Loading ToolBench
A cybersecurity reconnaissance MCP server providing network scanning, web reconnaissance, vulnerability assessment, and information gathering tools
PocketRecon-AI is a reconnaissance toolkit with 15 tools covering network, web, and vulnerability scanning. While all tools have descriptions and input schemas are present, quality is inconsistent. Descriptions range from adequate (ping, nmap) to minimal (traceroute: 4 words). Parameter descriptions are present but often generic. No output schemas documented. Error handling is basic (generic 500 responses). Tools lack idempotency hints, permission gates, and security annotations. The server exposes potentially sensitive operations (nmap, netcat, curl with arbitrary payloads) without destructive/readOnly hints. No evidence of input validation or rate limiting. Average tool score: 42/100.
Check if an IP address is listed in the AbuseIPDB blocklist.
Perform HTTP requests using curl.
Look up CVE vulnerabilities for a product and version.
Perform directory and file enumeration on a web target.
Perform DNS enumeration including A, AAAA, MX, NS records and subdomain discovery.
Audit HTTP security headers and identify misconfigurations.
Perform HTTP requests with advanced options.
No output schemas documented. Tools return unstructured JSON responses without field definitions. LLMs cannot predict response structure for downstream tool chaining or field extraction.
Missing tool annotations (readOnlyHint, destructiveHint, idempotentHint). Tools like nmap, curl, and netcat perform reconnaissance that could be sensitive; no hints guide agent behavior or logging.
Minimal descriptions on 8 tools (traceroute, whois, dirbuster, whatweb, abuseipdb_checker under 50 chars). Descriptions like 'Trace the network path to a target host' lack context on when to use vs similar tools or prerequisites.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 55 | <=2025-11-25 | v2 |
Test TCP connectivity or perform raw socket interaction using Netcat. Purpose: Validate port accessibility and optionally send raw payload data.
Perform network reconnaissance using Nmap. Purpose: Discover open ports, running services, OS fingerprinting, and optional NSE (Nmap Scripting Engine) based enumeration of a target host.
Execute ICMP echo requests to a target host. Purpose: Diagnose basic network reachability and measure latency/jitter. Parameters: target (str): IP address or hostname to ping. count (int): Number of ICMP echo requests to send (default: 1).
Trace the network path to a target host.
Visit a website and extract content including title, headings, links, and text.
Perform web search using DuckDuckGo.
Identify web technologies and frameworks used by a target website.
Perform WHOIS lookup on a domain.
No input validation or error recovery guidance. Flask routes catch exceptions and return generic 500 errors with no actionable guidance. E.g., invalid nmap target returns 'Internal Server Error' instead of 'Invalid target: must be IP, hostname, or CIDR range'.
No pagination or result limits documented. Tools like web_search, dns_enum, and visit_website may return unbounded results. No limit parameter or documentation of max results, risking context window exhaustion.