WebSec Auditor

Passive Security, Risk & Exposure Assessment Tool connected to Claude Desktop via MCP.

WebSec Auditor helps identify security, compliance, and exposure risks across public-facing websites without performing intrusive testing or modifying target systems.

Live Dashboard: https://sheiscypher.github.io/websec-search-auditor

---

Overview

WebSec Auditor performs passive assessments of websites and provides:

• Security & Exposure Score (0–100)
• Risk prioritisation
• Business impact analysis
• Technical evidence
• Remediation recommendations
• HTML audit report

Main command:

audit https://example.com

---

Assessment Domains

Domain	Controls
Security	HTTP Security Headers, TLS Configuration, Exposed Files, CMS Detection, Public CVEs
Email Security	SPF, DKIM, DMARC
DNS Security	DNSSEC, CAA
Privacy & Compliance	GDPR/RGPD Indicators, CMP Detection, Trackers, Legal Pages
Supply Chain	JavaScript Libraries, CDN Dependencies, Subresource Integrity (SRI)
Accessibility	WCAG and RGAA Indicators
AI Exposure	llms.txt, AI Crawlers, MCP Endpoint Exposure
Search Visibility	Technical SEO, Metadata, Structured Data, E-E-A-T Signals
Secrets Exposure	API Keys, JWT Tokens, Sensitive Public Files
AI-Assisted Development Risk	Signals of AI-generated or AI-assisted code lacking security review

---

Features

• Passive and non-intrusive assessment
• Business-oriented reporting
• Security and compliance visibility
• Exposure and attack-surface analysis
• Risk-based prioritisation
• Automated HTML reporting
• MCP integration for Claude Desktop

---

Score Model

WebSec Auditor computes a Security & Exposure Score (0–100) composed of four pillars:

Pillar	Weight	Question answered
Security	40%	What is the technical attack surface?
Trust & Compliance	25%	Is the site credible and compliant?
Visibility	20%	Is the site findable by search engines and AI agents?
AI Governance	15%	Are AI usages controlled or generating new risks?

---

Installation

Clone the Repository

git clone https://github.com/sheiscypher/websec-search-auditor.git
cd websec-search-auditor

Install Dependencies

pip install -r requirements.txt

Configure Environment

cp .env.example .env

Populate environment variables as required.

---

Claude Desktop Configuration

Add the following MCP server configuration to your Claude Desktop configuration file:

{
  "mcpServers": {
    "websec-auditor": {
      "command": "python",
      "args": [
        "/absolute/path/to/websec-search-auditor/server.py"
      ],
      "env": {}
    }
  }
}

Configuration file location — macOS:

~/Library/Application Support/Claude/claude_desktop_config.json

Restart Claude Desktop after configuration changes.

---

Deployment

Backend (Render)

1. Create a new Web Service on Render.
2. Connect this repository.
3. Render automatically detects render.yaml.
4. Configure required environment variables:

JWT_SECRET    — required, generate with: python -c "import secrets; print(secrets.token_hex(32))"
API_KEY       — optional, protects the /token endpoint
NVD_API_KEY   — optional, enables enhanced CVE enrichment

Dashboard (GitHub Pages)

1. Navigate to Settings → Pages.
2. Select GitHub Actions as deployment source.
3. Configure VITE_API_URL under Settings → Environments → github-pages:

https://your-backend.onrender.com/audit

Deployments are automatically triggered on pushes to main.

---

Security Model

WebSec Auditor is designed around passive assessment principles and Security By Design.

Included Controls

• SSRF protection
• URL validation and sanitisation
• Indirect prompt injection mitigation
• Rate limiting on public endpoints (10 req/min per IP)
• Passive-only data collection
• No exploitation or active scanning

Scope

WebSec Auditor identifies exposure and configuration weaknesses, evaluates publicly accessible information, and provides remediation guidance.

WebSec Auditor does not exploit vulnerabilities, modify target systems, perform intrusive testing, or conduct denial-of-service activities.

---

Report Outputs

Generated reports include:

• Executive Summary
• Security & Exposure Score
• Critical Findings
• Risk Classification
• Business Impact Assessment
• Technical Evidence
• Remediation Roadmap

Reports are generated on every audit, including when portions of a target website cannot be assessed due to bot protection, rate limiting, or restricted access. Any unavailable checks are explicitly documented.

---

Documentation

• SPEC.md — Full product specification
• CONTRIBUTING.md — Contribution guidelines

---

License

Licensed under the AGPL v3. See SPEC-LICENSE for details.