Offline methodology engine for authorized penetration testing, CTF, and security research.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Analyze an HTTP response from authorized probing for information leakage, fingerprinting signals, and related exposure. Structured findings cover version disclosures, stack traces, debug headers, internal paths, authentication patterns, CORS configuration, detection signals, remediation, and associated methodology vectors.
Freeform context about the authorized test target — e.g., "login endpoint", "GraphQL API", "file upload handler". Narrows the pattern matching to relevant categories. Max 2,000 characters.
HTTP status code (100–599). Helps classify the response type.
Raw HTML, JSON, XML, or error response body text. Maximum 10,000 characters.
Raw HTTP response headers, optionally including the status line. Maximum 20,000 characters.
Analyze an HTTP response from authorized probing for information leakage, fingerprinting signals, and related exposure. Structured findings cover version disclosures, stack traces, debug headers, internal paths, authentication patterns, CORS configuration, detection signals, remediation, and associated methodology vectors.
| Argument | Type | Description |
|---|---|---|
| context | string | Freeform context about the authorized test target — e.g., "login endpoint", "GraphQL API", "file upload handler". Narrows the pattern matching to relevant categories. Max 2,000 characters. |
| status_code | integer | HTTP status code (100–599). Helps classify the response type. |
| response_body | string | Raw HTML, JSON, XML, or error response body text. Maximum 10,000 characters. |
| response_headers | string | Raw HTTP response headers, optionally including the status line. Maximum 20,000 characters. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"context": {
"type": "string",
"maxLength": 2000,
"description": "Freeform context about the authorized test target — e.g., \"login endpoint\", \"GraphQL API\", \"file upload handler\". Narrows the pattern matching to relevant categories. Max 2,000 characters."
},
"status_code": {
"type": "integer",
"maximum": 599,
"minimum": 100,
"description": "HTTP status code (100–599). Helps classify the response type."
},
"response_body": {
"type": "string",
"maxLength": 10000,
"description": "Raw HTML, JSON, XML, or error response body text. Maximum 10,000 characters."
},
"response_headers": {
"type": "string",
"maxLength": 20000,
"description": "Raw HTTP response headers, optionally including the status line. Maximum 20,000 characters."
}
},
"additionalProperties": false
}Transform a payload string through an ordered encoding chain for authorized filter research. Results include the final value, intermediate values, optional decode path and rationale, and detection guidance. All transforms are local; no live probing occurs.
| Argument | Type | Description |
|---|---|---|
| chain* | array | Ordered list of encodings to apply (1–6 steps). Applied left to right. E.g., ["unicode", "url"] applies Unicode escape first, then URL-encodes the result. |
| explain | boolean | Whether to include the decode path and bypass rationale. |
| payload* | string | Input payload string to encode. Max 10,000 characters. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"payload",
"chain"
],
"properties": {
"chain": {
"type": "array",
"items": {
"enum": [
"url",
"double_url",
"html_entity",
"unicode",
"hex",
"base64",
"js_escape",
"null_byte",
"mixed_case",
"comment_break"
],
"type": "string",
"description": "An encoding step."
},
"maxItems": 6,
"minItems": 1,
"description": "Ordered list of encodings to apply (1–6 steps). Applied left to right. E.g., [\"unicode\", \"url\"] applies Unicode escape first, then URL-encodes the result."
},
"explain": {
"type": "boolean",
"default": true,
"description": "Whether to include the decode path and bypass rationale."
},
"payload": {
"type": "string",
"maxLength": 10000,
"minLength": 1,
"description": "Input payload string to encode. Max 10,000 characters."
}
},
"additionalProperties": false
}Generate context-specific payload templates for authorized systems. Each template includes its vulnerability category, context rationale, WAF/IDS detection signature, mitigation, optional WAF research note, and optional encoded variant.
| Argument | Type | Description |
|---|---|---|
| count | integer | Number of payload variants to return (1–20, default 5). More variants cover different bypass approaches for the same context. |
| category* | string | Vulnerability category for payload generation. |
| encoding | array | Optional encoding chain applied left to right to each returned template. |
| waf_profile | string | WAF or filter in front of the authorized test target. When a specific WAF is named, bypass variants referencing known public research are included. |
| injection_context* | string | Precise injection context. Critical for XSS: an HTML attribute payload differs from a JS string payload. Provide the most specific context for the best results. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"category",
"injection_context"
],
"properties": {
"count": {
"type": "integer",
"default": 5,
"maximum": 20,
"minimum": 1,
"description": "Number of payload variants to return (1–20, default 5). More variants cover different bypass approaches for the same context."
