Loading ToolBench
MCP server providing access to Kali Linux penetration testing tools including reconnaissance, network scanning, vulnerability assessment, exploitation, and post-exploitation capabilities
Server defines 12 tools with explicit schemas and descriptions. However, critical gaps undermine quality: (1) run_command is dangerously generic and violates single-responsibility principle; (2) descriptions lack LLM-optimized structure (missing WHEN to use, prerequisites, or recovery guidance); (3) no output schemas documented, LLMs cannot predict response structure for chaining; (4) error handling is absent, no guidance on retryability, user-fixable vs fatal errors, or recovery paths; (5) security concerns: run_command accepts arbitrary shell input with no sanitization, creating command injection risk; (6) no tool annotations (readOnlyHint, destructiveHint) despite clear risk levels. Naming is generally clear (verb_noun pattern), but parameter descriptions are minimal (avg ~40 chars vs baseline 72). Schemas present but incomplete, missing output documentation entirely.
Deep DNS enumeration using dnsrecon. Attempts zone transfers, enumerates standard record types, checks for wildcard records. More thorough than a basic DNS lookup. Can optionally brute-force subdomains.
Query DNS records for a domain using dig. Can retrieve A (IP), AAAA (IPv6), MX (mail), NS (name servers), TXT, CNAME, SOA records. Good for mapping a target's infrastructure passively.
Gather emails, subdomains, hosts, and URLs from public sources using theHarvester. Searches Google, Bing, and other public indexes. Pure OSINT — zero direct contact with the target.
Discover which hosts are alive on a network using nmap -sn (no port scan). Fast way to map all live devices in a subnet. Example: scan 192.168.1.0/24 to find every device on your local network.
Scan a target for open TCP ports using nmap. Use this first to discover what's open, then use service_scan or nmap_scan for deeper detail. Supports scanning top 100/1000 ports, all 65535 ports, or a custom range.
run_command violates single-responsibility principle and creates command injection risk. Accepts arbitrary shell input with no sanitization, validation, or input constraints. LLMs can be tricked via prompt injection into passing malicious payloads (e.g., 'rm -rf /'). No dry-run or confirmation step for irreversible operations.
No output schemas documented for any tool. LLMs cannot predict response structure, field names, or types. This breaks tool chaining, e.g., if dns_lookup returns 'ips' vs 'addresses' vs 'results', downstream tools cannot reliably extract data. Baseline: 100% of A+ tools document return types.
No error handling guidance. Tools return raw subprocess output or exception messages. LLMs receive no classification (retryable vs user-fixable vs fatal), no recovery suggestions, and no actionable error text. E.g., 'Command timed out after 30s' gives no guidance on whether to retry, increase timeout, or try a different approach.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 55 | 2026-07-28+ | v2 |
Read a file from the Kali Linux container filesystem (e.g. /etc/passwd, scan output files).
Execute ANY shell command inside Kali Linux. Use this as a fallback for anything not covered by a dedicated tool, or to chain multiple commands together with pipes and redirects.
Discover subdomains of a target domain by brute-forcing DNS using Gobuster. Finds hidden subdomains like admin.example.com, dev.example.com, api.example.com. Passive DNS queries — no direct contact with the web server.
Trace the network path from the Kali container to a target host. Shows each router hop and round-trip time. Useful for understanding network topology and detecting firewalls/load balancers.
Identify technologies used by a website using WhatWeb. Detects CMS (WordPress, Drupal, Joomla), web servers (Apache, Nginx, IIS), frameworks, JS libraries, analytics tools, and more. Low-noise recon — looks like a normal browser visit at aggression level 1.
Look up WHOIS registration data for a domain or IP. Reveals owner, registrar, registration/expiry dates, name servers, and contact info. Passive recon — no contact with the target system itself.
Write content to a file inside the Kali container (e.g. custom wordlists, scripts, notes).
Tool annotations missing. No readOnlyHint, destructiveHint, or idempotentHint despite clear risk levels (IRREVERSIBLE for run_command, WRITE for write_file, READ_ONLY for others). Agents cannot reason about side effects or retry safety without these hints.
Parameter descriptions are minimal (avg ~40 chars vs baseline 72). E.g., 'timeout' lacks range constraints (is 30s a hard limit? can it be 0? 999999?). 'ports' parameter accepts 'top100', 'top1000', '1-65535', or custom ranges, but description does not clarify format for custom ranges (comma-separated? hyphen-separated? both?). LLMs guess and pass invalid values.