FOFA MCP
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@FOFA MCPsearch for exposed Jenkins servers in Germany"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
FOFA MCP
一个面向 Agent 的 FOFA MCP 服务。项目融合结构化查询、多账号限流切换、 自定义字段、传统分页,以及游标分页、统计、Host 详情和账户信息能力。
安装与启动
在项目根目录执行:
uv sync
Copy-Item .env.example .env
# 编辑 .env,至少填写 FOFA_KEY
uv run fofa-mcp也可以使用:
uv run python -m fofa_mcp两个入口都调用同一个 fofa_mcp.server.main(),启动行为和退出码保持一致。
项目内的 PowerShell、CMD 和 shell 脚本只调用主入口,不复制服务启动逻辑。
.env 默认位于本项目根目录,已被 .gitignore 排除。服务不会把 Key 写入
日志、错误、工具返回值或请求诊断信息。
如需使用其他凭据文件,可设置 FOFA_ENV_FILE。绝对路径按原路径读取,
相对路径相对于项目根目录解析,而不是相对于 Agent 当前工作目录。进程环境
变量优先于 .env 文件中的同名配置。
Agent 安装时应在本项目根目录执行 uv sync,并在启动前检查根目录
.env 是否存在及 FOFA_KEY 是否已填写。项目不读取其他 Agent 的配置文件,
也不会自动修改 Agent 的配置。
使用 scripts/start.ps1、scripts/start.cmd 或 scripts/start.sh 时,
脚本会先检查 uv 是否在 PATH 中;缺失时会返回非零退出码并提示安装及
uv sync。依赖由 uv run 检查,凭据缺失时只报告配置文件路径和修复命令,
不会输出 .env 内容。
启动脚本都会从脚本自身位置解析项目根目录,因此项目路径包含空格时仍可启动,
并且从其他当前工作目录调用也不会改变 .env 和依赖的定位。PowerShell、CMD
和 POSIX shell 脚本最终都调用 uv run fofa-mcp。
fofa_health 会检查本地配置文件、已配置账号数量、账号实时状态(可用/冷却/
最近错误,accounts_state)、预算限制和版本信息,不会调用 FOFA 远端 API。
错误响应会返回稳定的错误类型及 retryable 标识;malformed JSON、非对象响应
和字段数量错位不会被伪装成空结果。
诊断日志只写入 stderr,包含工具名、request_id、task_id、查询指纹、
账号标签、耗时和成本字段。日志不会记录完整查询、Key、认证 URL、Banner、
Header 或证书内容;stdout 保留给 MCP 协议。
Related MCP server: SurveyHub-MCP
版本与测试
fofa_health 返回四类版本:服务版本、工具 schema 版本、结果 schema 版本和
配置 schema 版本。工具参数有 schema 快照测试;FOFA API 的正常、空结果、限流、
认证失败、配额不足、字段错误和 malformed JSON 均使用本地 fixtures 测试,不依赖
真实 FOFA 请求。启动 smoke test 覆盖凭据缺失、备用 .env 和非项目工作目录。
MCP 工具
fofa_search:使用完整 FOFA DSL 进行普通搜索,支持字段和页码。fofa_search_structured:使用结构化条件生成 FOFA 查询。fofa_search_next:使用 FOFA 游标继续获取结果。fofa_stats:获取字段聚合统计。fofa_host:查询 IP 或域名的 Host 聚合信息。fofa_account_info:查询当前账号状态和配额。fofa_health:只检查本地配置,不调用远端 API。
服务只查询 FOFA 已有数据,不执行端口扫描、漏洞利用、爆破或主动探测。
普通搜索字段和 fofa_stats 聚合字段使用不同的校验规则。统计默认使用
title、country;不适用于聚合接口的原始内容字段(例如 banner)会被明确拒绝,
