Travis234 Websec MCP

An optional external HTTP workbench for Travis234 and standard stdio MCP clients. Python 3.13 and macOS or Linux are required. Travis core and its existing MCP adapter supply the host integration; this package owns requests, HTTP execution, sanitization and evidence. KHackBar is a workflow reference and is not a dependency.

This milestone supports individual request experiments. Payload catalogs, generators, batch fuzzing, login/token extraction and browser capture remain future work. The package also includes imported assessment skills, built into Travis and exposed to other clients through MCP resources and prompts. These guides do not install external scanners. See the repository's complete KHackBar feature mapping.

Build, install and activate

Run these commands from the Travis234 repository root:

uv sync --project packages/travis234-websec-mcp --locked --group source-test
websec_dist_dir="$(mktemp -d "${TMPDIR:-/tmp}/websec-dist.XXXXXX")"
uv build --wheel --out-dir "$websec_dist_dir" packages/travis234-mcp-adapter
uv build --wheel --out-dir "$websec_dist_dir" packages/travis234-websec-mcp
export PIP_FIND_LINKS="$websec_dist_dir"
export UV_FIND_LINKS="$websec_dist_dir"
websec_wheel_uri="$(packages/travis234-websec-mcp/.venv/bin/python -c 'from pathlib import Path; import sys; print(next(Path(sys.argv[1]).glob("travis234_websec_mcp-*.whl")).resolve().as_uri())' "$websec_dist_dir")"
travis234 install "travis234-websec-mcp @ $websec_wheel_uri"
travis234 --tools read,bash,websec

Installation registers the package-owned server and one websec facade through the shared adapter. Discovery and status do not send a testing request. Tool selection uses the existing --tools allowlist; there is no new Travis flag.

For another MCP client, install the wheel and its dependencies into that client's Python 3.13 environment, then configure this stdio command:

travis234-websec-mcp mcp --transport stdio

The standalone server does not import the Travis extension. It uses the same configuration, request bounds and evidence format.

Imported assessment skills

The source index is htooayelwinict/awesome-ai-offensive-security. That repository contains links; the actual skills are imported from these linked MIT-licensed projects at fixed revisions:

All eight skills ship as read-only built-ins in Travis's Python and npm distributions, using its existing lazy loader, precedence and trust rules. Installing this optional package adds the Websec tools. When the user asks to use Websec MCP, its facade instructs the agent to try loading all eight SKILL.md guides before its first Websec call, like Evidence MCP's research skill. This guidance also accompanies authorized delegation. User overrides and --no-skills remain effective; unavailable guides are reported. Additional reference files load only as needed. The package does not register duplicate skill directories. A standalone installation exposes the same documents through MCP resources and prompts. No skill is copied into the user's Codex installation.

Each imported skill has a TRAVIS234.md guide describing the supported tools and request workflow. Local changes add compatible YAML metadata and a link to that guide. Upstream methodology and references are retained. Each skill keeps its upstream license; SOURCES.json records repository revisions, source paths, original hashes and shipped hashes. Imports are bundled: startup, discovery and reads do not fetch updates or run upstream code.

For a standard MCP client:

• resources/list enumerates skill documents in pages of eight. Pass its nextCursor back as cursor until it is absent.
• Read websec://skills/index for the skill index, then a skill's websec://skills/<name>/TRAVIS234.md and websec://skills/<name>/SKILL.md.
• A document larger than 4 KiB returns an ordered part index. Read the listed ?part=1, ?part=2, … URIs in order. All bytes are retained, with UTF-8 characters kept intact. Relative references resolve within the skill's URI directory. Each part is at most 4 KiB before protocol encoding. When literal code examples cannot pass the existing text classifier unchanged, the read uses a standard MCP blob with the same MIME type: Base64-decode it as UTF-8 to recover the exact text.
• prompts/list exposes eight entry prompts, named websec-<skill-name>. prompts/get takes that name and no arguments; it directs the client to the integration guide and relevant upstream resources.

Resource reads accept only bundled catalog URIs. Unknown URIs, prompts and cursors return fixed errors. The original document is checked before any part is returned, and the existing final MCP frame checks still apply. When a known credential overlaps a document, its read fails without returning that document.

The existing seven request operations retain their contracts. Browser sessions, raw protocol experiments, parallel probes and external tools mentioned in a guide require those capabilities separately. Imported methodology does not enable them in the Websec executor.

Try the actual acceptance fixture

In one terminal, start the bundled fixture. It prints its actual loopback origin:

packages/travis234-websec-mcp/.venv/bin/python packages/travis234-websec-mcp/tests/http_fixture.py

Keep it running. In a second terminal, copy that origin into WEBSEC_FIXTURE_ORIGIN, then create an isolated lab configuration:

export WEBSEC_FIXTURE_ORIGIN='http://127.0.0.1:<printed-port>'
export WEBSEC_LAB_TOKEN='synthetic-lab-token'
websec_lab_dir="$(mktemp -d "${TMPDIR:-/tmp}/websec-lab.XXXXXX")"
export TRAVIS234_CODING_AGENT_DIR="$websec_lab_dir/agent"
packages/travis234-websec-mcp/.venv/bin/python - <<'PY'
import json
import os
from pathlib import Path
from urllib.parse import urlsplit

origin = os.environ['WEBSEC_FIXTURE_ORIGIN']
assert urlsplit(origin).hostname == '127.0.0.1' and urlsplit(origin).port
path = Path(os.environ['TRAVIS234_CODING_AGENT_DIR']) / 'websec' / 'config.json'
path.parent.mkdir(parents=True, exist_ok=True)
path.write_text(json.dumps({'version': 1, 'profiles': {'lab': {
    'origins': [origin],
    'headers': {'Authorization': 'Bearer ${WEBSEC_LAB_TOKEN}'},
    'deadline_seconds': 10,
}}}))
PY

Run installation and activation in that same terminal so Travis inherits the directory override and credential reference. Stop the fixture with Ctrl-C. Normal operator configuration lives at ~/.travis234/agent/websec/config.json; the existing TRAVIS234_CODING_AGENT_DIR override changes the agent directory. The package never loads .env files. Headers accept exact $env:NAME references or ${NAME} interpolation. Missing or empty references leave offline operations available and make send return authentication_unavailable before connecting.

Request workflow

Call websec with the following operation arguments. Replace the fixture origin with its printed value and copy each returned ID exactly:

The fixture receives original, then changed, with the second query entry unchanged. Its UTF-8 response bodies have 8 and 7 bytes respectively. Reusing the original ID sends the original value again. prepare also accepts strict raw HTTP/1.1 text using raw_request and an explicit origin, instead of request. Ambiguous framing, invalid fields and unavailable IDs return specific bounded errors. Comparisons report observations rather than vulnerability verdicts.

Additional text codecs

These operations retain the 16 KiB input and 64 KiB output limits. The aggregate MCP frame limit also applies, so a valid engine result can return output_limit at the public boundary. Errors never return a successful partial transformation. Known credentials are checked in both the source value and the derived result.

Bounds, credentials and lifetime

Origins are exact normalized scheme/host/port allowlists. Every send checks its final target. The client performs one exchange, follows no redirects, retries nothing, carries no cookie jar, verifies TLS and ignores proxy environment variables. Only one send runs at a time; an overlapping send returns busy. Cancellation and shutdown close and join owned HTTP work.

Compressed responses are reported as unsupported_encoding and are not decoded. Binary and incomplete responses preserve honest byte measurements; comparison does not infer complete text equality or an exact complete-body length from them. Incomplete or oversized presentation values are withheld in full, with explicit omission flags. Complete bounded JSON can retain unrelated public fields.

Keep credentials in the operator environment and profile references. Never paste them into tool arguments: the host records those inputs before the plugin sees them. Available referenced values and bounded URL/Base64/hex forms are sanitized from returned results and exports. Authentication values go only to an allowed origin's request.

Request and response IDs belong to one server process. Shutdown, reload or eviction can invalidate them. Exports persist under <agent-directory>/websec/evidence/ as new atomic mode-0600 JSON files; the tool does not accept arbitrary export paths or overwrite prior evidence.

Restart the entire Travis process after changing profile configuration, credential references/environment or the installed package. Registrations are process-local; an existing host does not replace a different descriptor in place. Stop Travis before removing the package, then start a new process to confirm the facade is absent. Removing the package preserves exported evidence.

Qualification

PYTHONDONTWRITEBYTECODE=1 packages/travis234-websec-mcp/.venv/bin/python -m pytest -q -p no:cacheprovider packages/travis234-websec-mcp/tests

The acceptance test builds actual wheels, installs through Travis's package manager in a fresh interpreter outside the checkout, binds a real session, uses a deterministic model stream and real HTTP/MCP transports, scans persisted session JSONL, and checks A1–A13. Container qualification uses the same driver with offline wheels, a nonroot user and Docker networking disabled. A build or unit-test pass alone does not establish installed acceptance or deployment.