site
Server Details
Penetration Testing Cost: the site's own MCP server — enquiry (enquiry = a human handoff, not a...
- Status
- Healthy
- Uptime
- 99.8% over 42 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
TDQS
Scored across 3 tools
The three tools cover clearly distinct phases: enquiry_describe explains the process, enquiry_fields enumerates the form schema, and submit_enquiry performs the action. There is no realistic way to confuse one for another.
All names are snake_case and unified by the 'enquiry' domain term, but the pattern is slightly mixed: two are prefix-first (enquiry_describe, enquiry_fields) while the action tool inverts to verb_noun (submit_enquiry). Minor deviation, still highly readable.
Three tools is exactly the minimum needed to describe, enumerate fields for, and submit a single enquiry form. It is lean but the narrow scope (one form on one site) justifies it rather than feeling thin.
The discovery-to-submission lifecycle is fully covered, including a two-step consent/confirmation flow. A status-check tool is absent, but the described email-confirmation mechanism means agents have no dead end for the core task.
Available Tools
3 toolsenquiry_describeWhat you get: an ENQUIRY with a human (not a purchase, not a guaranteed quote)AInspect
Read first. States plainly what submit_enquiry does on Penetration Testing Cost: it starts an enquiry with human providers who quote directly. Nothing is bought, ordered or paid; no quote is guaranteed; it is free. Also returns who receives the details, the consent wording, and how the person confirms.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It transparently characterizes the tool as informational ('States plainly', 'Also returns') and discloses the key behavior of the underlying enquiry flow: nothing is bought, no quote is guaranteed, and it's free. It could have explicitly stated that calling this tool itself has no side effects, but the descriptive framing makes that sufficiently clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with 'Read first.' Every sentence adds value: it states what the tool does, what submit_enquiry does not do, and what the tool returns. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter describe tool with no output schema, this description is complete. It tells the agent when to use it, what it returns, and what the underlying submit_enquiry flow involves. Nothing an agent needs to correctly select and invoke the tool is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so schema description coverage is vacuously 100%. No parameter explanation is needed, and the description correctly focuses on behavior and return contents rather than parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: it 'States plainly what submit_enquiry does' on Penetration Testing Cost. It clearly positions this tool as a meta-description and distinguishes it from siblings like submit_enquiry and enquiry_fields.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Read first' explicitly tells the agent to consult this tool before using submit_enquiry, which is strong usage guidance. It doesn't explicitly name when-not-to-use or alternatives, but the ordering instruction combined with the behavioral explanation is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
enquiry_fieldsThe questions the enquiry asksAInspect
Every field of the Penetration Testing Cost enquiry: key, label, type, whether required, help text and the allowed options where there are any. Pass answers to submit_enquiry keyed by field key.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It transparently describes what the tool returns, including common field metadata and conditional allowed options, and implies a read-only inspection operation. It does not explicitly state 'read-only,' but the content makes the non-mutating nature clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with the key facts: what the tool returns, the exact attributes, and how the output relates to another tool. Every sentence adds value and nothing feels redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter listing tool with no output schema and no annotations, this description is largely complete: it names the resource, the fields returned, and the downstream submission workflow. The only minor gap is the lack of an explicit distinction from enquiry_describe.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has no parameters, so there is nothing to document. The description adds useful semantic context by explaining that field keys are meant to be used as submission keys for submit_enquiry, which goes beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool's purpose: returning every field of the Penetration Testing Cost enquiry, along with key, label, type, required flag, help text, and allowed options. It is specific enough to distinguish from submit_enquiry, though it does not explicitly contrast with the sibling enquiry_describe.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear usage context by stating that answers should be passed to submit_enquiry keyed by field key. It implies this tool should be used to retrieve the field structure before submission, but it does not state explicit conditions for when to choose this over enquiry_describe.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
submit_enquirySubmit an ENQUIRY to human providers (two steps; not a purchase)AInspect
Submits an enquiry to Penetration Testing Cost — NOT a purchase, NOT a guaranteed quote. Step 1: call with the answers (keyed by field key from enquiry_fields) and consent=true; it validates and returns a summary, the consent line and a confirmation token — show the person the summary and the consent line. Step 2: only if the person agrees, call again with the same answers, consent=true and the confirmation token; the enquiry is then submitted, and the person receives an email with a link they must click before any provider sees it. Consent means the person has read and agreed to: "Send my contact details to up to three Cyber Essentials and penetration testing providers, chosen by Penetration Testing Cost, who'll contact me directly. I'll be emailed each firm's name as my details go to it, and can stop any more firms getting them."
