Purpose
mcp-recon (formerly Tellix) is a conversational reconnaissance interface and MCP server designed to bridge the gap between natural language and HTTP infrastructure analysis. It exposes reconnaissance tools through the Model Context Protocol (MCP), enabling users to perform web domain reconnaissance through any compatible AI interface (such as Claude Desktop).
Key Capabilities
- Conversational commands: Perform reconnaissance through simple text prompts.
- MCP server: Integrates with Claude Desktop or other MCP-compatible tools.
- Multiple analysis modes: Choose between lite and full reconnaissance levels.
- Standalone ASN lookup: Query IPs, ASNs, or organizations directly.
- Docker-ready: Runs in an isolated container for both security and portability.
- Powered by httpx: Leverages ProjectDiscovery's robust reconnaissance tool.
- Bug avoidance: Automatically handles httpx's stdin/stdout leakage issue.
- MCP prompts: Includes predefined prompts such as http_lite_scan and katana_command_generator to simplify operations.
Usage
mcp-recon provides three main reconnaissance tools:
- Fast/lightweight reconnaissance (http_lite_recon): Fast, lightweight HTTP fingerprinting that provides basic information with minimal overhead.
- Full reconnaissance (http_full_recon): Comprehensive metadata collection, including page previews, headers, certificates, and technology detection.
- ASN lookup (asn_lookup): Independently query IPs, ASNs, or organization names using ProjectDiscovery's asnmap library.
mcp-recon is designed to run as a Docker container, used with Claude Desktop through the MCP protocol. It runs as a standalone MCP server, can be added to the MCP configuration, and is configured using a .env file.
MCP prompts are predefined templates that guide the AI assistant to perform specific tasks. Prompts can accept dynamic parameters, include context from resources, and chainmultiple interactions, thereby enabling structured and efficient workflows. mcp-recon includes the following prompts:
- http_lite_scan: Launches a quick HTTP scan to obtain basic information about a specified target.
- katana_command_generator: Generates an optimized Katana crawl command based on the reconnaissance target and the desired level of thoroughness.
Applicable Scenarios
Suitable for security researchers, penetration testers, or developers to quickly conduct reconnaissance through natural language on domains they own or are authorized to test, such as obtaining status codes, titles, server details, IP addresses, TLS configuration, headers, CDN, and security observations.
Limitations and Considerations
- Only scan domains you own or are authorized to test.
- full_recon mode retrieves full page content; use it with caution.
- Consider rate limits to avoid impacting the target system.
- If no results are returned, check whether the domain is publicly accessible, whether the correct tool was specified, and whether the target domain is blocking scans.
- Performance issues: It is recommended to start with http_lite_recon for faster results and to reduce the number of domains per scan.
- httpx stdin leakage: The httpx library attempts to read stdin even when used as a library; mcp-recon prevents interference with MCP by shielding os.Stdin.
- ASN silent failure: Even with Asn = true, httpx may fail to enrich IPs; mcp-recon includes a fallback using the official asnmap Go library.
This project is licensed under the MIT License, was formerly named Tellix, and has been renamed to mcp-recon to better align with the MCP naming conventions used in security tools.
