Generates WAF-specific bypass variants for Cloudflare, using techniques like Unicode normalization, HTTP parameter pollution, JSON nesting, case alternation, and whitespace alternatives to evade Cloudflare's Web Application Firewall.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@llm-toolkit Show me SQL injection payloads"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP server toolkit with payload library, WAF bypass generator, rate limiter, plugin system, and inter-MCP bridge for security testing.
Disclaimer: For authorized security testing only. Obtain written permission before testing any system you do not own. Unauthorized access is illegal.
80+ curated payloads across 8 vulnerability categories:
Category | File | Description |
XSS |
| Cross-site scripting vectors |
SQLi |
| SQL injection payloads |
SSRF |
| Server-side request forgery |
SSTI |
| Server-side template injection |
LFI |
| Local file inclusion |
XXE |
| XML external entity injection |
CMDi |
| Command injection |
NoSQLi |
| NoSQL injection |
Each payload entry includes metadata: id, name, payload, category, context, riskLevel, optional description, and tags.
Generates WAF-specific bypass variants with strategy tables per provider:
WAF | Techniques |
Cloudflare | Unicode normalization, HTTP parameter pollution, JSON nesting, case alternation, whitespace alternatives |
ModSecurity | MySQL version comments ( |
AWS WAF | Encoding chains (URL + Base64), regex evasion with character classes, deep JSON nesting, Unicode fullwidth, token breaker |
Generic | Case mutation, whitespace mutation, comment injection, URL/hex/base64/HTML entity encoding, token breaker, Unicode mutation |
Also includes payload type detection (XSS, SQLi, SSTI, XXE, SSRF, LFI, CMDi, NoSQLi) and bypass strategy suggestions.
Six mutation types that can be applied individually or chained:
Mutation | Description |
| Random case alternation per character |
| Replace spaces with |
| Insert SQL comments between characters ( |
| URL, hex, Base64, or HTML entity encoding |
| Split keywords at random positions with encoded delimiters |
| Fullwidth Unicode character substitution |
Token bucket implementation with configurable limits. Defaults to 20 requests per minute per client. Applied before every MCP tool execution.
Dynamic plugin loading from ~/.llm-toolkit/plugins.json. Plugins can register custom MCP tools, extend payload generation, or add new WAF strategies.
Connect to other MCP servers via stdio or in-memory transport. Call remote tools, list available tools, and disconnect. Enables chaining multiple MCP servers into a single workflow.
Link reference materials (articles, videos, PDFs, tweets) to vulnerability techniques. Validates URLs are reachable and fetches content for context.
Install and manage security testing tools:
Tool | Category | Description |
| Scanner | Fast vulnerability scanner based on templates |
| Recon | Subdomain discovery tool |
| Recon | Fast HTTP toolkit |
| Fuzzing | Fast web fuzzer |
| Recon | Next-gen crawling and spidering |
Auto-detects OS (macOS via Homebrew, Linux via Go install) and installs the correct package.
Related MCP server: my-mcp
Node.js 20+
npm
npm installnpm run dev # tsup watch mode
npm run typecheck # TypeScript type checking (strict mode)npm run build # tsup ESM output to dist/npm test # vitest run (48 tests)
npm run test:watch # vitest watch mode
npm run test:coverage # with coverageNo manual config editing needed. Run one of these commands:
# Development mode — uses tsx to run source directly
npm run setup:opencode
# Production mode — uses compiled dist/index.js
npm run setup:opencode:prodThe script:
Resolves the absolute path to this project
Reads (or creates) ~/.config/opencode/opencode.json
Adds/updates the llm-toolkit MCP entry automatically
Prints the resulting config block for verification
After setup, restart OpenCode. Tools will appear as llm-toolkit-{tool-name} — for example: llm-toolkit-get-payloads, llm-toolkit-bypass-waf, llm-toolkit-health.
