** Burp Suite / ZAP를 통한 Intercept 및 프록시 MCP 서버 트래픽 **

---

이것은 무엇입니까?

Appsecco MCP Client 및 Proxy는 Burp Suite 또는 ZAP와 같은 인터ception 프록시를 사용하여 Model Context Protocol (MCP) 트래픽을 인터셉트, 검사 및 수정할 수 있는 보안 테스트 도구입니다.

그것은 어떤 MCP 서버에 연결할 수있는 범용 MCP 클라이언트로 작동 - 로컬 또는 원격 - 보안 분석을위한 선택의 프록시를 통해 모든 트래픽을 경로.

키 기능

• **Burp Suite / ZAP 통합 ** - 모든 MCP 트래픽을 교차 프록시를 통해 경로
• **멀티 커넥션 모드 ** - 로컬 stdio 서버, 원격을 통해 mcp-remote, 또는 직접 HTTP/SSE 엔드포인트 -Full Traffic Visibility - 로컬 릴레이 트래픽과 HTTPS 트래픽을 중단
• OAuth 2.1 지원 - PKCE와 자동 MCP-spec-compliant OAuth 흐름
• **Static Header Auth ** - API 키, Bearer 토큰, 사용자 정의 헤더
• HTTP/2 지원 — HTTP/2를 가진 직접적인 연결 사용 HTTPx
• **Proxychains 통합 ** - Burp를 통한 루트 하위 처리 트래픽
• Session Logging - 모든 CLI 출력은 나중에 검토에 대한 타임스탬프 된 로그 파일에 표시됩니다

Appsecco MCP Client and Proxy

Intercept and Proxy MCP Server Traffic Through Burp Suite / ZAP

---

What is this?

The Appsecco MCP Client and Proxy is a security testing tool that lets you intercept, inspect, and modify Model Context Protocol (MCP) traffic using interception proxies like Burp Suite or ZAP.

It acts as a universal MCP client that can connect to any MCP server — local or remote — and route all traffic through your proxy of choice for security analysis.

Key Features

• Burp Suite / ZAP Integration — Route all MCP traffic through your interception proxy
• Multiple Connection Modes — Local stdio servers, remote via mcp-remote, or direct HTTP/SSE endpoints
• Full Traffic Visibility — Intercept both local relay traffic AND backend HTTPS traffic
• OAuth 2.1 Support — Automatic MCP-spec-compliant OAuth flow with PKCE
• Static Header Auth — API keys, Bearer tokens, custom headers
• HTTP/2 Support — Direct remote connections use httpx with HTTP/2
• Proxychains Integration — Route subprocess traffic through Burp
• Session Logging — All CLI output is tee’d to a timestamped log file for later review
• Interactive CLI — Select servers, list tools, call tools with arguments

---

Installation

Prerequisites

• Python 3.7+
• Node.js 18+ and npm (for npx-based MCP servers)
• Proxychains (optional, for routing subprocess traffic)
• Burp Suite or ZAP (for traffic interception)

Setup

# Clone the repository
git clone https://github.com/appsecco/mcp-client-and-proxy.git
cd mcp-client-and-proxy

# Create and activate virtual environment
python3 -m venv venv && source venv/bin/activate

# Install Python dependencies
pip3 install -r requirements.txt

# Install Node.js dependencies (for backend traffic interception)
npm install -g global-agent
npm install undici

Install Proxychains (optional)

• macOS: brew install proxychains-ng
• Ubuntu/Debian: sudo apt-get install proxychains
• CentOS/RHEL: sudo yum install proxychains

---

Quick Start

1. Configure your MCP servers

Create or edit mcp_config.json:

{
  "mcpServers": {
    "my-remote-mcp": {
      "url": "https://remote.example.com/mcp"
    }
  }
}

2. Start Burp Suite

Launch Burp Suite listening on 127.0.0.1:8080 (the default).

3. Run the tool

# For remote MCP servers (direct-remote mode)
python3 app.py

# For local stdio / mcp-remote servers (starts local proxy on port 3000)
python3 app.py --start-proxy

4. Interact