Loading ToolBench
MCP server for offensive security tools and penetration testing automation. Provides 50+ tools for reconnaissance, scanning, enumeration, exploitation, and post-exploitation across Kali Linux and Windows platforms.
This server has 28 tools with significant definition gaps. Most tools (24/28) lack explicit input parameter descriptions, only the parameter names and types are visible in the schema dict, with no descriptive text explaining what each parameter controls or its constraints. Tool descriptions are present but generic (avg ~60 chars, well below the 194-char baseline). No output schemas are documented. Error handling is absent, no recovery guidance, no categorization of retryable vs fatal errors. The server exposes offensive security capabilities (nmap, nuclei, msfvenom) with minimal guardrails: no permission gates, no audit logging visible, no dry-run patterns for destructive operations like generate_payload. Tool naming is reasonable (verb_noun style: nmap_basic, gobuster_dir) but lacks clarity on when to choose between similar tools (e.g., nmap_basic vs nmap_stealth vs nmap_vuln). No tool annotations (readOnlyHint, destructiveHint) despite many tools being high-risk.
Deep subdomain enumeration using Amass passive/active modes
Bulk DNS resolution and record enumeration with dnsx
SMB/Samba enumeration — users, shares, groups, OS, password policy
Recursive content discovery with Feroxbuster
FFUF web fuzzer — fuzz directories, parameters, headers, vhosts
Generate reverse shell payload via msfvenom.
Get current engagement scope.
Parameter descriptions missing or minimal. 24/28 tools have schema dicts with parameter names and types but NO descriptive text explaining what each parameter does, its constraints, or valid values. E.g., nmap_basic has 'ports' param with no guidance on format (range vs comma-separated list). LLMs cannot infer intent from names alone.
No output schemas documented. Tools return results but no schema describes what fields the LLM should expect. E.g., nmap_basic returns scan results but no documentation of output structure (open ports, services, versions). LLMs cannot plan downstream tool calls without knowing what data is available.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 44 | <=2025-11-25 | v2 |
Directory brute-force with Gobuster
DNS subdomain brute-force with Gobuster
LDAP enumeration of Active Directory — users, groups, computers
List all saved tool output files.
List all tools in a category.
Masscan — ultra-fast port scanner, ideal for large /16 subnets
Nikto web server vulnerability scanner
Nmap service/version scan with default scripts
Nmap SYN stealth scan — requires root
Nmap vulnerability scan using NSE vuln scripts
Nuclei template-based vulnerability scanner — 9000+ templates
Read a saved tool output file.
Search tool registry by name, tag, or keyword (e.g. 'smb', 'kerberos', 'xss').
Set engagement scope. Call FIRST before any attack tool. Targets outside scope are blocked.
Shodan CLI — search internet-exposed services for target org
SNMP walk — enumerate SNMP OIDs for device/config info
Fast passive subdomain discovery via 40+ data sources
Get recommended tool chain for a given attack phase and target type.
OSINT harvester — emails, subdomains, IPs from public sources
Web technology fingerprinter — CMS, framework, server
WHOIS lookup for domain registration info
No error handling or recovery guidance. Tools have no documented error cases, retryability, or actionable error messages. E.g., if nmap_basic fails due to invalid target, no guidance on what to do next. Agents cannot self-correct.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). High-risk tools like generate_payload (WRITE risk) and nmap_stealth lack annotations. Agents cannot distinguish safe tools from dangerous ones without reading descriptions.
No permission gates or audit logging for destructive operations. generate_payload creates malware payloads; set_scope controls engagement scope. No visible permission checks, no audit trail, no confirmation step before execution. Agents can invoke these without authorization.