If you prefer to edit config manually, add to ~/.config/opencode/opencode.json:
Development Mode (source)
{
"mcp": {
"llm-toolkit": {
"type": "local",
"command": ["npx", "tsx", "/absolute/path/to/llm-toolkit/src/server.ts"],
"cwd": "/absolute/path/to/llm-toolkit",
"enabled": true
}
}
}Production Mode (build)
{
"mcp": {
"llm-toolkit": {
"type": "local",
"command": ["node", "/absolute/path/to/llm-toolkit/dist/index.js"],
"cwd": "/absolute/path/to/llm-toolkit",
"enabled": true
}
}
}{
"mcpServers": {
"llm-toolkit": {
"command": "node",
"args": ["/absolute/path/to/llm-toolkit/dist/index.js"]
}
}
}Or use npx after publishing:
{
"mcpServers": {
"llm-toolkit": {
"command": "npx",
"args": ["llm-toolkit"]
}
}
}Tool | Description |
| Fetch payloads from a JSON file with optional filters (category, context, riskLevel) |
| Generate payload variants with mutations |
| Generate WAF-specific bypass variants |
| Analyze a payload to detect attack type and suggest bypass strategies |
| Encode data (url, doubleUrl, hex, base64, htmlEntity, unicode) |
| Decode data (url, hex, base64, htmlEntity, unicode, jwt) |
| Create JWT tokens with optional secret and algorithm |
| Fetch content from a URL reference |
| Validate that a content reference URL is reachable |
| Connect to another MCP server via stdio transport |
| Call a tool on a connected MCP server |
| List tools available on a connected MCP server |
| Disconnect from an MCP server |
| List all connected MCP servers |
Fetch XSS payloads filtered by risk level:
{
"name": "get-payloads",
"arguments": {
"filepath": "payloads/xss.json",
"filters": { "riskLevel": "high" }
}
}Generate payload variants with chained mutations:
{
"name": "generate-payload",
"arguments": {
"payload": "<script>alert(1)</script>",
"options": {
"mutations": ["caseMutation", "whitespaceMutation", "commentMutation"],
"chainMutations": true,
"encoding": "url"
}
}
}Generate Cloudflare bypass variants:
{
"name": "bypass-waf",
"arguments": {
"payload": "' OR 1=1 --",
"wafType": "cloudflare"
}
}Analyze a payload:
{
"name": "analyze-payload",
"arguments": {
"payload": "{{7*7}}"
}
}Connect to another MCP server and call a tool:
{
"name": "connect-mcp",
"arguments": {
"command": "npx",
"args": ["-y", "@some/mcp-server"],
"name": "remote-server"
}
}# List available security tools
llm-toolkit list
# Install a specific tool
llm-toolkit install nuclei
llm-toolkit install subfinder
llm-toolkit install httpx
llm-toolkit install ffuf
llm-toolkit install katana
# Check what's installed
llm-toolkit status
# Uninstall a tool
llm-toolkit uninstall nuclei
# Start MCP server directly
llm-toolkit
# or
node dist/cli.jsllm-toolkit/
├── src/
│ ├── index.ts # Package entry point, exports
│ ├── server.ts # Core MCP server, StreamableHTTP transport
│ ├── cli.ts # CLI installer (nuclei, subfinder, etc.)
│ ├── encoding.ts # Encode/decode utils (URL, hex, base64, HTML, Unicode, JWT)
│ ├── rate-limiter.ts # Token bucket per client (20 req/min default)
│ ├── generator.ts # Payload variant generator (6 mutation types)
│ ├── waf-bypass.ts # WAF-specific bypass engine (CF, ModSec, AWS, Generic)
│ ├── plugin-manager.ts # Dynamic plugin loading from ~/.llm-toolkit/plugins.json
│ ├── inter-mcp.ts # Bridge to other MCP servers (StdioClientTransport)
│ ├── content-fetcher.ts # Fetch/validate content references (articles, videos, PDFs)
│ └── tools/
│ └── index.ts # MCP tool handlers (14 tools registered)
├── payloads/
│ ├── xss.json # XSS payloads
│ ├── sqli.json # SQLi payloads
│ ├── ssrf.json # SSRF payloads
│ ├── ssti.json # SSTI payloads
│ ├── lfi.json # LFI payloads
│ ├── xxe.json # XXE payloads
│ ├── cmdi.json # Command injection payloads
│ └── nosqli.json # NoSQLi payloads
├── tests/ # Vitest test suite (48 tests)
├── scripts/ # Build and utility scripts
├── dist/ # tsup build output
│ ├── index.js # ESM library entry
│ └── cli.js # CLI binary entry
├── package.json
├── tsconfig.json
└── tsup.config.tsEach payload file is a JSON array of entries:
[
{
"id": "xss-001",
"name": "Basic script tag",
"payload": "<script>alert('XSS')</script>",
"category": "xss",
"context": "unescaped HTML output",
"riskLevel": "high",
"description": "Standard script tag injection for reflected XSS",
"tags": ["reflected", "script-tag", "alert"]
}
]Field | Type | Required | Description |
| string | Yes | Unique identifier |
| string | Yes | Human-readable name |
| string | Yes | The actual payload string |
| string | Yes | Vulnerability category |
| string | Yes | Where this payload applies |
| string | Yes |
|
| string | No | Explanation of the payload |
| string[] | No | Classification tags |
Create a JSON file in payloads/ following the schema above. Load it via get-payloads with the file path.
