MCP Server Pentest

by 9olidity

Overview Schema Related Servers Score Discussions

JavaScript

Local

Server Quality Checklist

Profile completionA complete profile improves this server's visibility in search results.

Latest release: v1.0.0
Disambiguation4/5
Most tools have distinct purposes focused on browser automation and security testing, with clear separation between navigation, interaction, and vulnerability checks. However, there is some overlap between browser_click/browser_click_text and browser_hover/browser_hover_text, which could cause minor confusion as they perform similar actions but differ only in the method of element selection (CSS selector vs. text content).
Naming Consistency5/5
All tools follow a consistent snake_case naming pattern with a clear 'browser_' prefix for automation tools and 'browser_url_' for vulnerability tests. The naming is highly predictable, using verb_noun structures like browser_navigate, browser_screenshot, and browser_url_reflected_xss, which enhances readability and agent usability.
Tool Count5/5
With 12 tools, the count is well-scoped for a penetration testing server, covering essential browser interactions and key security tests. Each tool earns its place by addressing specific needs in web application testing, such as navigation, element interaction, and vulnerability detection, without being overly bloated or sparse.
Completeness4/5
The toolset provides good coverage for browser-based penetration testing, including navigation, user interactions, and common vulnerability checks like XSS and SQL injection. A minor gap exists in the lack of tools for other common vulnerabilities (e.g., CSRF, command injection) or advanced testing features like network traffic analysis, but core workflows are adequately supported.
Average 2.9/5 across 12 of 12 tools scored.
See the Tool Scores section below for per-tool breakdowns.
- 0 of 1 community issues answered or closed in the last 6 months
- 0 commits in the last 12 weeks
- No stable releases found
- No critical vulnerability alerts
- No high-severity vulnerability alerts
- No code scanning findings
- CI status not available
This repository is licensed under MIT License.
This repository includes a README.md file.
No tool usage detected in the last 30 days. Usage tracking helps demonstrate server value.
Tip: use the "Try in Browser" feature on the server page to seed initial usage.
Add a glama.json file to provide metadata about your server.
If you are the author, simply .
If the server belongs to an organization, first add glama.json to the root of your repository:
```
{
  "$schema": "https://glama.ai/mcp/schemas/server.json",
  "maintainers": [
    "your-github-username"
  ]
}
```
Then . Browse examples.
Add related servers to improve discoverability.

How to sync the server with GitHub?

Servers are automatically synced at least once per day, but you can also sync manually at any time to instantly update the server profile.

To manually sync the server, click the "Sync Server" button in the MCP server admin interface.

How is the quality score calculated?

The overall quality score combines two components: Tool Definition Quality (70%) and Server Coherence (30%).

Tool Definition Quality measures how well each tool describes itself to AI agents. Every tool is scored 1–5 across six dimensions: Purpose Clarity (25%), Usage Guidelines (20%), Behavioral Transparency (20%), Parameter Semantics (15%), Conciseness & Structure (10%), and Contextual Completeness (10%). The server-level definition quality score is calculated as 60% mean TDQS + 40% minimum TDQS, so a single poorly described tool pulls the score down.

Server Coherence evaluates how well the tools work together as a set, scoring four dimensions equally: Disambiguation (can agents tell tools apart?), Naming Consistency, Tool Count Appropriateness, and Completeness (are there gaps in the tool surface?).

Tiers are derived from the overall score: A (≥3.5), B (≥3.0), C (≥2.0), D (≥1.0), F (<1.0). B and above is considered passing.

