Loading ToolBench
MCP server for MITM TLS interception and IoT security testing
mitm-mcp has well-structured tool definitions with clear naming (verb_noun pattern) and comprehensive descriptions that include lifecycle and duration hints. All 10 tools have input schemas with type definitions and parameter descriptions. However, output schemas are not documented, LLMs cannot predict what fields to expect from responses. Parameter descriptions lack format constraints (e.g., regex patterns, min/max for numeric fields). Error handling is minimal; tools return generic error dicts without recovery guidance. No tool annotations (readOnlyHint/destructiveHint) despite clear risk classifications in metadata. Missing descriptions for some edge cases (e.g., what happens if engagement_path doesn't exist in start_proxy).
Return current proxy and capture status, flow count, and pcap size for a session. [read-only] [Duration: instant.]
Extract security findings from intercepted flows for a session. [read-only] [Duration: instant to fast (1-3 s) depending on flow count.]
Read intercepted HTTP/TLS flows from a session, with optional filtering. [read-only] [Duration: instant for small sessions; fast (1-3 s) on long-running captures with many thousands of flows.]
List DHCP clients from the dnsmasq leases file. [read-only] [Duration: instant (file read).]
Start the hostapd access point via ap-toggle.sh. Set passthrough=true for a plain NAT AP without mitmproxy redirection (sacrificial-pair captures, AP-as-AP). [allowed-write] [Duration: fast (~2-5 s -- hostapd + dnsmasq + iptables). Lifecycle: persistent -- the AP keeps running until stop_ap is called.]
Start tshark packet capture on an interface for a session. [allowed-write] [Duration: fast (~1-2 s -- tshark spawn). Lifecycle: persistent -- tshark runs until stop_capture is called.]
Output schemas not documented. LLMs cannot predict response structure (fields, types, nesting). Breaks downstream tool chaining and forces agents to guess field names.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Tools are marked with [read-only] or [allowed-write] in descriptions, but not in machine-readable metadata. Agents cannot programmatically distinguish safe from destructive calls.
Error responses lack recovery guidance. Tools return {'error': '...'} without suggesting next steps. E.g., 'Session not found: xyz' should suggest 'Call capture_status() to list active sessions.'
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 60 | <=2025-11-25 | v2 |
Start a mitmproxy interception session for the named engagement. Creates engagement folder and starts mitmdump. [allowed-write] [Duration: fast (~1-3 s -- mitmdump startup). Lifecycle: persistent -- mitmdump runs until stop_proxy is called.]
Stop the hostapd access point via ap-toggle.sh. [allowed-write] [Duration: fast (~1-2 s).]
Stop tshark packet capture for a session. [allowed-write] [Duration: instant (~0.5 s).]
Stop a running mitmproxy session and finalize logs. [allowed-write] [Duration: fast (~1-2 s).]
Parameter constraints not documented. 'port' accepts 1-65535 but description lacks min/max. 'interface' defaults to 'wlan0' but no enum of valid interfaces. 'last_n' defaults to 20 but no bounds stated.
Pagination not implemented. get_flows returns 'last_n' (default 20) but no total count or cursor for iterating large result sets. Agents cannot discover how many flows exist or fetch older ones.