Edit src/generator.ts:
Add a new mutation function: export function myMutation(str: string): string { ... }
Add the type name to the MutationType union
Register it in the mutationFn record
Edit src/waf-bypass.ts:
Create a BypassStrategy[] array for your WAF
Add it to the WAF_STRATEGIES record with a WafType key
Create ~/.llm-toolkit/plugins.json:
[
{
"name": "my-plugin",
"path": "/path/to/plugin.js",
"enabled": true
}
]Plugins export an object with a register(server: McpServer) method to add custom tools.
Runtime: Node.js 20+, ESM module
Language: TypeScript (strict mode)
Build: tsup (outputs ESM to dist/)
Test: Vitest (48 tests)
MCP SDK: @modelcontextprotocol/sdk ^1.25.0
Validation: Zod ^3.25.0
npm install # Install dependencies
npm run build # Build with tsup
npm run dev # Watch mode rebuild
npm run typecheck # Type check (strict mode)
npm test # Run test suite
npm run test:watch # Watch mode tests
npm run test:coverage # Run with coverage
npm start # Start MCP serverAll source in src/, compiled to dist/
Payload JSON files in payloads/
Tests colocated in tests/
Main entry: dist/index.js
CLI binary: llm-toolkit resolves to dist/cli.js
Payloads are for authorized testing only
Rate limiter prevents abuse (20 req/min default, configurable)
No secrets or credentials stored in the toolkit
Plugin loading restricted to user-controlled config at ~/.llm-toolkit/plugins.json
All tool inputs validated with Zod schemas
MIT
Fork the repository
Create a feature branch (git checkout -b feature/my-feature)
Make your changes
Run the test suite (npm test)
Ensure type checking passes (npm run typecheck)
Commit with a descriptive message
Push to your fork and open a Pull Request
Keep payloads focused on practical, tested vectors
Write tests for new mutations or WAF strategies
Follow existing TypeScript strict patterns
No any types without justification
Keep tool handlers under 30 lines where possible
Analyze a payload to detect attack type and suggest bypass strategies
| Name | Required | Description | Default |
|---|---|---|---|
| payload | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears full responsibility for behavioral disclosure. It states the tool analyzes and suggests, but does not disclose internal behavior, return values, side effects, or any prerequisites. This is minimal transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise, but given the need for more detail (especially on behavior and parameters), it is not optimally structured. It is adequate but lacks essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, no annotations, and only one parameter. The description does not explain what the tool returns (e.g., attack type, strategies) or provide enough context for correct invocation and interpretation of results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% coverage (no descriptions on the 'payload' parameter). The description only restates the parameter name, adding no additional meaning about format, encoding, constraints, or expected input characteristics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool analyzes a payload to detect attack type and suggest bypass strategies. It uses a specific verb and resource, and distinguishes from siblings like 'generate-payload' and 'bypass-waf'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when a user wants to analyze a payload for attack type and bypass strategies, but it provides no explicit guidance on when to use this tool versus alternatives, or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Generate WAF-specific bypass variants for a payload (cloudflare, modsecurity, aws-waf, generic)
| Name | Required | Description | Default |
|---|---|---|---|
| payload | Yes | ||
| wafType | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description must disclose all behavioral traits. It only states the tool generates bypass variants, omitting information about whether it is destructive, requires special permissions, or has rate limits. The agent gains little actionable insight beyond the basic function.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that front-loads the key action and resource. Every word provides value, with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple (two parameters, no output schema), but the description fails to cover essential context: return value format, relationship to sibling tools, or any side effects. It leaves the agent unprepared to interpret results or choose this tool appropriately.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It lists the WAF types (which match the enum) but does not explain the 'payload' parameter's expected format, constraints, or how it relates to the WAF types. The addition is minimal and insufficient for an agent to use parameters correctly without guessing.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool generates WAF-specific bypass variants for a payload and lists the supported WAF types (cloudflare, modsecurity, aws-waf, generic). This provides a specific verb-resource pairing, but it does not differentiate from the sibling tool 'generate-payload', which might serve a similar purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as 'generate-payload' or 'analyze-payload'. The description does not include context about prerequisites, expected scenarios, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Call a tool on a connected MCP server
| Name | Required | Description | Default |
|---|---|---|---|
| serverId | Yes | ||
| toolName | Yes | ||
| arguments | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and description does not disclose behavioral traits such as whether the tool is destructive, requires authentication, or has side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence is concise but lacking substance; it is not front-loaded with essential details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Description is inadequate for a tool that invokes another tool—missing information about server connection requirement, error handling, and argument structure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% description coverage, and the description adds no meaning to any parameter. 'arguments' as an open object is unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool calls a tool on an MCP server. It is specific but does not differentiate from siblings like 'list-mcp-tools' or 'connect-mcp'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, nor any prerequisites (e.g., server must be connected).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Connect to another MCP server via stdio transport
