iflow-mcp_zilbonn-owasp-wstg-rag

# OWASP WSTG RAG A Retrieval-Augmented Generation (RAG) system that indexes the **OWASP Web Security Testing Guide (WSTG)** into a vector database, providing instant access to security testing methodologies via REST API and MCP (Model Context Protocol) for Claude Code integration. ## Features - **Complete WSTG Coverage** - All 12 WSTG testing categories indexed and searchable - **Semantic Search** - Find relevant testing methodologies using natural language queries - **MCP Integration** - Direct integration with Claude Code for AI-assisted penetration testing - **REST API** - HTTP endpoints for programmatic access - **WSTG ID Lookup** - Retrieve complete test cases by WSTG identifier (e.g., `WSTG-INPV-05`) ## WSTG Categories | Category | WSTG ID | Description | |----------|---------|-------------| | Information Gathering | WSTG-INFO | Fingerprinting, enumeration, mapping | | Configuration | WSTG-CONF | Server/platform configuration testing | | Identity Management | WSTG-IDNT | User registration, account provisioning | | Authentication | WSTG-ATHN | Login, password policy, MFA testing | | Authorization | WSTG-ATHZ | Privilege escalation, IDOR, access control | | Session Management | WSTG-SESS | Session tokens, cookies, fixation | | Input Validation | WSTG-INPV | SQLi, XSS, command injection, SSTI | | Error Handling | WSTG-ERRH | Error messages, stack traces | | Cryptography | WSTG-CRYP | TLS, encryption, hashing | | Business Logic | WSTG-BUSL | Workflow bypass, file upload | | Client-Side | WSTG-CLNT | DOM XSS, clickjacking, WebSockets | | API Testing | WSTG-APIT | REST, GraphQL, API security | ## Quick Start ### 1. Install Dependencies ```bash cd RAG_runner pip install -r requirements.txt ``` ### 2. Build the Database ```bash python3 build_database.py ``` This will: - Parse all OWASP WSTG HTML files - Create semantic chunks for retrieval - Build the ChromaDB vector database ### 3. Start the Server ```bash python3 -m server.http_server ``` Server runs …