Wpscan
wpscanWordPress Scan: WP version + author enum via REST (per-target)
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| q | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
wpscanWordPress Scan: WP version + author enum via REST (per-target)
| Name | Required | Description | Default |
|---|---|---|---|
| q | No |
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Changes observed during successful MCP inspections.
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must disclose behavioral traits. It mentions the method (via REST) but does not state whether the scan is passive or active, what network requests are made, potential side effects, or any safety implications. It also omits what happens if the target is not WordPress or if scanning fails. The description is too thin to convey the tool's runtime behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, highly concise and front-loaded with the core action 'WordPress Scan.' It wastes no words and communicates the primary purpose immediately. However, its brevity comes at the cost of missing critical details, so it is not ideal, but for conciseness alone it earns a strong score.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although an output schema exists, the description is insufficient for an agent to invoke the tool correctly. It does not explain the parameter, the exact operations, prerequisites, or error handling. Given the tool performs a network scan with potential side effects, the absence of annotations and minimal description leaves significant gaps in context. The description is adequate only if the agent has prior knowledge of WordPress scanning.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has one parameter 'q' with default '' and 0% description coverage. The description does not explain what 'q' represents, such as the target URL or domain. Since there is no parameter documentation in the schema, the description must clarify the input, but it fails to do so. An agent would have no clue what value to provide, making the tool nearly unusable without external knowledge.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as a WordPress scanner that retrieves the WP version and enumerates authors via REST. It specifies the resource (WordPress) and the operations performed, distinguishing it from siblings like wpplugin (plugin scanning) and tech (technology identification). The 'per-target' phrasing clarifies it operates on a single site, though it could be more explicit about the expected input.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention conditions for selection, exclusions, or related tools. The only hint is 'per-target,' implying it is for individual sites, but no comparison to wpplugin, waf, or tech is offered. An agent would not know if this is the right choice for a given task.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.