Autonomous penetration testing agent that executes security tools with intelligent error recovery and permission handling. Provides an HTTP-based MCP server for running reconnaissance and exploitation tools.
Static source inference · medium confidence · detected: Logging
Deprecated protocol patterns detected
Summary
This server exhibits severe quality deficiencies across nearly all 54 agentic tool patterns. Of 23 tools examined: zero have documented output schemas; 22 of 23 lack any parameter type definitions in visible schemas; descriptions are generic and lack actionable guidance; error handling is minimal; and critically, the server enables execution of destructive penetration testing tools (run_command, run_sqlmap, run_hydra, run_setoolkit) with no permission gates, permission declarations, or audit logging. The codebase shows incomplete tool implementations (code is truncated mid-function), missing input validation, no secret injection patterns, and no parameter constraints. Tool naming is inconsistent ('run_*' prefix is generic and non-descriptive per pattern:tool). Composition is extremely poor: run_command is a catch-all that violates single-responsibility; tools like run_setoolkit are vaguely defined social engineering attacks with no attack_type enumeration. The server operates as an unrestricted command execution engine masquerading as an MCP server, violating fundamental security and usability patterns.
CRITICAL: No documented output schemas for any of 23 tools. LLMs cannot plan multi-step chains or extract required fields for downstream calls. Violates pattern:tool and pattern:response-shaper.
CRITICAL: No input parameter type definitions visible in code. Schema section shows property names and brief descriptions but zero type constraints (string|number|boolean|array|object).
run_masscanrun_nmaprun_netstat
Recommendations
IMMEDIATE: Add JSON Schema output documentation for all 23 tools. Each must document the structure of responses: field names, types, required fields. Example: {'type': 'object', 'properties': {'status': {'type': 'string'}, 'open_ports': {'type': 'array', 'items': {'type': 'integer'}}}, 'required': ['status']}.
IMMEDIATE: Add explicit type definitions to all input parameters. Change 'target': 'Target IP or hostname' to 'target': {'type': 'string', 'pattern': '^([0-9]{1,3}\.){3}[0-9]{1,3}$|^([a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+$', 'description': 'Target IPv4 address or FQDN. Examples: 192.168.1.1, example.com'}.
IMMEDIATE: Remove run_command tool entirely. It violates fundamental security patterns. Replace with specific, well-scoped tools (e.g., run_ping, run_traceroute) that the agent can reason about.
IMMEDIATE: Implement permission gates for all destructive tools. Before executing run_sqlmap, run_hydra, run_wget, write_file, etc., check if the calling agent has explicit 'destructive' or 'write:*' scope. Return a clear error if not authorized.
IMMEDIATE: Add tool annotations (readOnlyHint, destructiveHint, idempotentHint) to the tool schema. Mark run_command, run_sqlmap, run_hydra, run_wget, write_file, run_ncrack, run_medusa, run_setoolkit as destructive. Mark discovery tools as readOnly.
HIGH: Add comprehensive error handling with recovery guidance. For each error case, return: error code, human-readable message, root cause, and suggested next step. Example: {'status': 'error', 'error_code': 'host_unreachable', 'message': 'Target 10.0.0.999 does not resolve. Did you mean 10.0.0.9?', 'recovery': 'Verify the target IP or hostname and retry.'}.
Spec posture evidence
Inferred effective spec: <=2025-11-25.
Relies on Logging (deprecated) - log to stderr or use OpenTelemetry
Score history
Overall score trend
First recorded score · v2 rubric
26/100
Scored
Grade
Overall
Spec posture
Rubric
2026-09-23
F
26
<=2025-11-25
v2
run_johnread onlysource verified25/100
Hash cracking
run_katanaread onlysource verified23/100
Web crawling and spidering tool
run_masscanread onlysource verified25/100
Fast port scanner
run_medusawritesource verified23/100
Fast credential brute forcing
run_ncrackwritesource verified23/100
Network authentication cracking
run_netstatread onlysource verified25/100
Display network connections and routing information
CRITICAL: run_command tool accepts arbitrary shell commands with no input validation, sanitization, or permission checks. Enables command injection, arbitrary code execution, data destruction, and lateral movement. Violates pattern:tool-gateway and pattern:permission-gate.
CRITICAL: run_setoolkit tool has vague description ('Social Engineering Toolkit execution') and attack_type parameter with no enumeration, constraint, or guidance. LLM cannot determine valid attack types. Violates pattern:tool-description and pattern:constrained-input.
CRITICAL: No error handling, recovery guidance, or error categorization. Code snippet shows incomplete error responses (e.g., 'Tool not supported' for unsupported_tool). LLMs receive no actionable next steps on failure. Violates pattern:recovery-guide and pattern:error-classification.
