto-mcp

Run locally (Node / npx)

# install deps and run (development)
npm install
# start with environment variables
MCP_PORT=3000 MCP_API_KEY=changeme npm start

Run via Docker (recommended for production isolation)

# build from repository
docker build -t nikto-mcp .

# run with basic environment configuration
docker run -d \
  -p 3000:3000 \
  -e MCP_API_KEY=changeme \
  -e NIKTO_BACKEND=docker \
  --name nikto-mcp \
  nikto-mcp

Example environment variables

Notes

• Enable TLS by placing a reverse proxy (nginx/Caddy) in front of the container or configure the server to use certs if provided.
• Use firewall/network policies to restrict scanning targets or isolate the scanning subnet.

Available Resources

The server implements the typical MCP-style discovery and invocation pattern so AI agents can integrate programmatically.

• Manifest endpoint (tool discovery)
  • GET /mcp/manifest — returns the list of tools, schemas, and accepted arguments
• Invocation endpoint (run a scan)
  • POST /mcp/invoke — request body includes tool name (e.g., “nikto”) and args
• Artifacts / logs
  • GET /artifacts/:id — fetch saved scan reports (JSON, HTML, txt)
• Health & metrics
  • GET /health — basic liveness/checks
  • GET /metrics — optional Prometheus metrics export

Example invocation payload (illustrative)

{
  "api_key": "changeme",
  "tool": "nikto",
  "args": ["-host", "https://example.com", "-output", "json"],
  "options": { "timeout": 300 }
}

Example response (illustrative)

{
  "status": "queued",
  "scan_id": "scan-20260410-01",
  "artifact_url