避免把搜索字段误当成统计维度。fofa_host 的目标继续使用独立 Host 输入校验。
搜索结果字段与返回数组长度不一致时会返回响应结构错误,不会静默截断或错位。
fofa_stats 返回统一的 field、value、count 数据项;fofa_host 支持
IPv4、IPv6 和主机名,并对 detail 响应施加大小上限。full=true 仅适用于
游标查询,默认关闭,显式启用时会返回风险和成本提示。
Agent 调用顺序
fofa_health
└─ 仅在启动或配置故障时调用
fofa_account_info
└─ 用户要求配额、开始大任务或发生配额错误时调用
fofa_search / fofa_search_structured
├─ has_more=true 且 next_token 存在 -> fofa_search_next
├─ 需要端口/国家/产品等分布 -> fofa_stats
└─ 发现重点 IP/域名 -> fofa_hostfofa_search 与 fofa_search_structured 是二选一。搜索工具每次只取一页;
只要仍有 next_token 且任务预算允许,编排层应继续分页,不得把第一页
当成完整收集。fofa_stats 和 fofa_host 不应在每次搜索后自动调用。
游标续查规则:fofa_search / fofa_search_structured 返回的 next_token
已在本服务进程内登记,可直接交给 fofa_search_next 并传
cursor_page = 上一页 page + 1。token 绑定 (task_id, query, fields, full),
四者任一变化都会被拒绝;token 只存在于服务进程内存,服务重启后旧 token
返回 pagination_error,应从头重新搜索。next 游标为空(has_more=false)
时不登记,续查应停止。
每次工具调用都会生成或接受安全格式的 request_id;结果和错误响应同时返回
request_id 与 task_id。fofa_health 不属于任务调用,因此其 task_id 为
null。关联标识不会包含 Key 或认证 URL。
安全与成本边界
full=true只用于明确请求的游标查询,可能扩大查询范围和消耗。size、游标页数、查询长度和统计数量均有本地上限。多账号只用于限流和可用性容灾,不绕过 FOFA 权限或平台限制。
当前账号网络重试耗尽后会切换到下一个已配置账号;结果中的
account.tried记录尝试过的账号标签。配额/F 点耗尽类错误立即停止重试并切换账号;所有账号都失败时抛出 最后一个真实错误(保留原始原因),不替换成笼统的失败消息。
可重试错误(限流/网络)按指数退避重试,尊重
Retry-After头; 可用FOFA_RETRY_BACKOFF_SEC(默认 0.5,0-30)与FOFA_MAX_CALL_SECONDS(默认 90,5-600)调节,单次调用总时长受后者 硬性约束。账户信息只返回必要状态和配额数据,Key、Token、密码等敏感字段会被移除, 邮箱等标识会脱敏。
日志写入 stderr,stdout 仅用于 MCP 协议。
设计约束
默认使用 stdio MCP,适配支持标准 MCP 的 Agent。
默认单页返回 100 条;单页大小不代表任务总量。FOFA 实际结果可能少于 请求的 100 条;只要存在后续结果, 编排层应继续分页,直到结果耗尽或达到明确的安全预算。
FOFA_MAX_PAGE_SIZE只限制单次响应;FOFA_MAX_TOTAL_RESULTS、FOFA_MAX_REQUESTS_PER_SESSION和FOFA_MAX_ESTIMATED_FPOINTS限制整个服务进程的累计调用规模。fofa_account_info是免费调用, 不消耗请求预算。HTTP 连接池在多次调用间复用,生命周期跟随服务进程(stdio 进程退出时 由操作系统回收);查询/游标/预算的进程内跟踪表有容量上限,超限淘汰 最旧条目,内存不随调用量无界增长。
多账号只用于可用性和限流容灾,不绕过 FOFA 权限或平台限制。
日志写入 stderr,stdout 仅用于 MCP 协议。
Available Tools
7 toolsfofa_account_infoA
Get account quota information without exposing API keys.
Call when the user requests quota status, before a deliberately large task, or after a quota error. Do not call before every ordinary search.
| Name | Required | Description | Default |
|---|---|---|---|
| task_id | No | default | |
| request_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full burden. It usefully discloses one behavioral trait — the response avoids exposing API keys — but says nothing about rate limits, auth requirements, or whether the call itself consumes quota. The safety disclosure is real but thin for a tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences: purpose first, then triggers, then the discouraging condition. Every sentence earns its place with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and the usage gating is thorough. The only real hole is the two undocumented parameters, which nothing in the description or schema clarifies.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description never mentions task_id or request_id, which default to 'default' and ''. An agent has no guidance on what these identifiers should contain or when to override the defaults, so the description fails to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource ('Get account quota information'), which is clearly distinct from the search/host/stats siblings. It does not explicitly say how it differs from fofa_stats or fofa_health, so an agent must infer the boundary from names alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit positive triggers (user requests quota status, before a deliberately large task, after a quota error) and an explicit negative ('Do not call before every ordinary search'). This is a textbook when-to-use / when-not-to-use statement with no inference required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fofa_healthA
Check local configuration without making a remote FOFA request.
Use at startup or for installation/configuration diagnosis; it does not consume FOFA quota.
| Name | Required | Description | Default |
|---|---|---|---|
| request_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses that the check is local-only, makes no remote call, and does not consume FOFA quota — the key behavioral traits for a health check. It stops short of mentioning configuration prerequisites (e.g., missing API keys) or error semantics, which would be the remaining behavioral gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, zero waste, with the core distinguishing constraint ('without making a remote FOFA request') front-loaded. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the description covers purpose, timing, and side effects adequately for a single-parameter diagnostic tool. The only omission is any note about configuration/auth prerequisites or what a failing health check implies.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one optional parameter (request_id) with 0% schema description coverage and no mention in the description. It is a trivial, optional tracing field with a default, so the practical impact is low, but the description adds no meaning beyond the schema's type declaration.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('check local configuration') and immediately scopes it with 'without making a remote FOFA request,' which cleanly separates it from the remote-call siblings (fofa_search, fofa_host, fofa_stats). An agent can distinguish this diagnostic tool from all siblings without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use triggers ('at startup or for installation/configuration diagnosis'), which is stronger than implied guidance. It does not name sibling alternatives or state when not to use it, but the 'no remote request' clause effectively frames the boundary against the search tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fofa_hostA
Get FOFA host aggregation for one selected IP or hostname.
Use after search identifies a priority asset; this is not a bulk replacement for search and should not be called for every result by default.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| detail | No | ||
| task_id | No | default | |
| request_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden and does add real context: it operates on a single host rather than in bulk. However, it says nothing about permissions, rate limits, or the cost of calling it, and the warning against per-result calls implies a constraint without explaining it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the primary action and followed by the scoping rule. No filler or redundancy; every phrase earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Because an output schema exists, return values need not be described, and the usage guidance is strong. The gap is parameter documentation: three of four params (detail, task_id, request_id) have zero coverage, leaving the agent guessing at invocation semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Four parameters with 0% schema description coverage, yet the description explains only 'host' implicitly via 'one selected IP or hostname'. The meaning of 'detail', 'task_id', and 'request_id' is left entirely undocumented in both schema and description, so it fails to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Get FOFA host aggregation') scoped to 'one selected IP or hostname', and explicitly distinguishes itself from the search family by rejecting bulk use. Clear enough to separate from fofa_search siblings, though it doesn't differentiate from the less-related fofa_stats.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use it ('after search identifies a priority asset') and when not to ('not a bulk replacement for search', 'should not be called for every result by default'). It names the alternative and the selecting condition, leaving nothing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fofa_searchA
Run one page of a complete FOFA DSL query.
Use this when the caller already has a FOFA DSL query. Use
fofa_search_structured instead when the caller has ordinary domain/IP/port
conditions. If the response has has_more=true and a next_token, call
fofa_search_next rather than repeating this search. Use fofa_stats only when
distribution analysis is needed, and fofa_host only for a selected asset.