Tool Scores

Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool tests for XSS vulnerabilities but doesn't explain how it behaves—e.g., whether it performs active scanning, returns detailed results, requires specific permissions, or has side effects like triggering alerts. This leaves critical operational details unclear for safe and effective use.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no wasted words, making it highly concise and front-loaded. It directly states the tool's purpose without unnecessary elaboration, which is efficient for quick understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of security testing, no annotations, no output schema, and low schema coverage, the description is incomplete. It doesn't cover behavioral aspects, parameter usage, or expected results, leaving significant gaps for an agent to understand how to invoke and interpret this tool effectively in context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description doesn't mention any parameters, while the input schema has 2 parameters with 50% coverage (only 'paramName' has a description). Since schema coverage is low, the description should compensate but doesn't, leaving 'url' and the usage of 'paramName' poorly explained. However, with 2 parameters total, the baseline isn't the lowest, but the lack of added semantic value keeps it at an adequate level.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose3/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Test whether the URL has an XSS vulnerability' clearly states the action (test) and target (URL for XSS vulnerability), making the purpose understandable. However, it doesn't differentiate from sibling tools like 'browser_url_sql_injection' which also tests URL vulnerabilities, leaving some ambiguity about when to choose this specific XSS test over other security tests.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing a browser session), exclusions, or compare it to siblings like 'browser_url_sql_injection' for SQL testing. This lack of context makes it harder for an agent to select the right tool in a given scenario.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. 'Fill out an input field' implies a mutation action but doesn't specify if it requires prior navigation, handles errors (e.g., invalid selectors), or has side effects like triggering events. This lacks critical details for safe and effective use in a browser automation context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with zero wasted words. It's front-loaded and directly states the action, making it highly concise and well-structured for quick comprehension.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of browser automation (mutating input fields) and the lack of annotations or output schema, the description is incomplete. It doesn't cover behavioral aspects like error handling, dependencies on other tools (e.g., 'browser_navigate'), or return values, leaving significant gaps for the agent to navigate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, with clear documentation for 'selector' and 'value'. The description adds no additional meaning beyond the schema, such as examples or constraints (e.g., selector syntax). Since the schema does the heavy lifting, the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose3/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Fill out an input field' states a clear verb ('Fill out') and resource ('input field'), making the basic purpose understandable. However, it doesn't distinguish this tool from potential alternatives or siblings like 'browser_select' or 'browser_click_text' that might also interact with input fields, leaving the scope somewhat vague.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing a browser session), exclusions (e.g., not for non-input elements), or comparisons to sibling tools like 'browser_click' for different interactions, leaving the agent to infer usage from context alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden but only states the basic action. It doesn't disclose behavioral traits such as whether navigation is synchronous/asynchronous, error handling, timeout behavior, or interaction with browser state, which are critical for a navigation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with a single sentence ('Navigate to a URL'), front-loaded and zero waste. Every word earns its place, making it efficient for quick understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (navigation in a browser context), lack of annotations, no output schema, and low schema coverage, the description is incomplete. It misses details on return values, error cases, and integration with sibling tools, making it inadequate for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate but adds no meaning beyond the schema. It doesn't explain the 'url' parameter's format, constraints, or examples, leaving the agent with only the schema's basic type information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Navigate') and target ('to a URL'), providing a specific verb+resource combination. However, it doesn't distinguish this from sibling tools like 'browser_url_reflected_xss' or 'browser_url_sql_injection' which also involve URL operations, missing explicit differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites, context for navigation, or compare it to sibling tools like 'browser_click' or 'browser_evaluate', leaving the agent with no usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the action but doesn't mention potential outcomes (e.g., page navigation, errors if selector fails), side effects, or safety considerations (e.g., could trigger JavaScript events). This leaves significant gaps for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with zero waste. It front-loads the core action ('click an element') and includes essential details ('on the page', 'using CSS selector') without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, the description is incomplete. It doesn't explain what happens after clicking (e.g., returns success/failure, navigates to new page) or error conditions. Given the complexity of browser interactions and lack of structured data, more behavioral context is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with the parameter 'selector' fully documented in the schema. The description adds minimal value by repeating 'CSS selector' but doesn't provide additional context like selector syntax examples or common pitfalls. Baseline 3 is appropriate as the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('click') and target ('element on the page'), and specifies the mechanism ('using CSS selector'). It distinguishes from siblings like browser_hover or browser_fill by focusing on clicking. However, it doesn't explicitly differentiate from browser_click_text which likely serves a similar purpose with different targeting.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like browser_click_text or browser_select. The description lacks context about prerequisites (e.g., requires a page to be loaded) or exclusions (e.g., not for non-clickable elements).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden but only states the basic action. It lacks details on behavioral traits such as error handling (e.g., if text isn't found), interaction effects (e.g., page navigation or state changes), performance considerations, or any side effects. This is inadequate for a mutation tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that directly conveys the core functionality without any fluff. It is appropriately sized and front-loaded, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's mutation nature (clicking implies interaction), lack of annotations, and no output schema, the description is insufficient. It doesn't cover expected outcomes, error cases, or how it integrates with sibling tools, leaving significant gaps for an AI agent to use it correctly in context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with the single parameter 'text' fully documented in the schema. The description adds no additional meaning beyond implying text content is used for element targeting, which aligns with the schema. Baseline 3 is appropriate as the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Click') and target ('an element on the page by its text content'), making the purpose immediately understandable. It distinguishes from generic 'browser_click' by specifying text-based targeting, though it doesn't explicitly contrast with 'browser_hover_text' or 'browser_select_text'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like 'browser_click' (for other selectors), 'browser_hover_text' (for hovering), or 'browser_select_text' (for selecting). The description implies usage for text-based clicking but offers no context on prerequisites, limitations, or sibling tool distinctions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure but offers minimal information. It states what the tool does but doesn't cover critical aspects like security implications (e.g., executing arbitrary JavaScript could be dangerous), execution context (e.g., runs in current page's console), error handling, or output format. For a tool that executes code, this lack of transparency is significant.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise—a single, clear sentence that communicates the core functionality without unnecessary words. It is front-loaded with the essential action and context, making it easy to parse. Every word earns its place, with no redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of executing JavaScript in a browser (a potentially powerful and risky operation), the description is incomplete. With no annotations and no output schema, it fails to address key contextual elements like safety warnings, execution environment details, or what the tool returns (e.g., console output, errors). This leaves significant gaps for an agent to use the tool effectively and safely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, with the 'script' parameter clearly documented as 'JavaScript code to execute'. The description adds no additional parameter semantics beyond what the schema provides, such as examples of valid scripts, constraints, or special syntax. However, with only one parameter fully covered by the schema, the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Execute JavaScript') and location ('in the browser console'), making the purpose immediately understandable. It distinguishes itself from sibling tools like browser_click or browser_navigate by focusing on code execution rather than UI interaction. However, it doesn't specify what browser context this applies to (e.g., current page, specific tab).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing an active browser session), appropriate use cases (e.g., debugging, automation), or when other tools like browser_navigate might be more suitable. The agent must infer usage from the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden but only states the basic action. It doesn't disclose behavioral traits like whether hovering triggers events, if it waits for element visibility, error handling for invalid selectors, or side effects like page changes. This leaves gaps in understanding the tool's operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that directly states the tool's purpose without unnecessary words. It is front-loaded and appropriately sized for a simple tool, with zero waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (a browser interaction with no annotations or output schema), the description is incomplete. It lacks details on behavior, error cases, and how it integrates with sibling tools, making it insufficient for an agent to use it effectively without additional context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, with the parameter 'selector' fully documented in the schema. The description adds minimal value by mentioning 'CSS selector' but doesn't provide additional semantics beyond what the schema already specifies, such as selector syntax examples or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('hover') and target ('element on the page'), specifying the method ('using CSS selector'). It distinguishes from some siblings like 'browser_click' but not from 'browser_hover_text', which suggests similar functionality with a different targeting method.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like 'browser_hover_text' or 'browser_click'. The description implies usage for hovering but lacks context on prerequisites, such as requiring a loaded page or element visibility.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the action but lacks details on what happens after hovering (e.g., whether it triggers events, waits for effects, or returns any feedback), potential errors (e.g., if text isn't found), or performance implications. This leaves significant gaps for a tool that interacts with a browser.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, direct sentence that efficiently conveys the core action without unnecessary words. It is front-loaded with the key information, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of browser interaction tools and the lack of annotations or output schema, the description is incomplete. It doesn't cover behavioral aspects like error handling, side effects, or what constitutes success, which are crucial for an agent to use the tool effectively in a dynamic environment like a browser.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the single parameter 'text' as 'Text content of the element to hover'. The description adds no additional meaning beyond this, such as explaining how text matching works (e.g., exact vs. partial, case sensitivity) or examples. Baseline 3 is appropriate when the schema handles parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('hover') and target ('an element on the page by its text content'), making the purpose immediately understandable. However, it doesn't explicitly differentiate from sibling tools like 'browser_hover' (which likely hovers by selector rather than text) or 'browser_click_text' (which clicks rather than hovers), missing full sibling distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. For example, it doesn't specify when to prefer 'browser_hover_text' over 'browser_hover' or 'browser_click_text', nor does it mention prerequisites like requiring the page to be loaded or the element to be visible.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states what the tool does but lacks critical behavioral details: it doesn't specify output format (e.g., image file, base64), error handling (e.g., what happens if selector isn't found), or side effects (e.g., whether it pauses page interaction). This leaves significant gaps for an agent to understand how to use it effectively.