Skip to main content
Glama
0day404

FOFA MCP

by 0day404
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

Server Configuration

Describes the environment variables required to run the server.

NameRequiredDescriptionDefault
FOFA_KEYYesFOFA API key. Required; at least fill FOFA_KEY in .env.
FOFA_ENV_FILENoPath to alternate credentials file. Absolute path used as-is; relative path resolved relative to project root. Process environment variables take precedence over .env file.
FOFA_MAX_PAGE_SIZENoLimits single response page size.
FOFA_MAX_CALL_SECONDSNoHard limit on total duration per call. Range 5-600.90
FOFA_MAX_TOTAL_RESULTSNoLimits cumulative total results for the entire service process.
FOFA_RETRY_BACKOFF_SECNoExponential backoff for retryable errors (rate limit/network), respects Retry-After header. Range 0-30.0.5
FOFA_MAX_ESTIMATED_FPOINTSNoLimits cumulative estimated F-points for the entire service process.
FOFA_MAX_REQUESTS_PER_SESSIONNoLimits cumulative requests per service process session.

Instructions

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

This server publishes no instructions, or was last inspected before Glama recorded them.

Capabilities

Features and capabilities supported by this server

Protocol revision2025-11-25

CapabilityDetails
tools
{
  "listChanged": false
}
prompts
{
  "listChanged": false
}
resources
{
  "subscribe": false,
  "listChanged": false
}
experimental
{}

Tools

Functions exposed to the LLM to take actions

NameDescription
fofa_searchA

Run one page of a complete FOFA DSL query.

Use this when the caller already has a FOFA DSL query. Use
fofa_search_structured instead when the caller has ordinary domain/IP/port
conditions. If the response has has_more=true and a next_token, call
fofa_search_next rather than repeating this search. Use fofa_stats only when
distribution analysis is needed, and fofa_host only for a selected asset.
This reads indexed data; it does not scan or probe targets.
fofa_search_structuredA

Build a FOFA query from common conditions and run one page.

Use this instead of manually composing DSL for domain, IP, port, host, body,
icon hash, ICP, or status code inputs. Continue only with fofa_search_next
when the result explicitly provides has_more=true and next_token.
fofa_search_nextA

Continue a FOFA cursor query using the previous response's next_token.

Call only when a prior search returned a next_token. Keep query, fields, and
full unchanged. Pass the returned token and increment cursor_page. Do not
call this repeatedly after next_token is empty. full=true may increase scope
or cost and requires confirm=true.
fofa_statsA

Return FOFA aggregation statistics for a query.

Call only when the caller needs distributions such as top titles, countries, ports, or products; do not call automatically after every search.

fofa_hostA

Get FOFA host aggregation for one selected IP or hostname.

Use after search identifies a priority asset; this is not a bulk replacement for search and should not be called for every result by default.

fofa_account_infoA

Get account quota information without exposing API keys.

Call when the user requests quota status, before a deliberately large task, or after a quota error. Do not call before every ordinary search.

fofa_healthA

Check local configuration without making a remote FOFA request.

Use at startup or for installation/configuration diagnosis; it does not consume FOFA quota.

Prompts

Interactive templates invoked by user choice

NameDescription

No prompts

Resources

Contextual data attached and managed by the client

NameDescription

No resources

Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A4/5.0

Scored across 7 tools

Disambiguation5/5

Each tool has a clearly distinct role, and the descriptions explicitly cross-reference when to use alternatives (search vs structured vs next, host vs stats). The search-family trio is well differentiated by intent and the cursor/token flow.

Naming Consistency5/5

All tools use the fofa_ prefix with consistent snake_case and predictable action suffixes (search, search_structured, search_next, host, stats, account_info, health). The pattern is uniform and readable throughout.

Tool Count5/5

Seven tools is well-scoped for a read-only FOFA search API, with each tool earning its place (query building, pagination, host detail, aggregation, account, health). No redundant or filler tools.

Completeness4/5

Covers the full lifecycle of a search service: query construction, pagination continuation, asset drill-down, stats, quota, and config health. Only minor gaps exist, such as bulk export/download, which agents can work around.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources