{"repo":"go-appsec/toolbox","free":true,"listed":false,"github":"https://github.com/go-appsec/toolbox","clone":"git clone https://github.com/go-appsec/toolbox.git","description":"Collaborative application security testing between humans and agents via CLI and MCP","language":"Go","stars":40,"topics":["agent-collaboration","security","security-testing","security-tools","mcp","agent","llm","application-security","appsec","model-context-protocol"],"license":"MIT","category":"mcp-servers","readme_excerpt":"-Significant%20AI%2C%20fully%20reviewed-1f77b4) MCP-based application security testing tools for your coding agent. Not a scanner — a collaborative workbench. Agents struggle with UI and stateful APIs; you're good at both. Sectool lets you explore an application through its proxy while an agent analyzes and manipulates the same authenticated traffic you generate. You handle auth and UI interactions, the agent queries flows, mutates requests, finds reflections, monitors out-of-band interactions, and attempts other permutations. Combining your abilities makes routine tasks easier, hidden indicators less likely to be missed, and complex testing more thorough. Getting Started 1. Install sectool No Go? Download the binary for your platform (Linux, macOS, Windows — amd64 and arm64) from the latest release. 2. Start the MCP (Model Context Protocol) server This starts an MCP server on port 9119 with a built-in HTTP proxy on port 8080. 3. Configure your browser Point your browser's proxy settings at 127.0.0.1:8080 (or the port specified with --proxy-port ). For HTTPS interception, install the CA certificate from /.sectool/ca.pem (auto-generated on first run). Most browsers accept it through their certificate settings; on macOS you can also add it to the system keychain. Using Burp? Follow Burp's proxy configuration instead, then start sectool with sectool mcp --burp . 4. Connect your agent Claude Code: Codex ( /.codex/config.toml ): 5. Collaborate Work with the agent to build a test p","default_branch":null,"files":null,"tree":[],"storefront":"/r/go-appsec","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/go-appsec/toolbox/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}