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | ||
| args | No | ||
| name | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description only mentions 'via stdio transport', missing disclosure of side effects, permissions, or failure behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence with no filler words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, no annotations, and no parameter descriptions, the description is insufficient to fully understand tool usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds no information about the three parameters (command, args, name) beyond the schema, which has 0% coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Connect' and specifies the resource 'another MCP server' and transport method 'stdio transport', clearly distinguishing from siblings like 'disconnect-mcp'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage (connecting to a server) but provides no explicit guidance on when to use this tool vs alternatives or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Decode data using various methods (url, hex, base64, htmlEntity, unicode, jwt)
| Name | Required | Description | Default |
|---|---|---|---|
| data | Yes | ||
| method | Yes | ||
| variant | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full responsibility for behavioral disclosure. It fails to mention any behavioral traits such as read-only status, error handling (e.g., invalid input), or side effects. The description only states the action, omitting safety or operational context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise at one sentence, but it is too brief to cover the necessary information. It front-loads the purpose but sacrifices completeness. Every sentence should earn its place; here, the single sentence could be expanded without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of 3 parameters (including an unexplained 'variant') and no output schema, the description is incomplete. It does not explain what the tool returns, how the variant affects decoding, or any limitations. The minimal description leaves significant gaps for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It lists the possible methods but does not explain the 'data' parameter beyond context, and the 'variant' parameter is entirely undocumented. The description adds minimal meaning beyond the enum values already in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'decode' and the resource 'data' using various methods, listing them explicitly. It distinguishes from the sibling 'encode' tool by name and action. However, it does not explicitly position itself as the decoding counterpart, missing a slight opportunity for clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'encode' or 'jwt-encode'. It does not mention prerequisites, when-not-to-use, or any context for selection, leaving the agent to infer usage solely from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Disconnect from an MCP server
| Name | Required | Description | Default |
|---|---|---|---|
| serverId | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fails to disclose behavioral traits like side effects (e.g., terminating the connection), required permissions, or server state changes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Though short, it is under-specified; the single sentence lacks essential detail, making it insufficiently informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of output schema and behavioral details, the description is incomplete for a tool with one parameter and no guidance on usage context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage for the single parameter 'serverId', and the description adds no meaning, leaving ambiguity about what serverId refers to.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Disconnect' and resource 'MCP server', clearly indicating the action. It differentiates from sibling 'connect-mcp' effectively.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, such as when to disconnect before reconnecting or managing multiple connections.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Encode data using various methods (url, doubleUrl, hex, base64, htmlEntity, unicode)
| Name | Required | Description | Default |
|---|---|---|---|
| data | Yes | ||
| method | Yes | ||
| variant | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavior. It states the action but omits important traits like error handling, output format, or side effects (e.g., is it safe? destructive?). The minimal text leaves the agent guessing about invocation behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that is front-loaded with the core purpose. It efficiently communicates the tool's role, though it could include more detail without becoming verbose. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given three parameters, no output schema, and no annotations, the description is insufficient. It does not explain return values, behavior across methods, or constraints like valid input formats. A more complete description is needed for accurate tool usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description should explain parameters. It mentions the 'method' enum implicitly by listing values but does not describe 'data' or the optional 'variant' parameter at all. The schema provides enums, but the description adds no additional meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action (encode data) and lists the supported methods, making it easy to understand its core function. However, it does not explicitly distinguish from the sibling 'decode' tool, but the naming and description suffice.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like 'jwt-encode' or 'decode'. There is no mention of prerequisites or context for choosing methods, leaving the agent without decision support.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Fetch content from a URL reference (article, video, pdf, tweet)
