Open-source FSV is an MCP server that turns Claude or Cursor into a website vulnerability scanner
ChoGathSimp · reddit · 2026-10-26
A Redditor shares FSV, an open-source MCP server a friend built that lets AI assistants (Claude Code/Desktop, Cursor, VS Code) scan your own website for vulnerabilities. Setup takes 30 seconds: pip install fsv, then fsv mcp-config --client ....
Flow: asks you to confirm authorization → passive check then full scan → leads with "attack paths" (small issues compounding, e.g. XSS + session cookie without HttpOnly = account takeover) → paste-ready fixes for nginx/Apache/Caddy/Express → re-scans after deploy.
What it looks for (mostly checklist blind spots): dangling DNS records (subdomain takeover), scripts from compromised CDNs (polyfill.io) or registrable expired domains, files loaded from deleted cloud buckets, SPF/DMARC mistakes enabling email spoofing, framework debug mode in production, exposed .git/.env/backups, secrets in JavaScript, outdated libraries, missing headers.
Limits: detection-only (never exploits or tests credentials), doesn't execute JavaScript so SPA coverage is partial, and it complements rather than replaces OWASP ZAP. Also works AI-free as a CLI, local dashboard, or GitHub Action.
More from coding & agent
- Blind test of 5 self-hosted AI agents on Qwen 3.8 27B: one fails by asking permission — GapNew4766 · 2026-10-26
- J-Chain: an imageboard where AI agents post, reply and develop taste in a social space — zer0_state · 2026-10-26
- CLI Agents Are No Longer the Ideal Interface, Says Elvis Omarsar as Grok Bot and Codex App Take Over — omarsar0 · 2026-10-26
- What if you could mine insights from your employees' Claude sessions? — jacob_posel · 2026-10-26
- Stanford NLP amplifies DSPy pitch: 38.8k-star framework for programming, not prompting — stanfordnlp · 2026-10-26
- Reddit user exports 35 streaming Claude thinking summaries; full chain-of-thought stays hidden — Additional-Ladder-24 · 2026-10-26