go-appsec/toolbox

go install github.com/go-appsec/toolbox/sectool@latest
Or download the binary for your platform from the latest release

Usage

• •sectool mcp to start MCP server on port 9119 with proxy on 8080
• •Point browser proxy settings at 127.0.0.1:8080 and install CA cert from ~/.sectool/ca.pem for HTTPS
• •claude mcp add --transport http sectool http://127.0.0.1:9119/mcp
• •CLI shares state with the agent: sectool proxy summary, crawl create, replay send, oast create, diff, reflected, jwt

Key features

• ✓Wire-fidelity MITM proxy (HTTP/1.1, HTTP/2, WebSocket) or optional Burp integration
• ✓Replay and mutation with match/replace rules and agent-optimized API
• ✓Flow diffing (JSON path-level, unified text, binary size)
• ✓JS surface analysis to extract endpoints/routes/secrets
• ✓Reflection detection and OAST via Interactsh with 307 redirect probing
• ✓Crawling, encoding utilities, JWT inspection
• ✓Workflow modes (explore, test-report, multi) and notes tools
• ✓Custom/binary protocol support via sidecar adapter (JSON-RPC 2.0)

Best for

Security professionals pairing human UI/auth handling with an agent for collaborative application testing

Caveats

• ⚠Requires installing the CA certificate for HTTPS interception
• ⚠For authorized security testing only
• ⚠Notes tools disabled by default to save context