MCP Pentest

Instructions

Implementation Reference

• src/engines/adaptive-strategy.ts:73-141 (handler)

  Core handler function that executes the adaptive_strategy tool logic: detects OS, profiles services, analyzes attack vectors, plans testing phases, identifies priority targets, and assesses risk based on input ports and technologies.
  async generateStrategy( ports: PortScanResult[], technologies: TechDetectionResult[], existingVulns?: VulnerabilityResult[], existingCVEs?: CVEResult[] ): Promise<ScanResult> { try { console.error('🧠 Generating adaptive penetration testing strategy...'); // Phase 1: OS Detection const osDetection = this.detectOperatingSystem(ports); console.error(` Detected OS: ${osDetection.os_family} (${osDetection.confidence}% confidence)`); // Phase 2: Service Profiling const serviceProfiles = this.profileServices(ports, osDetection); console.error(` Profiled ${serviceProfiles.length} services`); // Phase 3: Attack Vector Analysis const attackVectors = this.analyzeAttackVectors(ports, technologies, serviceProfiles, osDetection); console.error(` Identified ${attackVectors.length} attack vectors`); // Phase 4: Testing Phase Planning const testingPhases = this.planTestingPhases(attackVectors, serviceProfiles, technologies); console.error(` Planned ${testingPhases.length} testing phases`); // Phase 5: Priority Target Identification const priorityTargets = this.identifyPriorityTargets(serviceProfiles, technologies, existingVulns); console.error(` Identified ${priorityTargets.length} priority targets`); // Phase 6: Risk Assessment const riskAssessment = this.assessRisk(ports, technologies, attackVectors, existingVulns, existingCVEs); console.error(` Overall risk level: ${riskAssessment.overall_risk}`); const strategy: AdaptiveStrategy = { target: 'adaptive_strategy', os_detection: osDetection, service_profiles: serviceProfiles, technology_stack: technologies, attack_vectors: attackVectors, testing_phases: testingPhases, priority_targets: priorityTargets, risk_assessment: riskAssessment }; return { target: 'adaptive_strategy', timestamp: new Date().toISOString(), tool: 'adaptive_strategy_engine', results: { strategy, execution_plan: this.generateExecutionPlan(strategy), estimated_duration: this.calculateEstimatedDuration(testingPhases), resource_requirements: this.calculateResourceRequirements(testingPhases), success_metrics: this.defineSuccessMetrics(strategy) }, status: 'success' }; } catch (error) { return { target: 'adaptive_strategy', timestamp: new Date().toISOString(), tool: 'adaptive_strategy_engine', results: {}, status: 'error', error: error instanceof Error ? error.message : String(error) }; } }
• src/index.ts:341-364 (schema)

  Input schema definition for the adaptive_strategy tool, specifying required ports and technologies arrays.
  name: "adaptive_strategy", description: "Generate adaptive penetration testing strategy based on detected services and OS", inputSchema: { type: "object", properties: { ports: { type: "array", items: { type: "object" }, description: "Array of open ports and services" }, technologies: { type: "array", items: { type: "object" }, description: "Array of detected technologies" }, existing_vulns: { type: "array", items: { type: "object" }, description: "Array of existing vulnerabilities (optional)" } }, required: ["ports", "technologies"] } },
• src/index.ts:567-572 (registration)

  Tool call dispatch/registration in the main switch handler, invoking AdaptiveStrategyEngine.generateStrategy.
  case "adaptive_strategy": return respond(await this.adaptiveStrategy.generateStrategy( args.ports, args.technologies, args.existing_vulns ));
• src/index.ts:65-65 (registration)

  Instantiation of AdaptiveStrategyEngine used by the tool handler.
  this.adaptiveStrategy = new AdaptiveStrategyEngine();
• src/engines/adaptive-strategy.ts:143-256 (helper)

