wifi-security-mcp-server
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@wifi-security-mcp-serverAudit the WPA2-Enterprise security of our office network"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
The Problem
Wireless security assessment is one of the most fragmented disciplines in offensive security. WiFi auditing requires one set of tools, Bluetooth another, RF/SDR a third, IoT protocols yet another — and each domain has its own attack surface, its own vulnerabilities, its own compliance requirements. Today you run aircrack-ng for WPA, use Bettercap for BLE, fire up HackRF for SDR, consult different CVE databases for each chipset, reference NIST and PCI-DSS separately, and then spend hours manually correlating findings into a coherent assessment.
Traditional wireless security workflow:
audit WiFi networks -> aircrack-ng / Wireshark / Kismet
test Bluetooth security -> Bettercap / btlejack / Ubertooth
analyze RF signals -> HackRF / GNU Radio / GQRX
check NFC/RFID -> Proxmark3 / libnfc
assess cellular security -> srsRAN / OpenBTS
test IoT protocols -> Zigbee sniffer / Z-Wave tools / MQTT clients
look up wireless CVEs -> NVD / vendor advisories (manual search)
check compliance -> NIST / PCI-DSS / HIPAA docs (manual)
map to MITRE ATT&CK -> ATT&CK Navigator (manual mapping)
correlate everything -> copy-paste into a report
────────────────────────────────
Total: hours per assessment, most of it context-switching between toolswifi-security-mcp-server gives your AI agent 34 composite tools backed by 9 knowledge bases covering 139 individual capabilities via the Model Context Protocol. The agent analyzes networks, identifies vulnerabilities, maps attacks to MITRE ATT&CK, checks compliance, and generates actionable reports — in a single conversation.
With wifi-security-mcp-server:
You: "Audit the wireless security of our office network running WPA2-Enterprise"
Agent: -> scan_wifi_networks {encryption: "WPA2"}
-> analyze_wifi_security {encryption: "WPA2-Enterprise", authentication: "EAP-PEAP"}
-> find_wifi_attacks {target_type: "WPA2-Enterprise"}
-> detect_wireless_attack {attack_indicators: "deauth frames"}
-> audit_wireless_compliance {standard: "PCI-DSS", network_type: "WPA2-Enterprise"}
-> "Your WPA2-Enterprise network has 3 critical findings:
1. EAP-PEAP without certificate pinning — vulnerable to evil twin
with hostapd-mana (MITRE T1557.002)
2. No 802.11w (PMF) — susceptible to deauthentication attacks
(MITRE T1498.001)
3. PMKID hash extractable without client interaction — offline
cracking possible with hashcat mode 22000
PCI-DSS 4.0: 2 controls non-compliant (4.2.1, 11.2.1).
Recommended: migrate to WPA3-Enterprise with SAE, enable PMF,
deploy WIDS for rogue AP detection."Related MCP server: Wireshark MCP Server
How It's Different
Existing tools give you raw packet captures and protocol-specific analysis. wifi-security-mcp-server gives your AI agent the ability to reason across all wireless domains simultaneously with deep knowledge-base backing.
Quick Start
Option 1: npx (no install)
npx wifi-security-mcp-serverAll 34 tools work immediately. No API keys required — core functionality is knowledge-base driven.
Option 2: Clone
git clone https://github.com/badchars/wifi-security-mcp-server.git
cd wifi-security-mcp-server
bun installEnvironment variables (optional)
# WiGLE — wardriving database for real-world WiFi network lookups
export WIGLE_API_KEY=your-key
# Kismet — live wireless intrusion detection
export KISMET_HOST=127.0.0.1 # Default: 127.0.0.1
export KISMET_PORT=2501 # Default: 2501
export KISMET_API_KEY=your-keyAll API keys are optional. Without them, you still get full access to all 34 tools powered by 9 built-in knowledge bases covering WiFi attacks, Bluetooth attacks, RF/SDR, NFC/RFID, cellular, IoT, hardware databases, CVE intelligence, and compliance frameworks.
Connect to your AI agent
# With npx
claude mcp add wifi-security-mcp-server -- npx wifi-security-mcp-server
# With local clone
claude mcp add wifi-security-mcp-server -- bun run /path/to/wifi-security-mcp-server/src/index.tsAdd to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"wifi-security": {
"command": "npx",
"args": ["-y", "wifi-security-mcp-server"],
"env": {
"WIGLE_API_KEY": "optional",
"KISMET_HOST": "optional",
"KISMET_PORT": "optional",
"KISMET_API_KEY": "optional"
}
}
}
}Same JSON config format. Point the command to npx wifi-security-mcp-server or your local installation path.
