Related Servers

Many tools have overlapping purposes due to bundling of subcommands (e.g., bof_creds contains hashdump, lsadump, etc., but also there are separate hashdump and lsadump tools? Actually they are subcommands, not separate tools. The sheer number of tools (54) with similar naming patterns (bof_*, list_*, execute_*) makes it difficult for an agent to distinguish which tool is appropriate for a given task. For instance, bof_ldap, bof_ad, and bof_kerbeus all deal with AD but in different ways, increasing ambiguity.

Most tools use snake_case (bof_ad, list_agents, execute_shell), but some use hyphens (cookie-monster) or run-on words (underlaycopy). The bof_* prefix is consistent among a large group, but other tools like get_uid, jobs_kill, and run_process follow a different pattern. Overall, there is a mix of conventions, though no extreme chaos.

54 tools is very high for a single MCP server. While a C2 framework may justify many operations, many 'tools' are actually command groups (e.g., bof_ldap encapsulates dozens of subcommands), inflating the count. The surface would be more manageable with fewer, more granular tools or a hierarchical structure.

The tool set covers an extensive range of C2 operations: agent management, file ops, credential extraction, AD attacks, Kerberos, lateral movement, MSSQL exploitation, and situational awareness. It appears to handle most common post-exploitation tasks, with minor gaps like cloud-specific attacks or advanced persistence mechanisms.