},
"category": {
"enum": [
"xss",
"sqli",
"ssrf",
"xxe",
"path_traversal",
"ssti",
"command_injection",
"open_redirect",
"csrf",
"deserialization",
"jwt",
"ldap_injection",
"nosql_injection",
"http_header"
],
"type": "string",
"description": "Vulnerability category for payload generation."
},
"encoding": {
"type": "array",
"items": {
"enum": [
"none",
"url",
"double_url",
"html_entity",
"unicode",
"hex",
"base64",
"js_escape"
],
"type": "string",
"description": "An encoding step to apply."
},
"description": "Optional encoding chain applied left to right to each returned template."
},
"waf_profile": {
"enum": [
"cloudflare",
"aws_waf",
"modsecurity_crs",
"imperva",
"akamai",
"f5_bigip_asm",
"nginx_modsecurity",
"fortinet_fortiwaf",
"none",
"unknown"
],
"type": "string",
"default": "none",
"description": "WAF or filter in front of the authorized test target. When a specific WAF is named, bypass variants referencing known public research are included."
},
"injection_context": {
"enum": [
"html_attribute",
"html_body",
"js_string",
"js_template",
"js_script_block",
"url_parameter",
"url_path",
"sql_where",
"sql_integer",
"xml_element",
"xml_attribute",
"http_header",
"json_value",
"cookie_value",
"file_name",
"generic"
],
"type": "string",
"description": "Precise injection context. Critical for XSS: an HTML attribute payload differs from a JS string payload. Provide the most specific context for the best results."
}
},
"additionalProperties": false
}Return an authorized-testing methodology for a selected vector and optional target context. The playbook covers reconnaissance, enumeration, exploitation, and post-exploitation phases with objectives, techniques, detection signals, mitigations, common pitfalls, references, and context-derived tool suggestions across 15 vectors.
| Argument | Type | Description |
|---|---|---|
| phase | string | Methodology phase selector. "all" returns the complete playbook; a named phase returns only that phase. |
| vector* | string | Attack vector to retrieve methodology for. Each vector has its own methodology branch covering recon through exploitation. Authorized testing only. |
| target_context | object | Optional target profile for authorized engagement. Providing this narrows the playbook to what is most relevant for the specific environment. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"vector"
],
"properties": {
"phase": {
"enum": [
"all",
"recon",
"enumeration",
"exploitation",
"post_exploitation"
],
"type": "string",
"default": "all",
"description": "Methodology phase selector. \"all\" returns the complete playbook; a named phase returns only that phase."
},
"vector": {
"enum": [
"auth_bypass",
"idor",
"ssrf",
"xss",
"sqli",
"xxe",
"path_traversal",
"cors",
"csrf",
"open_redirect",
"deserialization",
"race_condition",
"ssti",
"command_injection",
"jwt_attack"
],
"type": "string",
"description": "Attack vector to retrieve methodology for. Each vector has its own methodology branch covering recon through exploitation. Authorized testing only."
},
"target_context": {
"type": "object",
"properties": {
"waf": {
"type": "string",
"description": "WAF or filter in use (e.g., \"Cloudflare\", \"AWS WAF\", \"ModSecurity CRS\", \"custom regex\"). Triggers bypass-aware variants in payload suggestions."
},
"stack": {
"type": "string",
"description": "Technology stack (e.g., \"Node.js + Express + PostgreSQL\", \"PHP 7.4 + Apache\", \"Spring Boot\"). Narrows methodology to stack-specific techniques."
},
"recon_notes": {
"type": "string",
"description": "Freeform recon findings to incorporate. E.g., \"endpoint /api/users/{id} reflects user input in JSON response\". Narrows which phases are most relevant."
}
},
"description": "Optional target profile for authorized engagement. Providing this narrows the playbook to what is most relevant for the specific environment."
