Loading ToolBench
pm3-mcp has well-structured tool definitions with complete JSON schemas and descriptions for all 11 tools. Naming follows verb_noun convention (connect, disconnect, detect_tag, etc.). Descriptions are detailed and include duration/risk annotations. However, parameter descriptions lack actionable constraints (e.g., hex format validation is in code, not schema). Output schemas are not documented in tool definitions. Error handling returns structured dicts but lacks recovery guidance. Input validation is thorough in code (tools.py) but not exposed in schema constraints (no pattern/minLength/maxLength in JSON Schema). Missing tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear read/write semantics.
Run 'hf mf autopwn' to automatically recover all MIFARE Classic keys. Chains dictionary, darkside, nested, and hardnested attacks as needed. Returns recovered keys and dump path. [read-only] [Duration: very-slow (5-30+ min depending on card PRNG and key diversity). Background-dispatch required.]
Connect to a Proxmark3 device and create an engagement folder. Returns a session_id for subsequent calls. [allowed-write] [Duration: fast (~1-2 s -- single pm3 handshake).]
Run 'hf mf darkside' to recover a MIFARE Classic key using the darkside attack. Only works on cards with a weak PRNG. [read-only] [Duration: slow (~30-120 s -- PRNG-dependent). Background-dispatch recommended.]
Run 'auto' to detect any nearby RFID/NFC tag. Returns raw PM3 output. [read-only] [Duration: fast (~1-2 s -- single pm3 command round-trip).]
Disconnect a PM3 session by session ID. [allowed-write] [Duration: instant.]
Dump a tag to the engagement artifacts directory. Supports MIFARE Classic 1K/4K and MIFARE Ultralight. [read-only] [Duration: slow (~30-60 s for MIFARE Classic 1K/4K -- reads all sectors sequentially). Background-dispatch recommended.]
Output schemas not documented. Tool descriptions state what is returned (e.g., 'Returns parsed PM3 output', 'Returns recovered keys and dump path') but JSON Schema output type is missing. LLMs cannot plan downstream tool calls without knowing response structure.
Parameter constraints not exposed in JSON Schema. Code validates hex format (12 chars, no spaces), block ranges (0-255), sector ranges (0-39), and key types (A|B), but schema lacks pattern, enum, minLength, maxLength, minimum, maximum. LLMs cannot self-correct invalid input without explicit schema constraints.
Missing tool annotations. All tools have clear read/write semantics (marked in descriptions: [read-only], [allowed-write]) but lack JSON Schema annotations (readOnlyHint, destructiveHint, idempotentHint). Agents cannot determine retry safety or permission requirements from schema alone.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 58 | <=2025-11-25 | v2 |
Run 'hf search' and, if a tag is found, 'hf 14a info'. Returns combined parsed result. [read-only] [Duration: fast (~2-4 s -- two pm3 command round-trips).]
Run 'hw status' and return parsed PM3 device information. [read-only] [Duration: fast (~1-2 s -- single pm3 command round-trip).]
Run 'lf search' and return parsed low-frequency tag information. [read-only] [Duration: fast (~2-5 s -- lf search samples for a short window).]
Run 'hf mf nested' to recover unknown MIFARE Classic keys using a known key. Requires a working key for at least one sector. [read-only] [Duration: slow (~30-120 s per sector depending on nonce collection). Background-dispatch recommended.]
Read a single MIFARE Classic block by number. Returns hex and ASCII representations. [read-only] [Duration: fast (~1-2 s -- single block read).]
Error responses lack recovery guidance. Tools return {'error': str(exc)} but do not suggest next steps. E.g., 'session not found: xyz' should suggest 'Call connect() first to establish a session.'
Long-running tools (autopwn 5-30+ min, dump_tag 30-60 s) lack progress reporting or cancellation support. Descriptions recommend 'Background-dispatch required' but MCP protocol features show progress=false, cancellation=false. Agents cannot monitor or abort hung operations.