secureIT Sicherheits-Checks

Phishing-Selbsttest anfordern (Freigabe durch die Person nötig)

phishing_selbsttest_anfordern

Fordert den kostenlosen Phishing-Selbsttest für eine Person an. WICHTIG: Dieses Werkzeug startet noch NICHTS. Es schickt nur eine Bestätigungsmail; erst wenn die Person den Link darin selbst anklickt, laufen über drei Tage drei simulierte Phishing-Mails an ihre Adresse an. Fordern Sie das nur für die eigene Adresse des Nutzers an und holen Sie vorher dessen ausdrückliche Zustimmung ein. Die Motive wählt das System zufällig — sie sind nicht bestimmbar. Pro Domain ist ein Selbsttest je Stunde möglich.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "email": "<email>"
    },
    "name": "phishing_selbsttest_anfordern"
  }
}

Input Schema

Name	Required	Description	Default
`email`	Yes	Adresse der Person, die sich selbst testen möchte. Nur hierhin gehen die Testmails.

Schema Changelog

Changes observed during successful MCP inspections.

First observedOct 13, 2026

TDQS

A4.4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so well: it warns that nothing starts immediately, explains the confirmation-email handshake, the three simulated mails over three days, the randomized and non-selectable motives, and the per-domain hourly limit. This is exactly the behavioral context an agent needs before triggering an outbound-email action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The critical warning ('starts NOTHING') is front-loaded in capitals immediately after the one-line purpose. Every subsequent sentence adds a distinct constraint (consent, random motives, rate limit) with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema or annotations exist, yet the description covers the entire lifecycle: the request, the confirmation step, the multi-day delivery, the consent prerequisite, and the rate limit. Nothing needed to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema already documents the email field, so the baseline is 3. The description adds meaning beyond the schema by imposing the constraint that only the user's own address may be used and that consent must be obtained first, which changes how the parameter should be populated.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (anfordern) and resource (Phishing-Selbsttest) and clarifies the scope ('für eine Person'). It implicitly distinguishes itself from the status sibling by framing this as the request step, but never names phishing_selbsttest_status, so an agent must infer the companion tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete when-to-use constraints: only for the user's own address, explicit prior consent required, and a rate limit of one self-test per domain per hour. It does not name an alternative tool or state when NOT to use this one, but the operational conditions are unusually explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All secureIT Sicherheits-Checks tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?