living-off-the-land-lolbins-mcp-server

find_discovery

Search for discovery and enumeration techniques using living-off-the-land binaries to perform native enumeration, network scanning, and service, user, or file discovery.

Instructions

Find discovery and enumeration techniques using LOL binaries — native enumeration, network scanning, service/user/file enumeration.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "find_discovery"
  }
}

Input Schema

Name	Required	Description	Default
`platform`	No	Target platform for discovery techniques	all
`discovery_type`	No	Type of discovery technique to search for	all
`environment_id`	No	Environment session ID returned by enumerate_host
`stealth_priority`	No	Prioritize stealthier discovery techniques

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.0Jul 24, 2026

TDQS

B3.2/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries full burden. It does not mention whether the tool is read-only, potentially destructive, or requires specific authorization. The use of 'find' implies search, but no behavioral traits are disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-formed sentence that immediately states the action and scope. No extraneous information, making it efficient and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Without an output schema, the description should hint at return format or side effects. It does not explain how environment_id is used or what the output looks like. For a tool with 4 parameters and enums, it lacks sufficient context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and all parameters have descriptions. The tool description lists discovery types that match enum values but adds no additional meaning beyond the schema. Baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states what the tool does: find discovery and enumeration techniques using LOL binaries. It specifies the types (native enumeration, network scanning, service/user/file enumeration), which distinguishes it from sibling find_* tools like find_token_abuse or find_named_pipe_abuse that target other categories.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives, when not to use it, or any prerequisites. The description lacks context for selection among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server