  Helper method for OS detection, key part of strategy generation.
  private detectOperatingSystem(ports: PortScanResult[]): OSDetectionResult { const evidence: string[] = []; let osFamily: 'windows' | 'linux' | 'unix' | 'mac' | 'unknown' = 'unknown'; let confidence = 0; let osVersion: string | undefined; // Windows indicators const windowsPorts = [135, 139, 445, 3389, 5985, 5986]; // RPC, NetBIOS, SMB, RDP, WinRM const windowsServices = ['microsoft-ds', 'msrpc', 'rdp', 'winrm']; const windowsPortsFound = ports.filter(p => windowsPorts.includes(p.port)); const windowsServicesFound = ports.filter(p => windowsServices.some(ws => p.service.toLowerCase().includes(ws)) ); if (windowsPortsFound.length > 0 || windowsServicesFound.length > 0) { osFamily = 'windows'; confidence += windowsPortsFound.length * 20 + windowsServicesFound.length * 25; if (windowsPortsFound.some(p => p.port === 445)) { evidence.push('SMB service detected (port 445)'); } if (windowsPortsFound.some(p => p.port === 3389)) { evidence.push('RDP service detected (port 3389)'); } if (windowsPortsFound.some(p => p.port === 135)) { evidence.push('RPC endpoint mapper detected (port 135)'); } // Try to detect Windows version from service versions const smbService = ports.find(p => p.port === 445); if (smbService?.version) { if (smbService.version.includes('Windows Server 2019')) { osVersion = 'Windows Server 2019'; } else if (smbService.version.includes('Windows Server 2016')) { osVersion = 'Windows Server 2016'; } else if (smbService.version.includes('Windows 10')) { osVersion = 'Windows 10'; } else if (smbService.version.includes('Windows Server 2012')) { osVersion = 'Windows Server 2012'; } } } // Linux indicators const linuxPorts = [22, 80, 443, 25, 53, 110, 143, 993, 995]; // SSH, HTTP, SMTP, DNS, POP3, IMAP const linuxServices = ['openssh', 'apache', 'nginx', 'postfix', 'dovecot', 'bind']; const linuxPortsFound = ports.filter(p => linuxPorts.includes(p.port)); const linuxServicesFound = ports.filter(p => linuxServices.some(ls => p.service.toLowerCase().includes(ls) || p.version?.toLowerCase().includes(ls)) ); if (linuxServicesFound.length > 0) { if (osFamily === 'unknown' || confidence < 50) { osFamily = 'linux'; confidence = linuxServicesFound.length * 15 + linuxPortsFound.length * 5; evidence.push('Linux services detected'); // Try to detect specific distributions const sshService = ports.find(p => p.port === 22); if (sshService?.version) { if (sshService.version.includes('Ubuntu')) { osVersion = 'Ubuntu Linux'; evidence.push('Ubuntu SSH banner detected'); } else if (sshService.version.includes('Debian')) { osVersion = 'Debian Linux'; evidence.push('Debian SSH banner detected'); } else if (sshService.version.includes('CentOS') || sshService.version.includes('RHEL')) { osVersion = 'RedHat/CentOS Linux'; evidence.push('RedHat/CentOS SSH banner detected'); } } } } // macOS indicators const macServices = ['afp', 'apple-filing']; const macServicesFound = ports.filter(p => macServices.some(ms => p.service.toLowerCase().includes(ms)) ); if (macServicesFound.length > 0) { osFamily = 'mac'; confidence = macServicesFound.length * 30; evidence.push('Apple Filing Protocol detected'); } // Generic Unix indicators const unixPorts = [513, 514, 515]; // rsh, syslog, printer const unixPortsFound = ports.filter(p => unixPorts.includes(p.port)); if (unixPortsFound.length > 0 && osFamily === 'unknown') { osFamily = 'unix'; confidence = unixPortsFound.length * 20; evidence.push('Unix services detected'); } // Confidence normalization confidence = Math.min(confidence, 95); // Cap at 95% if (confidence < 30) { osFamily = 'unknown'; evidence.push('Insufficient evidence for OS detection'); } return { os_family: osFamily, os_version: osVersion, confidence, evidence }; }