CRITICAL: No audit logging for tool invocations. Security-critical operations (credential brute force, SQL injection, command execution) leave no trace of who called what, when, or with which parameters. Violates pattern:audit-trail.
HIGH: Tool naming uses generic 'run_*' prefix (e.g., run_command, run_masscan, run_nmap). Does not follow verb_noun convention clearly. 'run_setoolkit' is especially vague, does not clearly signal it executes social engineering attacks. Violates pattern:tool naming requirements.
HIGH: Parameter descriptions are generic and lack actionable context. Examples: 'Target IP or hostname to scan' does not explain when to use run_nmap vs run_masscan. 'Wordlist path' does not specify format, expected size, or availability. Violates pattern:tool-description (descriptions must answer WHAT, WHEN, PREREQUISITES).
HIGH: run_command violates single-responsibility pattern. It is a catch-all that accepts ANY shell command, making it impossible for agents to reason about side effects, validate safety, or plan chains. Violates pattern:tool (each tool should do exactly one thing).
MEDIUM: Multiple tools perform overlapping reconnaissance (run_masscan, run_nmap, run_nikto, run_nuclei, run_katana, run_ffuf, run_httpx). No clear guidance on when to use each. Violates pattern:tool-composition (avoid multiple tools doing the same thing differently).
MEDIUM: No tool annotations (readOnlyHint, destructiveHint, idempotentHint) visible in schema. Agents cannot distinguish safe read-only calls from destructive ones without analyzing each tool's risk label in metadata. Violates current spec alignment (tool annotations are current pattern as of 2026-07-28).
MEDIUM: No pagination support for tools that return multiple results (run_nmap ports, run_nuclei findings, run_katana URLs, run_gobuster directories). Results could overwhelm context window. Violates pattern:paginated-result.
LOW: Code is incomplete/truncated (write_file implementation cut off mid-function). Cannot fully evaluate error handling or security constraints. Implementation quality is unverifiable.
write_fileread_file
HIGH: Implement audit logging. Log all tool invocations (tool name, parameters, timestamp, result) to a tamper-evident log file or external system. Sanitize parameters to exclude wordlist paths, but retain the fact that brute-force was attempted.
HIGH: Rewrite parameter descriptions with explicit constraints. Include format (IP, CIDR, FQDN), range (1-65535 for ports), enum values (ssh, ftp, mysql for service), and why the parameter matters. Example: 'service: Service to brute-force. Must be one of: ssh, ftp, mysql, postgres, smb, http-get, vnc, telnet. Common for lateral movement after initial access.'
HIGH: Add per-tool selection guidance. Document when to use run_masscan vs run_nmap (masscan is faster for large ranges; nmap is detailed), when to use run_nikto vs run_nuclei, etc. This helps agents and humans understand the toolchain.
HIGH: Split tools with overlapping functionality. Consolidate run_nuclei, run_katana, run_ffuf, run_httpx into a single 'scan_web_application' tool with mode parameter (enum: nuclei, crawl, fuzz, probe). Or clearly delineate when to use each.
MEDIUM: Add pagination to tools that return lists. run_nmap should return {'ports': [22, 80, 443], 'total_found': 1247, 'returned': 50, 'next_cursor': 'offset_50'}. Cap results at 50 per call.
MEDIUM: Document idempotency guarantees. Are these tools safe to retry? For example, run_curl with a GET request is idempotent; run_wget with a download may be non-idempotent if the file already exists.
MEDIUM: Add dependency hints to descriptions. Example: 'run_nmap: Use run_masscan first to identify open ports, then run_nmap for service details on those ports.' This guides agent planning.
MEDIUM: Rename run_setoolkit to 'execute_social_engineering_attack' and add an explicit enum for attack_type: ['phishing_email', 'credential_harvester', 'java_applet', 'website_clone', 'payload_generator']. Current naming is too vague.
MEDIUM: Add rate limiting and timeout constraints to the server configuration. Prevent runaway agents from calling run_hydra 1000x per minute. Set sensible defaults (e.g., max 10 concurrent scans, 5min timeout per tool).
LOW: Complete the truncated code. The write_file and read_file implementations are cut off; ensure they include proper path sanitization (no /etc/passwd, no ../ traversal) and error handling.
LOW: Add examples of tool chaining in the system prompt or documentation. Show agents how to compose tools: 'First, run_subfinder to enumerate subdomains. Then run_masscan on each to find open ports. Then run_nmap for service fingerprinting.'
LOW: Consider adding a 'dry_run' or 'simulation' parameter to destructive tools. This lets agents plan and show the user what would happen before executing.