Skip to main content
Glama

gobuster_dir

Discover hidden web directories and files by brute-forcing URLs with Gobuster. Scan target sites using customizable wordlists, extensions, and status code filters to uncover exposed resources.

Instructions

Directory and file brute-force using Gobuster. url: target URL (e.g. 'http://example.com') wordlist: path to wordlist (auto-selects common.txt from dirb/seclists if empty) extensions: file extensions to search e.g. 'php,html,txt' threads: concurrent threads (default 10) exclude_codes: HTTP codes to hide (default '404'), use '' to show all follow_redirect: follow 3xx redirects

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
urlYes
threadsNo
wordlistNo
extensionsNo
exclude_codesNo404
follow_redirectNo
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the burden, and it does disclose some behaviors: auto-selecting common.txt if wordlist is empty, using '' for exclude_codes to show all, and following redirects. However, it fails to mention important traits like output format, whether the tool runs asynchronously (suggested by sibling jobs tools), or how results are retrieved.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a concise bullet-style list, front-loading the purpose and then detailing each parameter. Every line earns its place, with no redundant filler. It could be slightly more structured (e.g., separating description from parameter docs), but it remains efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema and no annotations, so the description should explain return values and execution behavior, but it does not. It also doesn't mention whether results are returned directly or via job status/output tools, which are present in the sibling list. This leaves a significant gap for an agent invoking the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description fully compensates by explaining every parameter with added meaning. It provides an example for extensions ('php,html,txt'), clarifies the wordlist default behavior, and explains the exclude_codes special case of '' to show all. This goes far beyond the schema's type/default info.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Directory and file brute-force using Gobuster,' which clearly identifies the tool's purpose and distinguishes it from siblings like gobuster_dns and gobuster_vhost. It uses a specific verb (brute-force) and resource (directories/files), leaving no ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for directory/file brute-force but provides no explicit guidance on when to choose this over alternatives such as ffuf_fuzz or web_crawl. It includes some operational context (e.g., wordlist auto-selection) but lacks exclusions or alternative recommendations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Neeraj829784/kali-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server