Loading ToolBench
An MCP server that integrates Kali Linux security tools and utilities, providing AI agents native access to reconnaissance, scanning, enumeration, web vulnerability testing, password cracking, and exploitation tools.
This server exhibits systematic deficiencies across naming, descriptions, parameter documentation, and schema clarity. While all 21 tools are explicitly registered via @mcp.tool() decorators with visible function signatures, most lack the rigor expected of production tools. Tool names follow verb_noun patterns adequately (whois_lookup, nmap_scan, etc.), but descriptions are often generic or incomplete. Most critically: (1) NO tools document their output schema, the return type is universally 'str' (plain text), leaving LLMs unable to parse structured results. (2) Parameter descriptions are minimal or absent for many tools, e.g., 'nmap_scan' accepts 'flags' with only 'Nmap flags (default: "-sV -F")' as guidance, providing no constraint on valid flag values, which could enable command injection. (3) No parameter validation or constraint specifications (enums, patterns, ranges) are present in the schema layer. (4) Error messages are generic ('Error: Tool not installed', 'Command timed out') with no recovery guidance. (5) Security parameters like passwords are exposed as tool inputs (smbclient_list, hydra_bruteforce), violating secret injection patterns. (6) Tool descriptions do not explain WHEN to use each tool vs. similar ones (e.g., dirb_scan vs. gobuster_dir vs. ffuf_scan are functionally redundant but not distinguished). Per-tool analysis shows most tools score 25-45 overall; a few (whois_lookup, dnsenum_scan) reach 50 due to clearer single-purpose definitions.
Run OWASP Amass for subdomain enumeration (passive mode for speed).
Run Dirb for web content scanning [1].
Run Dnsenum to enumerate DNS records for a domain.
Run Enum4linux to enumerate information from Windows and Samba systems.
Run FFUF (Fuzz Faster U Fool) for fast web directory fuzzing. Target URL must include the 'FUZZ' keyword.
Run Gobuster to brute-force directories and files on a web server [1].
Run Hashcat to crack an inline hash string. Note: Hashcat can be very resource-intensive.
NO OUTPUT SCHEMAS DOCUMENTED. All 21 tools return plain text (str type) with no structured schema definition. LLMs cannot parse or chain results; they must resort to regex or heuristic parsing of raw command output.
PASSWORDS AND CREDENTIALS EXPOSED AS PARAMETERS. smbclient_list accepts 'user' and 'password' as plain-text parameters; hydra_bruteforce similarly exposes wordlist paths and service credentials. These will be logged in trace history and agent logs, violating secret-injection pattern. Use server-side credential injection via environment variables or a secrets vault.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 43 | 2026-07-28+ | v2 |
Run THC-Hydra to brute force login credentials for a specific service (e.g., ssh, ftp).
Run John the Ripper to crack an inline password hash string.
Execute a Metasploit module against a target. Provide the module name (e.g., 'exploit/windows/smb/ms17_010_eternalblue'). Provide options as a comma-separated string of KEY=VALUE pairs (e.g., 'RHOSTS=192.168.1.100, LHOST=10.0.0.5, LPORT=4444').
Run Netdiscover to find active hosts on a local subnet (requires root). Example ip_range: '192.168.1.0/24'
Run a Nikto web vulnerability scan against a target URL [1].
Run an Nmap scan for network discovery and port scanning [1].
Search the Exploit Database using SearchSploit for known vulnerabilities.
List SMB shares on a target using smbclient.
Run SQLMap to detect and exploit SQL injection flaws. Runs in --batch mode automatically.
Capture a specific number of network packets using tcpdump (Requires Root).
Run Wfuzz to fuzz web application parameters or directories. Target URL must include 'FUZZ'.
Run WhatWeb to identify CMS, web technologies, and headers of a website.
Perform a WHOIS lookup on a domain to find registration and ownership details.
Run WPScan to scan a WordPress site for vulnerabilities and enumerate users/plugins.
PARAMETER CONSTRAINTS MISSING. 'flags' parameter in nmap_scan accepts arbitrary strings with no validation, LLMs could pass malicious flag combinations or command injection payloads (e.g., 'nmap -sV; rm -rf /). All string parameters accepting user input lack enum, pattern, or length constraints.
MISSING PARAMETER DESCRIPTIONS. Several tools have parameters with minimal or no guidance: netdiscover_scan's 'ip_range' states only 'Example ip_range' without explaining valid CIDR format or constraints. Parameters lack type clarity and validation rules.
TOOL REDUNDANCY WITHOUT DISAMBIGUATION. dirb_scan, gobuster_dir, ffuf_scan, and wfuzz_scan are four functionally similar directory-brute-force tools that differ only in command-line flags. Descriptions do not explain when to prefer one over another, forcing LLMs to guess. Either consolidate into one flexible tool or clearly differentiate use cases.
GENERIC ERROR MESSAGES WITHOUT RECOVERY GUIDANCE. run_cmd() returns errors like 'Error: Tool not installed' or 'Command timed out' with no actionable next steps. LLMs cannot determine if they should retry, try an alternative tool, or ask the user for help.
DESTRUCTIVE AND REVERSIBLE TOOLS NOT DISTINGUISHED IN SCHEMA. sqlmap_scan (WRITE risk), hydra_bruteforce, john_crack, and metasploit_exploit (DESTRUCTIVE risk) lack tool annotations (readOnlyHint, destructiveHint) in their definitions. LLMs cannot detect which tools are safe vs. dangerous without explicit annotations.
MISSING IDEMPOTENCY DOCUMENTATION. Many tools (e.g., hydra_bruteforce, john_crack) can have side effects (network traffic, resource consumption, potential account lockouts). Descriptions do not state whether repeated calls with identical inputs are safe or if LLMs should avoid retry.
NO PERMISSION/SCOPE DECLARATIONS. Tools requiring elevated privileges (netdiscover_scan, tcpdump_sniff, metasploit_exploit) do not declare required scopes (e.g., 'requires:root', 'requires:exploit:write'). Agents cannot plan least-privilege configurations.
INCONSISTENT DEFAULT PARAMETER HANDLING. Many tools accept optional 'wordlist' and 'timeout' parameters with defaults embedded in code, not surfaced in schema. If a default changes, LLMs may not know the new behavior.