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with zero wasted words. It's front-loaded with the core action and target, making it easy to parse quickly. Every word earns its place by conveying essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (screenshot functionality with three parameters) and the absence of both annotations and an output schema, the description is incomplete. It fails to address key contextual aspects like what the tool returns, how errors are handled, or dependencies on other tools (e.g., browser_navigate). This makes it inadequate for safe and effective use by an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, so the schema already documents all parameters thoroughly. The description adds no additional meaning beyond what's in the schema—it doesn't explain parameter interactions (e.g., how selector and fullPage relate) or provide examples. This meets the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('take a screenshot') and the target ('current page or a specific element'), which is specific and unambiguous. However, it doesn't explicitly differentiate from sibling tools like browser_evaluate or browser_navigate, which serve different purposes but are also page-related operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing a page loaded first), exclusions, or comparisons to other screenshot-related tools that might not exist in the sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It mentions selecting an element but doesn't disclose behavioral traits like whether it requires the page to be loaded, if it waits for the element, what happens on failure, or if it triggers page changes. For a browser interaction tool with zero annotation coverage, this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, zero waste, front-loaded with the core action. Every word earns its place by specifying the element type and method, making it efficient and clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a browser interaction tool with no annotations and no output schema, the description is incomplete. It lacks details on behavior, error handling, return values, and differentiation from siblings. Given the complexity of browser automation and rich sibling set, more context is needed for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters (selector and value). The description adds that it's for 'Select tag' elements, which gives context for the selector parameter, but doesn't provide additional syntax or format details beyond what the schema provides. Baseline 3 is appropriate when schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Select an element') and resource ('on the page with Select tag'), specifying it's for dropdown/select elements. It distinguishes from siblings like browser_click or browser_select_text by focusing on selecting options within select elements, though it doesn't explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like browser_select_text or browser_click. The description implies usage for select elements but doesn't specify prerequisites, error conditions, or exclusions, leaving the agent to infer context from sibling names alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It mentions selecting by text content but doesn't disclose behavioral traits such as whether this triggers page events, requires the element to be visible, handles multiple matches, or what happens on failure. This is a significant gap for a browser interaction tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, straightforward sentence with no wasted words. It could be slightly more specific (e.g., 'HTML <select> element'), but it efficiently conveys the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a browser interaction tool with no annotations and no output schema, the description is incomplete. It doesn't explain what happens after selection (e.g., does it return success/failure, trigger events?), error conditions, or dependencies like requiring a page to be loaded. More context is needed for safe and effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters (text and value). The description adds minimal value beyond the schema by implying text is used to identify the element and value is what gets selected, but doesn't clarify the relationship between them or provide examples.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('select') and target ('element on the page with Select tag'), though it could be more specific about what 'Select tag' means (likely HTML <select> element). It distinguishes from siblings like browser_click or browser_select by focusing on text-based selection rather than clicking or generic selection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives like browser_select (which might select by other criteria) or browser_click_text. The description implies usage for selecting elements by text content, but lacks context on prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the tool tests for vulnerabilities but lacks details on how it performs the test (e.g., automated scanning, manual input), what the output looks like, potential side effects (e.g., whether it modifies the target), or error handling. This is inadequate for a security testing tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no wasted words. It is front-loaded and efficiently conveys the core purpose without unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of SQL injection testing, lack of annotations, no output schema, and incomplete parameter documentation, the description is insufficient. It does not explain what results to expect, how to interpret them, or any limitations, making it incomplete for effective tool use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%, with only 'paramName' having a description. The description adds no parameter-specific information beyond the tool's general purpose. It implies testing involves a URL and possibly a parameter, but does not clarify the role of 'paramName' or provide examples. Baseline 3 is appropriate as the schema covers half the parameters, but the description does not compensate for the gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Test whether the URL has SQL injection vulnerabilities.' It specifies the verb ('Test') and resource ('URL'), but does not explicitly differentiate it from sibling tools like 'broser_url_reflected_xss' (likely a typo for 'browser_url_reflected_xss'), which tests for a different vulnerability type.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites, context, or exclusions, such as when to choose this over other vulnerability testing tools or general browser interaction tools in the sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

GitHub Badge

Glama performs regular codebase and documentation scans to:

Confirm that the MCP server is working as expected.
Confirm that there are no obvious security issues.
Evaluate tool definition quality.

Our badge communicates server capabilities, safety, and installation instructions.

Card Badge

Copy to your README.md:

[![MCP-Server-Pentest MCP server](https://glama.ai/mcp/servers/9olidity/MCP-Server-Pentest/badges/card.svg)](https://glama.ai/mcp/servers/9olidity/MCP-Server-Pentest)

Score Badge

Copy to your README.md:

[![MCP-Server-Pentest MCP server](https://glama.ai/mcp/servers/9olidity/MCP-Server-Pentest/badges/score.svg)](https://glama.ai/mcp/servers/9olidity/MCP-Server-Pentest)

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/9olidity/MCP-Server-Pentest'

If you have feedback or need assistance with the MCP directory API, please join our Discord server