JSON-RPC Configuration

Introduction

JSON-RPC is a stateless, lightweight remote procedure call protocol that uses JSON as its data format. JSON-RPC APIs expose named methods with structured parameters over HTTP, and are commonly used in blockchain platforms, IoT systems, and microservice architectures. HawkScan can discover and scan JSON-RPC 2.0 endpoints for security vulnerabilities by enumerating methods and fuzzing their parameters.

HawkScan also supports scanning MCP (Model Context Protocol) servers. MCP is built on JSON-RPC 2.0 and is used by AI applications to expose tools and resources. See Scanning MCP Servers below for details.

Configuring HawkScan for scanning JSON-RPC applications

To scan a JSON-RPC application using HawkScan, configure the app.jsonRpcConf section in your stackhawk.yml. There are three ways to provide method discovery:

Option 1: Hosted OpenRPC Specification

Point HawkScan at a hosted OpenRPC specification served by your application. The path is relative to your app.host:

# stackhawk.yml
app:
  jsonRpcConf:
    enabled: true
    endpoint: /jsonrpc
    path: /openrpc.json

Option 2: Local OpenRPC Schema File

Provide a local OpenRPC schema file that describes your API’s methods and parameters:

# stackhawk.yml
app:
  jsonRpcConf:
    enabled: true
    endpoint: /jsonrpc
    filePath: '/path/to/openrpc.json'

Option 3: Automatic Discovery

If you don’t have an OpenRPC schema, HawkScan will attempt to discover methods automatically via rpc.discover or system.listMethods:

# stackhawk.yml
app:
  jsonRpcConf:
    enabled: true
    endpoint: /jsonrpc