Skip to main content
Glama
DansPK

Kali MCP

by DansPK

cewl

Spiders a target website to extract words and generate custom wordlists for password attacks. Saves the output for use with hydra, john, or hashcat.

Instructions

Custom wordlist generator that spiders a website and extracts words from its content. Creates targeted password lists based on the vocabulary actually used by the target organization. Use to generate wordlists for password attacks when you have a target website. For generating wordlists from character sets and patterns (not website content), use crunch. Output: list of extracted words, optionally saved to a file for use with hydra, john, or hashcat.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
urlYesTarget website URL to spider (e.g. http://example.com)
optsNoAdditional cewl options (e.g. '--lowercase' for lowercase-only output)
depthNoHow many links deep to spider from the starting URL (default: 2)
outfileNoOutput file path to save the generated wordlist
min_lengthNoMinimum word length to include in output (default: 3)

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It discloses that the tool spiders a website and can save output to a file, but it does not mention potential network impact, rate limiting, or whether it respects robots.txt. For a network-scanning tool, this is a moderate gap, though the core behavior is clear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tightly packed with no filler. It front-loads the core function, then adds usage guidance, a contrast to a sibling, and a note on output—all in a few sentences. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 5 parameters (all schema-documented), no output schema, and no annotations. The description covers purpose, usage, alternative, and output format. It does not mention prerequisites or edge cases, but for a straightforward spidering tool, the provided context is sufficient for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with every parameter described in the input schema. The description does not add extra meaning beyond the schema; it only implies the tool's purpose. According to the rubric, a baseline of 3 is appropriate when the schema handles parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise verb+resource: 'spiders a website and extracts words from its content.' It explicitly differentiates from the sibling tool crunch by contrasting website-content extraction with character-set/pattern generation, so an agent can select it unambiguously.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states exactly when to use this tool ('when you have a target website') and explicitly names the alternative (crunch) for non-website cases. It also lists downstream tools (hydra, john, hashcat) that consume the output, providing clear context for invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.