Report MoonMCP's configuration and capabilities.

Shows the active scope, whether enforcement/intrusive scanning are enabled, which optional enhancers (dnspython) are present, and which external security CLIs (nuclei, httpx, subfinder, nmap, ...) were detected on PATH. Call this first to understand what the server can do in the current environment.

List the current in-scope and out-of-scope entries.

Authorize a target for active testing.

Accepts a domain (example.com matches the apex and every subdomain), a wildcard (*.example.com for subdomains only), an exact host (api.example.com), an IP, or a CIDR (10.0.0.0/8). Active tools refuse to touch anything not covered by the scope.

Mark a target as out-of-scope. Exclusions always override the allowlist.

Remove a previously added scope entry (from allow or deny lists).

Passively enumerate subdomains of a domain via free OSINT sources.

Queries certificate transparency (crt.sh), HackerTarget, AnubisDB and AlienVault OTX in parallel and merges the results. Passive — no packets are sent to the target itself. sources optionally restricts which providers to use (see server_status / available list: crtsh, hackertarget, anubis, otx).

Fetch historical URLs for a domain from the Internet Archive (Wayback).

Passive. Surfaces old endpoints, parameters and forgotten files. Flags 'interesting' URLs (backups, configs, .git, api, tokens, ...) separately.

Look up a single CVE by ID (e.g. CVE-2021-44228) from the NVD database.

Returns description, CVSS score/severity/vector, CWE mappings and references.

Keyword-search the NVD for CVEs (e.g. 'apache log4j 2.14').

Results are sorted most-severe first by CVSS base score. Use this to map a fingerprinted product/version to known vulnerabilities.

Look up an IP's exposure via Shodan.

Uses Shodan's free InternetDB by default (open ports, hostnames, CPEs, known CVEs, tags); uses the full Shodan API automatically if a key is configured. Passive — queries Shodan, not the target.

Resolve a host's DNS records (A/AAAA, plus MX/NS/TXT/CNAME/SOA/CAA when dnspython is installed) and attempt a reverse PTR lookup on its A records. Requires the target to be in scope.

Send a single HTTP(S) request to an in-scope target and return a structured result: status, reason, response headers, timing, the full redirect chain, page title and body size. Accepts a bare host (defaults to https) or a full URL. The primary building block for web recon.

Inspect a host's TLS certificate: subject, issuer, validity window, days until expiry, negotiated protocol/cipher, and — most useful for recon — the Subject Alternative Names, which often reveal sibling hostnames. In scope only.

Fetch a URL and audit its HTTP security headers.

Grades (A-F) the presence of HSTS, CSP, X-Frame-Options, X-Content-Type- Options, Referrer-Policy and Permissions-Policy; flags information-leaking headers (Server, X-Powered-By, ...) and risky Set-Cookie flags. In scope only.

Fetch a URL and fingerprint its technology stack: web server, CDN/WAF, language/runtime, frameworks, CMS and front-end libraries, with version hints and the evidence for each match. In scope only.

Fetch and parse a host's disclosure files: robots.txt (extracting the referenced paths), sitemap.xml (extracting URLs), security.txt and humans.txt. A quick, low-noise way to discover structure. In scope only.

TCP connect-scan an in-scope host. ports is 'top' (a curated common set) or a spec like '80,443,8000-8100'. Optionally grabs service banners. Unprivileged and non-malformed (full handshake). Intrusive: requires MOONMCP_ALLOW_INTRUSIVE and the host to be in scope.

Probe an in-scope host for common sensitive paths (admin panels, API docs, .git/.env, backups, config files, ...) using a compact built-in wordlist or a caller-supplied one. Reports each path's status, size and content type. Intrusive: requires MOONMCP_ALLOW_INTRUSIVE and the host to be in scope.

One-shot passive+light recon of an in-scope domain.

Chains the safe tools into a single report: subdomain enumeration, DNS resolution, TLS certificate (with SANs), an HTTP probe, security-header grade, and a technology fingerprint of the apex. No intrusive scanning is performed. Ideal as the first call against a new target.

List the external security CLIs MoonMCP knows about and whether each is installed on PATH, plus the native MoonMCP fallback for each. Use before calling run_scanner or vuln_scan to know what is available.

Run an installed external security CLI and return its output.

tool must be one of the known tools (subfinder, httpx, nuclei, naabu, nmap, katana, ffuf, gau, dnsx, amass, waybackurls). args are passed through verbatim. If target is given it is scope-checked first. If the tool is missing, returns a structured note and the native fallback to use instead. JSONL output is auto-parsed. Gated by MOONMCP_ALLOW_EXTERNAL_TOOLS.

Run a nuclei template-based vulnerability scan against an in-scope target.

Requires nuclei to be installed (there is no safe stdlib equivalent for template-based scanning). templates maps to nuclei -t and severity to -severity (e.g. 'critical,high'). Intrusive: requires MOONMCP_ALLOW_INTRUSIVE, MOONMCP_ALLOW_EXTERNAL_TOOLS and the host in scope.