Skip to main content
Glama
Sign In
PwnBridge

PwnBridge

Official
by 1mr0-tech
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Hybrid

whatweb_fingerprint

Fingerprint a target URL's web technologies, CMS, frameworks, server software, and plugin versions on a remote Kali machine via PwnBridge.

Instructions

Run WhatWeb web technology fingerprinting against a target URL on the remote Kali machine. Identifies web technologies, CMS, frameworks, server software, and plugin versions.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "url": "<url>"
    },
    "name": "whatweb_fingerprint"
  }
}

Input Schema

NameRequiredDescriptionDefault
urlYesTarget URL to fingerprint. Example: "http://target.example.com"
aggressionNoAggression level: 1=stealthy (single request), 2=unused, 3=aggressive (try many paths), 4=heavy. Default: 1

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.0

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It does add one genuinely useful fact – execution happens on a remote Kali machine – but it omits that this is a read-only reconnaissance probe, that it generates live requests to the target, and that the aggression parameter controls how noisy/detectable the scan is. Those are the traits an agent most needs before invoking it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, both earning their place: the first front-loads the verb, resource, and execution environment; the second lists the identification targets. No filler or repetition of the title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Parameters are fully documented in the schema, but there is no output schema, so the description should ideally say something about what is returned (report format, findings structure) and when this tool fits into a recon workflow. With no annotations and no output schema, the definition is adequate but leaves real gaps for an agent deciding among the scanning siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both params (url and aggression) are already documented in the schema, including the aggression level semantics. The description adds no parameter-level meaning beyond that, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Run WhatWeb web technology fingerprinting against a target URL") and enumerates what it identifies (technologies, CMS, frameworks, server software, plugin versions). This clearly separates it from vulnerability-adjacent siblings like nikto_scan or nmap_scan, though the description never names or contrasts those siblings explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description never states when to choose this tool over nmap_scan, nikto_scan, or gobuster_scan, nor any prerequisites or when-not-to-use conditions. An agent must infer that this is the passive fingerprinting option purely from the tool name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools