Static source inference · medium confidence · detected: Logging
Deprecated protocol patterns detected
Summary
NCL Toolkit presents a well-structured GPU password cracking service with 11 tools covering job lifecycle, file management, and real-time monitoring. Tool naming follows verb_noun conventions (create_job, list_jobs, stream_job_events) and descriptions are generally clear and action-oriented. However, parameter descriptions lack depth, many omit format constraints, valid ranges, and dependency documentation. Output schemas are not explicitly documented in the source. Error handling guidance is absent; tools do not indicate what to do on failure or which errors are retryable. Security considerations around file uploads (1GB wordlists, 100MB rules) lack validation details. The stream_job_events tool uses SSE, which is legacy transport. Overall, definitions are functional but lack the rigor expected of production-grade agent tools.
Tools (11)
cancel_jobreversibleauthsource verified73/100
Cancel a running or queued password cracking job
create_jobwriteauthsource verified75/100
Submit a password cracking job with hashes, attack mode, wordlists, and rules. Supports file uploads for hashes and custom wordlists
get_jobread onlysource verified75/100
Retrieve the status and results of a password cracking job
healthread onlysource verified77/100
Get health status of the GPU Cracker service including GPU detection, hashcat installation, CPU info, and queue status
list_jobsread onlysource verified77/100
List password cracking jobs with optional filtering by status
Parameter descriptions lack format constraints and valid ranges. E.g., 'hash_mode' and 'attack_mode' in create_job accept integers but do not document valid ranges (0-31 for hash_mode, 0-7 for attack_mode). 'timeout_seconds' has no min/max bounds. LLMs cannot infer valid values and will pass arbitrary integers.
Output schemas are not documented in the source code. Tools like create_job, get_job, and list_jobs return responses, but the structure (fields, types, nested objects) is not visible. LLMs cannot plan downstream calls or extract required data without knowing what fields to expect.
File upload tools (upload_wordlist, upload_rule) specify max sizes (1GB, 100MB) but do not document accepted file formats, encoding, or validation errors. No guidance on what happens if a file is malformed or exceeds limits. Error handling is absent.
Destructive operations (cancel_job, self-test) lack confirmation or dry-run support. An agent could cancel a running job without warning. No guidance on whether cancellation is reversible or what state the job enters.
Parameter 'mask' in create_job is described as 'Brute-force mask pattern (e.g., '?a?a?a?a')' but lacks formal specification of valid mask syntax. LLMs may pass invalid patterns. No enum or regex constraint provided.
create_job
Document output schemas for all tools. Specify the structure of responses (e.g., create_job returns {job_id: string, status: string, created_at: ISO8601, queue_position: integer}). Include all fields the agent needs for downstream calls.
Add error handling guidance to tool descriptions. E.g., 'If hash_mode is invalid, returns 400 with message 'Invalid hash_mode: must be one of [0, 1, 3, ...]'. Retry with a valid mode.' Categorize errors as retryable (network timeout) vs user-fixable (invalid input).
Implement confirmation or dry-run for destructive operations. Add a 'confirm' parameter to cancel_job (default false) or offer a 'preview_cancellation' tool that shows what would be canceled without executing.
Add file format and encoding documentation to upload_wordlist and upload_rule. E.g., 'Wordlist must be UTF-8 encoded, one password per line, max 1GB. Supported formats: .txt, .gz. Returns 400 if file is binary or exceeds size limit.'