| Name | Required | Description | Default |
|---|---|---|---|
| answers | Yes | the person's answers, keyed by field key | |
| consent | Yes | true only when the person has agreed to: Send my contact details to up to three Cyber Essentials and penetration testing providers, chosen by Penetration Testing Cost, who'll contact me directly. I'll be emailed each firm's name as my details go to it, and can stop any more firms getting them. | |
| confirmation | No | the confirmation token from step 1, after the person has approved the summary |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it discloses that step 1 is a validate-and-summarize dry run returning a consent line and token, that step 2 triggers an email with a link the person must click before any provider sees the data, and that details go to up to three named-at-send firms the person can stop. What it omits is failure behaviour — what happens if validation fails, what step 1 returns on bad answers, and whether either call is idempotent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads purpose and the purchase/quote disclaimer, then walks the two steps in order. The main inefficiency is the full consent sentence being quoted verbatim in the description and again in the consent parameter's schema description, which is duplicated real estate rather than new information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a stateful two-call tool with a nested answers object and no output schema, the description supplies everything needed to call it correctly: the sequence, the required fields per step, the return of step 1, and the human-in-the-loop email verification that gates provider visibility.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (baseline 3), but the description adds real meaning beyond it: it ties 'answers' to field keys sourced from enquiry_fields, explains that the confirmation token comes specifically from step 1 and is only to be used after approval, and spells out what consent=true commits the person to.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (submits an enquiry to Penetration Testing Cost) and immediately bounds it with two negations — NOT a purchase, NOT a guaranteed quote — which an agent could easily confuse this with. It also names the sibling that supplies its input (enquiry_fields) so the tool's place in the workflow is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit two-step protocol with the exact condition that selects each step: step 1 with answers + consent=true, step 2 only 'if the person agrees'. It also names the prerequisite source for field keys (enquiry_fields), leaving nothing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
- Changed
submit_enquiry1 field changed- changed
Input schema / properties / consent / descriptionPrevious value: -"true only when the person has agreed to: Send my contact details to up to three relevant penetration testing providers, chosen by Penetration Testing Cost, who'll contact me directly. I'll be emailed each firm's name as my details go to it, and can stop any more firms getting them."New value: +"true only when the person has agreed to: Send my contact details to up to three Cyber Essentials and penetration testing providers, chosen by Penetration Testing Cost, who'll contact me directly. I'll be emailed each firm's name as my details go to it, and can stop any more firms getting them."
1 tool update
- Changed
submit_enquiry1 field changed- changed
Input schema / properties / consent / descriptionPrevious value: -"true only when the person has agreed to: Happy for my details to go to relevant penetration testing providers, who'll contact me directly."New value: +"true only when the person has agreed to: Send my contact details to up to three relevant penetration testing providers, chosen by Penetration Testing Cost, who'll contact me directly. I'll be emailed each firm's name as my details go to it, and can stop any more firms getting them."
3 tool updates
- First observed
enquiry_describe - First observed
enquiry_fields - First observed
submit_enquiry
Related MCP Connectors
Cyber Essentials Cost: the site's own MCP server — enquiry (enquiry = a human handoff, not a...
Cyber Insurance Cost: the site's own MCP server — enquiry (enquiry = a human handoff, not a...
Underpinning Costs: the site's own MCP server — enquiry (enquiry = a human handoff, not a...
Site Investigation Cost: the site's own MCP server — enquiry (enquiry = a human handoff, not a...
Related MCP Servers
AlicenseAqualityFmaintenanceA comprehensive security testing MCP server providing 51 tools for penetration testing, network forensics, memory analysis, and vulnerability assessment. It enables automated security audits and technical investigations across web applications, cloud environments, and network captures.51107 npm25MIT- AlicenseNot gradedqualityAmaintenanceEnables professional penetration testers to run reconnaissance, network and web scanning, content fuzzing, vulnerability templates, brute-force checks, SQLi extraction, traffic capture, and engagement report generation through MCP clients.68 npmGPL 3.0
- AlicenseNot gradedqualityAmaintenanceAutonomous pentests from one command: real security tools, working PoCs, and audit-ready reports, all driven via MCP.218 PyPI1,744MIT
- AlicenseNot gradedqualityCmaintenanceEnables authorized penetration testing through MCP, providing parallel reconnaissance, vulnerability scanning, attack path analysis, and self-contained HTML reporting with compliance tagging.MIT
Glama MCP Gateway
Add one secure layer between your agents and this server.