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description should disclose behavioral traits. It only says 'fetch content' but doesn't specify whether full content or metadata is returned, authentication needs, rate limits, or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that immediately conveys the tool's purpose, with no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple tool with one parameter and no output schema, the description should at least hint at return values or behavior. It fails to mention what the tool returns (e.g., text content, metadata) or any limitations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description adds context by listing example content types (article, video, pdf, tweet). However, it doesn't elaborate on URL format or constraints beyond the schema's 'uri' type.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool fetches content from a URL reference and lists example types (article, video, pdf, tweet), distinguishing it from sibling tools like validate-reference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like analyze-payload or validate-reference. The description does not mention prerequisites, limitations, or scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Generate payload variants with mutations (case, whitespace, comment, encoding, tokenBreaker, unicode)
| Name | Required | Description | Default |
|---|---|---|---|
| payload | Yes | ||
| options | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description lacks behavioral details such as side effects, return format, or mutation order. The minimal one-liner does not compensate for the lack of structured metadata.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise (one sentence) and front-loaded. It avoids fluff but could benefit from a more structured format.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has complex parameters and no output schema, yet the description does not explain the output format, mutation application order, or behavior. This is insufficient completeness for a payload generation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description lists mutation types, partially covering the enum values in the schema. However, it does not explain each mutation's effect or the options like encoding and chainMutations, so meaning beyond the schema is limited.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Generate payload variants with mutations.' It lists specific mutation types, distinguishing it from sibling tools like encode or analyze-payload.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like encode or bypass-waf. No context for selection is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Fetch payloads from a JSON file with optional filters (category, context, riskLevel)
| Name | Required | Description | Default |
|---|---|---|---|
| filepath | Yes | ||
| filters | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behaviors. It states 'Fetch' implying a read operation, but lacks details on safety, side effects, or error conditions. The minimal description does not adequately inform about potential risks or guarantees.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of 13 words, containing only relevant information. It is appropriately sized and front-loaded with the verb and resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations and output schema, the description is insufficient. It does not explain return format, error behavior, or provide enough context for a user to understand the tool's full functionality, especially with several related sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain parameters. It only lists the filter names 'category, context, riskLevel' without describing their semantics, valid values, or how they affect the fetch. The required 'filepath' parameter is not described at all.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Fetch' and resource 'payloads from a JSON file', and mentions optional filters. It distinguishes itself from sibling tools like 'generate-payload' (creation) and 'analyze-payload' (analysis) by indicating it is a retrieval operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. The description only implies usage for fetching filtered payloads but does not provide context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Returns server health status
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden but only states it returns health status. It does not disclose whether it is read-only, what side effects exist, or what the return value contains.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no wasted words, perfectly sized for the tool's simplicity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema is provided, and the description does not explain the format of the returned health status. For a tool with no other documentation, this is incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so baseline is 4. The description does not need to add parameter info.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns server health status, which is specific and distinct from sibling tools like analyze-payload or encode.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. For a health check, usage is implied, but explicit context is missing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Encode a JWT token with payload, optional secret and algorithm
| Name | Required | Description | Default |
|---|---|---|---|
| payload | Yes | ||
| secret | No | ||
| alg | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must disclose behavioral traits. It only states the basic operation, but does not mention output format, potential errors, default algorithm behavior, or security implications.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence, front-loading the key purpose. However, it omits important details, making it slightly under-specified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 3 parameters, no output schema, and no annotations, the description is insufficient. It does not explain the return value, error handling, or edge cases like missing secret.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate but only lists parameter names and implies optionality. It does not explain the payload structure, algorithm allowed values, or secret requirements.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Encode') and resource ('JWT token'), and mentions key arguments (payload, secret, algorithm). It clearly distinguishes from siblings like 'decode' and the generic 'encode' tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide any guidance on when to use this tool versus alternatives, nor does it mention prerequisites, exclusions, or typical use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Returns all available payload categories
