Static source inference · medium confidence · detected: Logging
Deprecated protocol patterns detected
Summary
This server has 4 tools with substantial parameter definitions visible in the source. However, critical gaps emerge across naming, descriptions, and output schemas. Tool names (sqlmap_scan, get_scan_status, get_ai_providers, get_rag_memory) follow verb_noun convention reasonably well, but descriptions are minimal and lack the depth required for LLM decision-making. Most critically: NO OUTPUT SCHEMAS are documented anywhere in the visible code. The sqlmap_scan tool accepts 12 parameters with types and some descriptions, but parameter descriptions are terse (often 1-3 words) and lack actionable guidance. Error handling is present but minimal, most tools simply return dict/JSON without categorizing errors as retryable, user-fixable, or fatal. Security is a concern: the 'ai_provider' parameter names an AI provider but keys like 'openai', 'claude' are checked against environment variables without explicit secret-injection pattern documentation. The tool that runs SQLMap (a security scanner) lacks critical safety guardrails: no dry-run mode, no confirmation for scans, and the targetlist parameter accepts file paths with only basic validation (ROOT boundary check), vulnerable to symlink attacks or misconfiguration. Overall, the server reads like a prototype with functional parameter handling but insufficient polish for production agent use.
No output schemas documented for any tool. LLMs cannot predict what fields to expect or plan downstream tool calls. For sqlmap_scan, the return type is 'dict' with no structure guidance. get_scan_status returns logs but format is unstated. get_ai_providers and get_rag_memory return types are completely undocumented.
Parameter descriptions are too brief and lack actionable detail. Examples: 'Target URL to scan' (9 chars), 'HTTP method (GET, POST, etc.)' (30 chars), 'Use Tor network' (15 chars). Most descriptions violate the 10 - 1024 character guidance and fail to explain WHEN or WHY an LLM should set each parameter.
Mutually exclusive parameters are undocumented. sqlmap_scan accepts both 'url' and 'targetlist' but code comment says 'Target : url OR targetlist'. The description does not warn the LLM to pass only one. LLMs will try both, causing confusion.
Recommendations
Document the output schema for each tool. For sqlmap_scan, specify: {ok: bool, scan_id?: str, error?: str, details?: {targets_scanned: int, vulnerabilities_found: int, ...}}. For get_scan_status, specify: {scan_id: str, status: 'running'|'idle'|'completed', progress: float (0-1), logs: [{timestamp, level, message}], ...}. For get_ai_providers, specify: {providers: [{name: str, available: bool, model?: str}, ...]}. For get_rag_memory, specify: {results: [{source: str, relevance: float, text: str}, ...], total_hits: int}.
Expand parameter descriptions to 50 - 150 characters and include actionable guidance. Examples: 'Target URL (http/https, including scheme, e.g. https://example.com). Use this OR targetlist, not both.' 'Maximum scan cycles, 1-100. Higher values find more vulnerabilities but consume more time and resources. Default 30 balances speed and coverage.' 'Enable RAG memory (Retrieval-Augmented Generation) to reuse insights from past scans. Recommended for repeated target assessment.'
Convert ai_provider to an explicit enum in the schema: {enum: ['auto', 'openai', 'claude', 'deepseek', 'groq', 'kimi', 'ollama']}. Update description: 'AI provider for autonomous scan logic. auto=auto-select from available (order: openai→claude→deepseek→groq). Provider must be available (check via get_ai_providers). If not configured, falls back to ollama localhost.'
Declare mutually exclusive parameters. In sqlmap_scan description, add: 'Pass exactly one of: url (single target) or targetlist (file path to URLs, one per line). Comments (#) and blank lines ignored.'
Spec posture evidence
Inferred effective spec: <=2025-11-25.
Relies on Logging (deprecated) - log to stderr or use OpenTelemetry
No error classification or recovery guidance. When sqlmap_scan fails (e.g., 'No valid targets found', 'SQLMapRunner not available'), the response is a bare dict with 'ok: False'. The LLM has no hint whether to retry, ask the user, or abandon the action.
Destructive operation lacks confirmation pattern. sqlmap_scan initiates an active security scan (potentially hours long, network-intensive, modifying remote targets). No dry-run mode, no confirmation_required hint, no warning in description. The tool is marked 'Risk: WRITE' but the description does not convey this.
Path traversal risk in targetlist parameter. Code validates 'if ROOT not in fp.parents and fp != ROOT' but symlinks, relative paths with '..', and case-insensitive traversal on Windows are not guarded. An attacker or confused LLM could read arbitrary files.
AI provider selection exposes provider names as free-form string enum without explicit constraint. 'ai_provider' has default 'auto' and description lists 'auto/openai/claude/deepseek/groq/kimi/ollama', but schema does not declare an enum field. LLMs can hallucinate invalid providers like 'gpt-4' or 'anthropic'.
Generic, non-descriptive tool names for read-only query tools. 'get_scan_status', 'get_ai_providers', 'get_rag_memory' are passable but lack specificity about what 'scan' refers to (SQLMap scan), what fields 'status' includes, or what 'RAG memory' is. A description alone cannot substitute for a more precise name.
No idempotency guarantees. sqlmap_scan appears to initiate a new scan on each call without a scan_id or idempotency_key. If an agent retries after a transient timeout, it will launch a second scan, doubling work and costs.
sqlmap_scan
Add error guidance to each tool's description and return error responses with actionable next steps. For example: 'If SQLMapRunner not available, ensure the core scanner module is installed. If targetlist not found, verify the file exists and is readable. If no targets parsed, check the file format (one URL per line, no comments in data rows).'
Implement a dry-run mode for sqlmap_scan. Add parameter 'dry_run: bool (default false)'. Update description: 'Dry run validates targets and configuration without executing probes. Use to verify setup before real scan.' Return {ok: true, dry_run: true, validated_targets: [...], estimated_time: '45m', issues: [...]} to let the LLM preview before committing.
Add idempotency key support. Add parameter 'idempotency_key: str (optional, UUID)'. Document: 'If provided, the same key ensures only one scan runs. Retries with the same key return the existing scan status instead of launching a new one.'
Tighten path validation in targetlist. Use os.path.realpath() and check against ROOT after full normalization. Validate file is not a symlink (os.path.islink()) or reject symlinks explicitly. Sanitize against directory traversal by rejecting '..' in any path component.
Add bounds to numeric parameters. max_cycles: 1-500 (default 30), logs_limit: 1-1000 (default 50). Include bounds in schema (minimum, maximum) and description.
Add risk and permission hints to tool descriptions. sqlmap_scan: 'Risk: WRITE (initiates active probes against remote hosts). Requires security:scan permission. Scans may trigger WAF, IDS, or security alerts on target systems. Use caution and only on authorized targets.' get_scan_status: 'Risk: READ_ONLY (view only). Requires security:read permission.' Similar for others.
Rename tools for clarity: sqlmap_scan → scan_target_with_sqlmap, get_scan_status → get_current_sqlmap_scan_status, get_ai_providers → list_available_ai_providers, get_rag_memory → search_rag_memory_for_insights. Names should unambiguously convey domain (SQLMap security scanning) and distinguish from generic status/list tools.
Add per-tool success/failure examples to documentation (not in descriptions, but in server README or inline comments). Example for sqlmap_scan success: {ok: true, scan_id: 'scan-abc123', targets: ['https://example.com'], estimated_completion: '2024-01-15T14:30:00Z'}. Example failure: {ok: false, error: 'Invalid URL format', error_code: 'INVALID_INPUT', suggestion: 'Use http:// or https:// scheme. E.g., https://example.com'}.