MCP Server Pentest
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| browser_navigateC | Navigate to a URL |
| browser_screenshotB | Take a screenshot of the current page or a specific element |
| browser_clickB | Click an element on the page using CSS selector |
| broser_url_reflected_xssC | Test whether the URL has an XSS vulnerability |
| browser_click_textB | Click an element on the page by its text content |
| browser_fillB | Fill out an input field |
| browser_selectC | Select an element on the page with Select tag using CSS selector |
| browser_select_textC | Select an element on the page with Select tag by its text content |
| browser_hoverA | Hover an element on the page using CSS selector |
| browser_hover_textB | Hover an element on the page by its text content |
| browser_evaluateC | Execute JavaScript in the browser console |
| browser_url_sql_injectionC | Test whether the URL has SQL injection vulnerabilities |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| Browser console logs |
TDQS
Scored across 12 tools
Most tools have distinct purposes focused on browser automation and security testing, with clear separation between navigation, interaction, and vulnerability checks. However, there is some overlap between browser_click/browser_click_text and browser_hover/browser_hover_text, which could cause minor confusion as they perform similar actions but differ only in the method of element selection (CSS selector vs. text content).
All tools follow a consistent snake_case naming pattern with a clear 'browser_' prefix for automation tools and 'browser_url_' for vulnerability tests. The naming is highly predictable, using verb_noun structures like browser_navigate, browser_screenshot, and browser_url_reflected_xss, which enhances readability and agent usability.
With 12 tools, the count is well-scoped for a penetration testing server, covering essential browser interactions and key security tests. Each tool earns its place by addressing specific needs in web application testing, such as navigation, element interaction, and vulnerability detection, without being overly bloated or sparse.
The toolset provides good coverage for browser-based penetration testing, including navigation, user interactions, and common vulnerability checks like XSS and SQL injection. A minor gap exists in the lack of tools for other common vulnerabilities (e.g., CSRF, command injection) or advanced testing features like network traffic analysis, but core workflows are adequately supported.