This reads indexed data; it does not scan or probe targets.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| size | No | ||
| query | Yes | ||
| fields | No | ||
| format | No | standard | |
| confirm | No | ||
| task_id | No | default | |
| request_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It usefully discloses that this reads indexed data rather than scanning or probing targets, and reveals the pagination contract (has_more / next_token). It says nothing about authentication requirements, rate limits, or what the 'confirm' and 'task_id' parameters actually do, which leaves gaps for a tool with an undocumented 'confirm' flag.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action, then a sequence of short routing sentences that each carry distinct decision value. The only mild cost is that the routing list is long relative to the tool's single required parameter, but no sentence is pure filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value documentation is not required, yet the description still usefully surfaces the has_more/next_token continuation contract. The gap is parameter completeness: with 0% schema coverage on 8 parameters, an agent cannot tell what confirm, task_id, format, or fields control, so the definition is not fully self-sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 8 parameters, and the description clarifies only the meaning of 'query' (a FOFA DSL expression). Page, size, fields, format, confirm, task_id, and request_id are left entirely undocumented in both the schema and the description, including the potentially consequential 'confirm' boolean.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Run one page of a complete FOFA DSL query') and implicitly scopes it against siblings by naming the conditions under which each alternative applies. An agent can distinguish it from fofa_search_structured and fofa_search_next without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit routing: use this when a DSL query already exists, use fofa_search_structured for ordinary domain/IP/port conditions, chain to fofa_search_next when has_more=true and next_token is present, and reserve fofa_stats and fofa_host for their specific cases. Both when-to-use and when-not-to-use are covered with named alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fofa_search_nextA
Continue a FOFA cursor query using the previous response's next_token.
Call only when a prior search returned a next_token. Keep query, fields, and
full unchanged. Pass the returned token and increment cursor_page. Do not
call this repeatedly after next_token is empty. full=true may increase scope
or cost and requires confirm=true.
| Name | Required | Description | Default |
|---|---|---|---|
| full | No | ||
| size | No | ||
| query | Yes | ||
| fields | No | ||
| format | No | standard | |
| confirm | No | ||
| task_id | No | default | |
| next_token | No | ||
| request_id | No | ||
| cursor_page | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and discloses important behavior: cursor-state rules, parameter-preservation constraints, and that full=true may increase scope or cost and needs confirmation. It still omits auth requirements, rate limits, and token-expiry/error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose, then concise operational rules. Every sentence earns its place and nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. However, with no annotations and 0% input-schema coverage, the description should compensate more fully for a 10-parameter tool; four parameters remain undocumented.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 10 parameters. The description adds meaning for next_token, cursor_page, full, confirm, and says query/fields/full should remain unchanged, but leaves size, format, task_id, and request_id undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Continue'), resource ('FOFA cursor query'), and scope ('using the previous response's next_token'). This clearly distinguishes it from the initial search sibling fofa_search.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to call ('only when a prior search returned a next_token'), when not to call ('Do not call this repeatedly after next_token is empty'), and adds a prerequisite for full=true ('requires confirm=true').
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fofa_search_structuredA
Build a FOFA query from common conditions and run one page.
Use this instead of manually composing DSL for domain, IP, port, host, body,
icon hash, ICP, or status code inputs. Continue only with fofa_search_next
when the result explicitly provides has_more=true and next_token.
| Name | Required | Description | Default |
|---|---|---|---|
| ip | No | ||
| icp | No | ||
| body | No | ||
| host | No | ||
| page | No | ||
| port | No | ||
| size | No | ||
| domain | No | ||
| fields | No | ||
| format | No | standard | |
| confirm | No | ||
| task_id | No | default | |
| icon_hash | No | ||
| request_id | No | ||
| status_code | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full disclosure burden. It does surface the pagination contract (one page only, has_more/next_token handoff), which is genuinely useful. However, for a 15-param tool it says nothing about the 'confirm' gate, quota/cost, auth requirements, or what page/size/format do operationally.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences, front-loaded with the core action and followed by the routing rule. No filler; every clause carries load-bearing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be explained, and the routing/pagination story is complete. But with 15 undocumented parameters and no annotations, the description leaves the confirmation gate and operational controls (page, size, format, task_id) unaddressed for a tool this broad.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain parameters, and it does map eight conditions (domain, IP, port, host, body, icon hash, ICP, status code) to query-builder inputs. It adds no meaning for page, size, fields, format, confirm, task_id, or request_id, leaving nearly half the parameters opaque.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: build a FOFA query from structured conditions and run one page. It explicitly contrasts itself with the manual-DSL sibling (fofa_search) and the pagination sibling (fofa_search_next), so an agent can route without opening another schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use guidance ('Use this instead of manually composing DSL for domain, IP, port...') and a precise continuation condition ('Continue only with fofa_search_next when the result explicitly provides has_more=true and next_token'). Both the alternative and the triggering condition are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fofa_statsA
Return FOFA aggregation statistics for a query.
Call only when the caller needs distributions such as top titles, countries, ports, or products; do not call automatically after every search.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | ||
| top_n | No | ||
| fields | No | ||
| task_id | No | default | |
| request_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden, and it does disclose one useful trait: this is not a routine follow-up to every search, implying a cost/latency reason. However it says nothing about rate limits, quotas, credentials, or whether the query is a literal FOFA query string, so significant behavioral gaps remain.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, purpose first and the usage guardrail second, with no filler. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and the core purpose is covered. But for a 5-parameter tool with zero schema documentation, the description leaves the meaning of fields, top_n, task_id, and request_id (and the query string format) unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 5 parameters, so the description must compensate and largely does not. Only a passing hint at aggregatable dimensions ('top titles, countries, ports, or products') gestures at 'fields' or 'top_n'; task_id and request_id are entirely unexplained anywhere.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb and resource: 'Return FOFA aggregation statistics for a query.' This clearly distinguishes an aggregation tool from the search-oriented siblings (fofa_search, fofa_host), but it never names an alternative explicitly, so differentiation is inferred rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger ('only when the caller needs distributions such as top titles, countries, ports, or products') plus a clear exclusion ('do not call automatically after every search'). It stops short of naming a sibling tool for the alternative path, but the when/when-not conditions are unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v0.2.0- First observed
fofa_account_info - First observed
fofa_health - First observed
fofa_host - First observed
fofa_search - First observed
fofa_search_next - First observed
fofa_search_structured - First observed
fofa_stats
TDQS
Scored across 7 tools
Each tool has a clearly distinct role, and the descriptions explicitly cross-reference when to use alternatives (search vs structured vs next, host vs stats). The search-family trio is well differentiated by intent and the cursor/token flow.
All tools use the fofa_ prefix with consistent snake_case and predictable action suffixes (search, search_structured, search_next, host, stats, account_info, health). The pattern is uniform and readable throughout.
Seven tools is well-scoped for a read-only FOFA search API, with each tool earning its place (query building, pagination, host detail, aggregation, account, health). No redundant or filler tools.
Covers the full lifecycle of a search service: query construction, pagination continuation, asset drill-down, stats, quota, and config health. Only minor gaps exist, such as bulk export/download, which agents can work around.
Maintenance
Related MCP Connectors
Scoped agent execution. Server-side credentials, policy, budgets and verifiable receipts.
Read-only cited financial datasets, bounded research queries and source diagnostics.
Normalized official data with provenance, aggregations, insights, free samples and agent access.
Normalized official data with provenance, aggregations, insights, free samples and agent access.
Related MCP Servers
- FlicenseNot gradedqualityBmaintenanceMCP server for querying the FOFA API, enabling network asset search and account information retrieval.8-
- AlicenseBqualityBmaintenanceAggregates multiple cyberspace search engines (FOFA, Quake, Hunter, ZoomEye) into a unified MCP server, enabling asset search, pagination, statistics, and account info retrieval.2635 PyPIMIT

mlab.sh MCP serverofficial
AlicenseNot gradedqualityCmaintenanceEnables threat intelligence for SOC and DFIR workflows, including IOC enrichment, CVE and threat actor lookup, domain scanning, and account-based scan management.2MIT- AlicenseNot gradedqualityBmaintenanceEnables querying internet-wide scan data for hosts, services, and certificates through the Censys Platform API.19 npmMIT