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description should disclose behavioral traits. It only states it returns categories, implying a read operation, but does not mention any other behavioral aspects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded, and no wasted words. Highly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is minimal and does not hint at the return format or values. Given the lack of output schema, additional context about the categories would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and schema description coverage is 100%. According to the rubric, 0 params yields a baseline of 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns a list of payload categories. It uses a specific verb and resource, and it distinguishes from siblings like 'get-payloads' which returns payloads.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. While it is a simple list, the description does not mention context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List all connected MCP servers
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden but only states it lists servers. It doesn't disclose safety (e.g., read-only), authentication needs, or what happens on failure. Minimal behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that immediately communicates the tool's action. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters and no output schema, the description is minimally viable. However, it doesn't explain what information is returned about each server, which could be important for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters in the input schema, so the description's lack of parameter details is acceptable. Baseline score of 4 is appropriate as the schema coverage is 100%.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'List' and the resource 'all connected MCP servers', making the tool's purpose unambiguous. It distinguishes itself from sibling tools like connect-mcp and disconnect-mcp.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives or any prerequisites. For instance, it doesn't mention that it should be used to view connections before connecting or disconnecting.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List tools available on a connected MCP server
| Name | Required | Description | Default |
|---|---|---|---|
| serverId | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden but only states the basic function. It does not disclose whether the tool is read-only, requires prior connection, or any other behavioral traits such as error handling or permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no redundancy. It could be slightly improved by front-loading the purpose, but overall it is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with one parameter and no output schema, the description covers the core function. However, it omits preconditions like the server must be connected, and does not clarify what 'available' means or what the output format is.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds context that the 'serverId' parameter identifies a connected server, which is not explained in the schema (0% coverage). However, it does not elaborate on valid values, format, or any constraints beyond the schema's 'string' type.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'list' and clearly identifies the resource as 'tools available on a connected MCP server'. This distinguishes it from sibling tools like 'call-mcp-tool' (which calls a tool) and 'list-connected-servers' (which lists servers).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage after connecting to an MCP server but provides no explicit guidance on when to use this tool versus alternatives, nor any exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Validate that a content reference URL is reachable
| Name | Required | Description | Default |
|---|---|---|---|
| reference | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description must fully disclose behavioral traits. It only says 'validate ... reachable' without explaining how (e.g., HTTP request, timeout, redirect handling, error responses). Lacks essential context for safe invocation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence is front-loaded and concise, but critically underspecified. While brevity is valued, the description omits essential details, making it insufficient for proper tool use.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (nested object parameter, no output schema, no annotations), the description is far from complete. No information on return value, success/failure indicators, or error conditions. Agent cannot predict behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and description adds no meaning to the 'reference' parameter. The parameter is a nested object with required fields but no explanation of their roles (e.g., what 'type' values imply, URL format expectations). Agent cannot infer correct usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool validates that a content reference URL is reachable, with a specific verb and resource. It uniquely identifies the tool's function among siblings like 'fetch-reference', which likely fetches content rather than checking reachability.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives (e.g., 'fetch-reference'). The description does not mention conditions, prerequisites, or scenarios where validation is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0analyze-payloadbypass-wafcall-mcp-toolconnect-mcpdecodedisconnect-mcpencodefetch-referencegenerate-payloadget-payloadshealthjwt-encodelist-categorieslist-connected-serverslist-mcp-toolsvalidate-referenceScored across 16 tools
Each tool has a distinct purpose without overlap. analyze-payload and generate-payload are clearly different (analysis vs generation), and all other tools target unique actions or resources.
Most tools follow a verb-noun hyphenated pattern (analyze-payload, bypass-waf, etc.). The only outlier is 'health' which is a simple noun, but it's minor and the pattern is otherwise consistent.
16 tools is on the high side but still reasonable for a toolkit covering security analysis, encoding, MCP management, and reference fetching. Each tool serves a specific function, so the count is appropriate.
The tool set covers core functionalities for the stated domain: payload analysis, encoding, WAF bypass, MCP server management, and reference validation. Minor gaps like missing payload editing are acceptable for a toolkit.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Free MCP server: 32 security & developer API tools -- WHOIS, DNS, CVE checks, IP reputation.
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
Self-hosted MCP server: 26 deterministic dev, security, and EVM tools.
