Loading ToolBench
MCP server for styx, a post-exploitation framework providing node management, network tunneling, file transfer, command execution, and network scanning capabilities
styx-mcp defines 15 tools with explicit schemas and descriptions. All tools have names starting with action verbs (list_, get_, add_, delete_, start_, connect_, upload_, pull_, shutdown_). Descriptions are present and range 50 - 200 chars, meeting baseline expectations. However, several critical gaps reduce the score: (1) output schemas are not documented, callers cannot predict response structure; (2) error handling is absent, no recovery guidance or categorization; (3) parameter descriptions lack format/constraint details (e.g., 'address' format, timeout bounds, port ranges); (4) no pagination support on list_nodes despite potentially large result sets; (5) security-sensitive tools (start_cmd, start_scan, shutdown_node) lack permission gates or audit trail documentation. The start_scan tool is particularly complex with 10 parameters but minimal guidance on mutual exclusivity or defaults. Overall, definitions are functional but lack production-grade polish.
Add a memo text to a node for annotation purposes
Connect a node to a target address
Delete the memo from a node
Get detailed information about a specific node by node ID
Get the status and result of an asynchronous task
List all connected nodes with their metadata including ID, UUID, IP address, local addresses, hostname, user, memo, and children
Output schemas not documented. Callers cannot predict response structure, field names, or types. LLMs must guess what fields to extract for downstream tool calls.
Parameter descriptions lack format constraints. 'address' appears in 5 tools but format ([ip]:<port>) is only documented in descriptions, not as JSON Schema pattern or minLength/maxLength. 'timeout_sec' lacks min/max bounds (code shows default 30, max 120 but not in schema).
No error handling guidance. Tools like start_cmd, upload_file, and shutdown_node are irreversible or destructive but provide no recovery hints, categorization (retryable vs fatal), or actionable error messages.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 55 | 2026-07-28+ | v2 |
Download a file from a node to the controller
Shutdown and disconnect a node
Start reverse port forwarding through a node
Execute a command on a node asynchronously
Start port forwarding on a node
Start a listener on a node to accept incoming connections
Start an intranet scan from an agent to discover alive hosts and port-scan them. Authorized environments only. Refs are hints not confirmed vulns. Full mode is expensive and hard-capped.
Start a SOCKS proxy tunnel through a node
Upload a file to a node
list_nodes lacks pagination. No limit, offset, or cursor parameters. Large node counts will blow context windows. Baseline pattern requires page/offset + limit + total count.
Security-sensitive tools (start_cmd, start_scan, shutdown_node) lack permission gates, scope declarations, or audit trail documentation. No indication of what authorization checks are performed server-side.