}
},
"additionalProperties": false
}Look up a MITRE ATT&CK threat group or software entry by ID, name, or keyword. Results include ATT&CK identity, aliases, type, description, and associated techniques with procedure-level context from public ATT&CK reporting.
| Argument | Type | Description |
|---|---|---|
| query* | string | ATT&CK threat group ID (e.g., "G0007"), software ID (e.g., "S0002"), or name/keyword (e.g., "APT28", "Mimikatz", "Lazarus Group"). ID lookup is exact and case-insensitive; name/keyword search returns the best match. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"query"
],
"properties": {
"query": {
"type": "string",
"description": "ATT&CK threat group ID (e.g., \"G0007\"), software ID (e.g., \"S0002\"), or name/keyword (e.g., \"APT28\", \"Mimikatz\", \"Lazarus Group\"). ID lookup is exact and case-insensitive; name/keyword search returns the best match."
}
},
"additionalProperties": false
}Look up a MITRE ATT&CK technique by exact ID or keyword. Results include tactics, platforms, description, detection data, public procedure examples, mitigations, related sub-techniques, and dataset version.
| Argument | Type | Description |
|---|---|---|
| query* | string | ATT&CK technique ID (e.g., "T1190", "T1059.001") or keyword describing the technique (e.g., "sql injection", "pass the hash", "web shell upload"). ID lookup is exact; keyword lookup returns the best match plus related techniques. |
| include_subtechniques | boolean | Include sub-techniques in the result. Set to false when only the parent technique summary is needed. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"query"
],
"properties": {
"query": {
"type": "string",
"description": "ATT&CK technique ID (e.g., \"T1190\", \"T1059.001\") or keyword describing the technique (e.g., \"sql injection\", \"pass the hash\", \"web shell upload\"). ID lookup is exact; keyword lookup returns the best match plus related techniques."
},
"include_subtechniques": {
"type": "boolean",
"default": true,
"description": "Include sub-techniques in the result. Set to false when only the parent technique summary is needed."
}
},
"additionalProperties": false
}Rank ATT&CK techniques and OWASP test cases against an authorized target profile of technology stack, exposed services, authentication type, and operating system. Results include profile-specific relevance, detection opportunities, mitigations, and associated methodology vectors.
| Argument | Type | Description |
|---|---|---|
| os | string | Target operating system. Narrows to OS-specific techniques. |
| limit | integer | Maximum number of techniques to return (1–50, default 15). Higher values give broader coverage; lower values focus on highest-relevance items. |
| stack | array | Technology stack components (e.g., ["Node.js", "Express", "PostgreSQL", "Redis"]). Each element matched against technique platform and procedure examples. |
| services | array | Exposed services and interfaces (e.g., ["REST API", "GraphQL", "file upload", "admin panel"]). Narrows technique relevance. |
| auth_type | string | Authentication mechanism in use. Surfaces auth-specific attack techniques. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"os": {
"enum": [
"linux",
"windows",
"macos",
"unknown"
],
"type": "string",
"description": "Target operating system. Narrows to OS-specific techniques."
},
"limit": {
"type": "integer",
"default": 15,
"maximum": 50,
"minimum": 1,
"description": "Maximum number of techniques to return (1–50, default 15). Higher values give broader coverage; lower values focus on highest-relevance items."
},
"stack": {
"type": "array",
"items": {
"type": "string",
"description": "A technology stack component."
},
"description": "Technology stack components (e.g., [\"Node.js\", \"Express\", \"PostgreSQL\", \"Redis\"]). Each element matched against technique platform and procedure examples."
},
"services": {
"type": "array",
"items": {
"type": "string",
"description": "An exposed service or interface."
},
"description": "Exposed services and interfaces (e.g., [\"REST API\", \"GraphQL\", \"file upload\", \"admin panel\"]). Narrows technique relevance."
},
"auth_type": {
"enum": [
"jwt",
"session_cookie",
"api_key",
"oauth2",
"basic_auth",
"ntlm",
"kerberos",
"none",
"unknown"
],
"type": "string",
"description": "Authentication mechanism in use. Surfaces auth-specific attack techniques."
}
},
"additionalProperties": false
}