Skip to main content
Glama
SlanyCukr

Bug Bounty MCP Server

by SlanyCukr

nuclei_scan

Execute Nuclei vulnerability scanner to identify security flaws in targets with enhanced logging and comprehensive parameter support for thorough security assessments.

Instructions

Execute Nuclei vulnerability scanner with enhanced logging and comprehensive parameter support.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
additional_argsNo
authorNo
automatic_scanNo
bodyNo
bulk_sizeNo
concurrencyNo
custom_headersNo
debugNo
exclude_idNo
exclude_tagsNo
follow_redirectsNo
include_metadataNo
include_requestsNo
include_responsesNo
max_redirectsNo
methodsNo
new_templatesNo
output_formatNojsonl
protocol_typeNo
proxyNo
rate_limitNo
resolverNo
retriesNo
scan_strategyNo
severityNo
silentNo
system_resolversNo
tagsNo
targetYes
templateNo
template_idNo
timeoutNo
timestamp_enabledNo
user_agentNo
verboseNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Implementation Reference

  • MCP tool handler for 'nuclei_scan'. This function defines the tool interface, collects parameters, sends them to the backend REST API endpoint '/api/nuclei' via BugBountyAPIClient, and returns the results with logging. This is the primary implementation of the MCP tool.
    @mcp.tool()
    def nuclei_scan(
        target: str,
        severity: str = "",
        tags: str = "",
        exclude_tags: str = "",
        template: str = "",
        template_id: str = "",
        exclude_id: str = "",
        author: str = "",
        protocol_type: str = "",
        output_format: str = "jsonl",
        include_requests: bool = True,
        include_responses: bool = False,
        include_metadata: bool = True,
        timestamp_enabled: bool = True,
        concurrency: int = 25,
        rate_limit: str = "",
        timeout: str = "",
        retries: str = "",
        bulk_size: str = "",
        follow_redirects: bool = True,
        max_redirects: str = "",
        custom_headers: str = "",
        proxy: str = "",
        user_agent: str = "",
        scan_strategy: str = "",
        resolver: str = "",
        system_resolvers: bool = False,
        methods: str = "",
        body: str = "",
        new_templates: bool = False,
        automatic_scan: bool = False,
        silent: bool = False,
        verbose: bool = False,
        debug: bool = False,
        additional_args: str = "",
    ) -> dict[str, Any]:
        """Run Nuclei scanner with enhanced logging and rich parameters."""
        data = {
            "target": target,
            "severity": severity,
            "tags": tags,
            "exclude_tags": exclude_tags,
            "template": template,
            "template_id": template_id,
            "exclude_id": exclude_id,
            "author": author,
            "protocol_type": protocol_type,
            "output_format": output_format,
            "include_requests": include_requests,
            "include_responses": include_responses,
            "include_metadata": include_metadata,
            "timestamp_enabled": timestamp_enabled,
            "concurrency": concurrency,
            "rate_limit": rate_limit,
            "timeout": timeout,
            "retries": retries,
            "bulk_size": bulk_size,
            "follow_redirects": follow_redirects,
            "max_redirects": max_redirects,
            "custom_headers": custom_headers,
            "proxy": proxy,
            "user_agent": user_agent,
            "scan_strategy": scan_strategy,
            "resolver": resolver,
            "system_resolvers": system_resolvers,
            "methods": methods,
            "body": body,
            "new_templates": new_templates,
            "automatic_scan": automatic_scan,
            "silent": silent,
            "verbose": verbose,
            "debug": debug,
            "additional_args": additional_args,
        }
    
        logger.info(f"🎯 Starting Nuclei vulnerability scan on {target}")
        result = api_client.safe_post("api/nuclei", data)
    
        if result.get("success"):
            logger.info(f"✅ Nuclei scan completed on {target}")
        else:
            logger.error("❌ Nuclei scan failed")
    
        return result
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions 'enhanced logging' and 'comprehensive parameter support' but doesn't describe what the tool actually does (runs vulnerability scans), what it returns, whether it's destructive, what permissions it requires, or any rate limits. For a scanning tool with 35 parameters, this is a significant transparency gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise - a single sentence that gets straight to the point. There's zero wasted language, and it's appropriately sized for what it communicates. The structure is front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex vulnerability scanning tool with 35 parameters, no annotations, and 0% schema description coverage, the description is woefully incomplete. While there's an output schema (which helps), the description doesn't explain what the tool actually does, when to use it, what behaviors to expect, or how to configure its many parameters. This leaves significant gaps for an AI agent trying to use this tool effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 35 parameters and 0% schema description coverage, the description provides almost no help understanding what the parameters mean or how to use them. It mentions 'comprehensive parameter support' but doesn't explain any specific parameters, their purposes, or how they interact. The description fails to compensate for the complete lack of schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the tool 'Execute[s] Nuclei vulnerability scanner' which provides a clear verb ('Execute') and resource ('Nuclei vulnerability scanner'). However, it doesn't distinguish this tool from its many sibling scanning tools (like nmap_scan, sqlmap_scan, etc.) beyond mentioning 'enhanced logging and comprehensive parameter support' - which is somewhat vague about what makes this scanner unique.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus the 38 other scanning/discovery tools in the sibling list. There's no mention of prerequisites, target types, or scenarios where Nuclei scanning is preferred over alternatives like nmap_scan, sqlmap_scan, or other vulnerability scanners in the list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/SlanyCukr/bugbounty-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server