Loading ToolBench
Multi-tool MCP server repository providing security testing, enumeration, exploitation, and network utilities wrapped as MCP tools. Includes subdomain discovery (amass), AWS interaction (aws), Active Directory tools (bloodhound, bloodyad, certipy), network tunneling (chisel), cloud enumeration (cloudfox), HTTP client (curl), DNS enumeration, embedding services, SMB enumeration (enum4linux-ng), WinRM access (evil-winrm), code execution sandbox (exploit-runner), web fuzzing (ffuf), forensics analysis, FTP client, and more.
The server defines 11 tools across security domains (reconnaissance, code execution, embeddings, web fuzzing). Strengths: all tools have descriptions (50-200 chars, within baseline 194 avg); parameter schemas are consistently present with types and descriptions. Critical weaknesses: (1) Tool names lack action verbs, 'enum_passive', 'enum_active', 'embed', 'hybrid_score', 'health', 'exec', 'upload', 'download', 'dir_fuzz', 'param_fuzz', 'vhost_fuzz' are inconsistent with verb_noun convention (only 'exec', 'upload', 'download' follow pattern). 'enum_passive' and 'enum_active' are particularly unclear, should be 'enumerate_subdomains_passive' or 'scan_subdomains_passive'. (2) Output schemas are NOT documented anywhere in the visible code, the base_server.py shows ToolResult with success/data/error structure, but no explicit schema definition for what each tool returns. (3) Security tools accept credentials as parameters (username, password, hash in exec/upload/download), CRITICAL violation of pattern:secret-injection. Credentials must never appear in tool parameters. (4) No idempotency guarantees stated for operations like exec (command execution) and upload/download. (5) Error handling in base_server.py shows basic ToolError exception but no guidance for LLM recovery (e.g., 'retry this', 'ask user', or 'unrecoverable'). (6) Three tools (enum_passive, enum_active, embed) have timeout/limit parameters but no explicit max constraints documented. Composition: tools are largely single-purpose (good), but parameter chaining not documented, e.g., do enum_passive/enum_active return data that feeds into dir_fuzz? Not stated.
Subdomain discovery via OWASP Amass v5.0.1. Performs passive and active subdomain enumeration using multiple data sources.
Firmware analysis and binary extraction via binwalk v2.4.3. Identifies and extracts embedded filesystems, compressed archives, and executable code.
Active Directory relationship mapping via BloodHound Python. Collects AD data and generates BloodHound-format JSON for graph analysis.
Active Directory privilege escalation via ACL abuse. Leverages misconfigured ACLs, Resource Based Constrained Delegation (RBCD), shadow credentials, and password resets.
Execute AWS API calls via the official AWS Labs MCP server. Wraps awslabs.aws-api-mcp-server providing direct access to AWS service APIs.
Active Directory Certificate Services enumeration and exploitation. Identifies certificate authority misconfigurations and escalation paths.
HTTP-based network tunneling via Chisel v1.11.4. Establishes reverse/forward tunnels through HTTP/HTTPS for pivoting through firewalls.
Tool names lack action verbs and follow inconsistent naming convention. 'enum_passive', 'enum_active', 'hybrid_score', 'health', 'dir_fuzz', 'param_fuzz', 'vhost_fuzz' violate verb_noun pattern. LLMs cannot infer intent from these names, e.g., 'enum_passive' does not clearly mean 'enumerate subdomains without direct contact'. Should be 'enumerate_subdomains_passive', 'scan_subdomains_passive', etc.
Credentials (username, password, NTLM hash) are exposed as tool parameters in exec, upload, and download. This violates pattern:secret-injection, agent traces will log plaintext passwords. Credentials must be injected server-side via environment variables or vault, never as parameter input.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 0 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 39 | - | v1 |
AWS attack path enumeration via Bishop Fox CloudFox. Analyzes AWS environment for exploitable misconfigurations and attack chains.
HTTP/HTTPS/FTP client for web requests, exploit testing, and file downloads. Full-featured curl wrapper supporting authentication, proxies, and custom headers.
DNS enumeration via dig. Performs zone transfers, record queries, reverse lookups, and DNSSEC validation.
Dense and sparse vector embeddings via BGE-M3 FP16 model. Supports hybrid search (dense + sparse) for semantic document retrieval. Returns embedding vectors and similarity scores.
SMB/Windows enumeration via enum4linux-ng. Enumerates shares, users, groups, policies, and domain information via SMB protocol.
Metadata extraction and analysis via exiftool v13.50. Reads and parses EXIF, IPTC, XMP, and other metadata from images, documents, and media files.
Fast web fuzzer for directory discovery, parameter fuzzing, and vhost enumeration. Supports custom wordlists, filtering, and multiple matching modes.
File carving and recovery via foremost v1.5.7. Recovers deleted files and data remnants from raw forensic images based on file signatures.
FTP/FTPS client for file transfer operations. Supports connect, list, download, upload, delete, and directory navigation via curl FTP protocol.
Terminate a detached/background job started by run_cli_detached. Part of the held resources trio (v0.5.0).
Auto-registered CLI tool for executing external commands and binaries. Available on all servers that inherit from BaseMCPServer/RunCliServer. Supports argv-based invocation with FAKETIME environment variable for clock-skew workarounds.
Execute CLI command in detached/background mode for long-running operations. Returns job ID for status tracking. Part of the held resources trio (v0.5.0).
Execute arbitrary Python code in a sandboxed environment. Used by agents for exploit development, dynamic analysis, and library-based operations (pwntools, impacket, requests, etc.).
Execute arbitrary shell commands in a sandboxed environment. Provides access to compiled binaries (gcc), binary analysis tools (gdb, objdump, ropper), and utility programs (curl, wget, nmap).
Query status of a detached/background job started by run_cli_detached. Returns exit code, stdout, stderr, and completion status.
Steganography tool for embedding and extracting hidden data from image and audio files. Supports passphrase-protected extraction.
Get AWS CLI command suggestions based on agent query. Part of the official AWS Labs MCP server. OPSEC: This tool sends agent query text to a remote AWS Labs HTTP endpoint.
WinRM/PSRP remote execution and file transfer via pypsrp. Supports NTLM password, NTLM pass-the-hash, and Kerberos authentication. Executes commands and transfers files to/from Windows targets.
Output schemas are not documented. The base_server.py defines ToolResult but does not explicitly state what fields each tool returns, their types, or structure. LLMs cannot plan downstream tool calls without knowing output schema. E.g., what does enum_passive return? A list of domains? Domain objects with metadata? Not stated.
Error handling provides no recovery guidance. The base_server.py ToolError exception and CallToolResult structure do not include error classification (retryable vs. user-fixable vs. fatal) or actionable next steps. LLMs receive errors with no guidance on what to try next.
No idempotency guarantees. Tools like exec (command execution), upload, and download do not state whether they are idempotent. Agents retry on ambiguous failures, a non-idempotent exec could run the same command twice. Idempotent operations must be labeled.
Timeout parameters (enum_passive, enum_active) lack maximum constraint documentation. What if an LLM passes timeout=1000? Does it time out? Fail? Reset? Numeric parameters must specify min/max bounds in description.
No pagination or result limits. Tools like enum_passive, enum_active, dir_fuzz, and param_fuzz return unbounded result sets. If a domain has 10,000 subdomains or a fuzzer finds 5,000 paths, the LLM context window explodes. Must cap results and offer pagination.
Tool composition not documented. No guidance on which tools chain together. E.g., do enum_passive output domain names feed into dir_fuzz? Does hybrid_score require embed output? Tool descriptions lack dependency hints.