通过Burp Suite / ZAP拦截和代理MCP服务器流量

---

这是什么？

Appsecco MCP 客户端和代理 是一个安全测试工具，允许你使用如 **Burp Suite 或 ZAP 这样的拦截代理拦截、检查和修改模型上下文协议（MCP）流量。

它作为一个通用MCP客户端，可以连接到任何MCP服务器——无论是本地还是远程——并将所有流量通过你选择的代理进行安全分析。

主要特色

• Burp Suite / ZAP 集成 — 将所有 MCP 流量路由至你的拦截代理
• 多连接模式 — 本地标准服务器，通过mcp-remote远程，或直接HTTP/SSE端点
• 全流量可视化 — 截获本地中继流量和后端HTTPS流量
• OAuth 2.1 支持 — 自动符合 MCP 规范的 OAuth 流，支持 PKCE
• 静态头部认证 — API 密钥、承载令牌、自定义头部
• HTTP/2 支持 — 直接远程连接使用 HTTP/2 的 httpx
• 代理链集成 — 通过Burp路由子进程流量
• 会话日志 — 所有CLI输出都被记录为带时间戳的日志文件，供后续查看

Appsecco MCP Client and Proxy

Intercept and Proxy MCP Server Traffic Through Burp Suite / ZAP

---

What is this?

The Appsecco MCP Client and Proxy is a security testing tool that lets you intercept, inspect, and modify Model Context Protocol (MCP) traffic using interception proxies like Burp Suite or ZAP.

It acts as a universal MCP client that can connect to any MCP server — local or remote — and route all traffic through your proxy of choice for security analysis.

Key Features

• Burp Suite / ZAP Integration — Route all MCP traffic through your interception proxy
• Multiple Connection Modes — Local stdio servers, remote via mcp-remote, or direct HTTP/SSE endpoints
• Full Traffic Visibility — Intercept both local relay traffic AND backend HTTPS traffic
• OAuth 2.1 Support — Automatic MCP-spec-compliant OAuth flow with PKCE
• Static Header Auth — API keys, Bearer tokens, custom headers
• HTTP/2 Support — Direct remote connections use httpx with HTTP/2
• Proxychains Integration — Route subprocess traffic through Burp
• Session Logging — All CLI output is tee’d to a timestamped log file for later review
• Interactive CLI — Select servers, list tools, call tools with arguments

---

Installation

Prerequisites

• Python 3.7+
• Node.js 18+ and npm (for npx-based MCP servers)
• Proxychains (optional, for routing subprocess traffic)
• Burp Suite or ZAP (for traffic interception)

Setup

# Clone the repository
git clone https://github.com/appsecco/mcp-client-and-proxy.git
cd mcp-client-and-proxy

# Create and activate virtual environment
python3 -m venv venv && source venv/bin/activate

# Install Python dependencies
pip3 install -r requirements.txt

# Install Node.js dependencies (for backend traffic interception)
npm install -g global-agent
npm install undici

Install Proxychains (optional)

• macOS: brew install proxychains-ng
• Ubuntu/Debian: sudo apt-get install proxychains
• CentOS/RHEL: sudo yum install proxychains

---

Quick Start

1. Configure your MCP servers

Create or edit mcp_config.json:

{
  "mcpServers": {
    "my-remote-mcp": {
      "url": "https://remote.example.com/mcp"
    }
  }
}

2. Start Burp Suite

Launch Burp Suite listening on 127.0.0.1:8080 (the default).

3. Run the tool

# For remote MCP servers (direct-remote mode)
python3 app.py

# For local stdio / mcp-remote servers (starts local proxy on port 3000)
python3 app.py --start-proxy

4. Interact