Start querying
You: "What attacks are possible against a WPA3-SAE network and how do I test for them?"That's it. The agent looks up attacks, maps them to MITRE ATT&CK, recommends tools, and provides step-by-step methodology — all from built-in knowledge bases.
What The AI Can Do
WiFi Security Assessment
You: "Analyze the security of a WPA2-PSK network with WPS enabled"
Agent: -> analyze_wifi_security {encryption: "WPA2-PSK", features: ["WPS"]}
-> crack_wps {method: "pixie_dust"}
-> analyze_pmkid {capture_method: "hcxdumptool"}
-> find_wifi_attacks {target_type: "WPA2-PSK"}
-> "Critical vulnerabilities found in WPA2-PSK + WPS configuration:
1. WPS Pixie Dust Attack — PIN recoverable in seconds via
offline brute-force of E-S1/E-S2 nonces (Reaver + PixieWPS).
Gives full PSK recovery without client interaction.
2. PMKID Attack — first packet of 4-way handshake contains
PMKID hash, crackable offline with hashcat -m 22000.
No deauth needed, no client needed.
3. 4-Way Handshake Capture — EAPOL frames capturable with
airodump-ng + deauth, then offline dictionary attack.
Priority: Disable WPS immediately (highest risk), enforce
strong 20+ char PSK, consider migration to WPA3-SAE."Bluetooth & BLE Analysis
You: "What are the security risks of our BLE-based access control system?"
Agent: -> scan_bluetooth {scan_type: "BLE"}
-> find_bluetooth_attacks {target_type: "BLE"}
-> analyze_ble {feature: "GATT", pairing_method: "JustWorks"}
-> "BLE access control system — 4 critical risks identified:
1. JustWorks Pairing — no MITM protection. Attacker can
intercept pairing with Ubertooth One (MITRE T1040).
2. GATT Characteristic Sniffing — unlock commands sent in
cleartext, replayable with gatttool (MITRE T1212).
3. BLE Relay/Replay Attack — relay legitimate unlock signal
using two devices + btlejack (MITRE T1557).
4. MAC Address Tracking — static BLE MAC enables occupant
tracking (MITRE T1592.002).
Recommended: enforce LE Secure Connections (LESC) with
Numeric Comparison, encrypt GATT characteristics, implement
rolling nonces for replay protection."IoT Wireless Audit
You: "Assess the wireless security of our smart building IoT deployment"
Agent: -> scan_iot_wireless {protocols: ["Zigbee", "Z-Wave", "MQTT"]}
-> analyze_zigbee {network_key_type: "default"}
-> find_mousejack {vendor: "Logitech"}
-> analyze_wifi_security {encryption: "WPA2-PSK"}
-> "Smart building IoT wireless assessment — 5 findings:
1. Zigbee: Default trust center link key (ZigBeeAlliance09)
allows network join interception with KillerBee (CRITICAL)
2. MQTT: Broker on port 1883 without TLS — credentials
and sensor data transmitted in cleartext
3. Z-Wave: S0 security with known key exchange vulnerability
— recommend S2 upgrade
4. MouseJack: 3 Logitech Unifying receivers vulnerable to
keystroke injection (CVE-2016-10761)
5. WiFi: IoT devices on same VLAN as corporate — no
network segmentation
Priority remediation: MQTT TLS, Zigbee install codes,
IoT VLAN isolation, replace vulnerable Logitech receivers."Compliance Audit
You: "Check our hospital WiFi against HIPAA wireless requirements"
Agent: -> audit_wireless_compliance {standard: "HIPAA", network_type: "WPA2-Enterprise"}
-> analyze_medical_wireless {device_types: ["infusion_pump", "patient_monitor"]}
-> detect_wireless_attack {attack_indicators: "rogue_ap"}
-> "HIPAA Wireless Compliance Audit — 6 findings:
3 NON-COMPLIANT controls:
- 164.312(a)(1): No wireless IDS deployed for rogue AP detection
- 164.312(e)(1): Medical devices using WPA2-PSK (not Enterprise)
- 164.312(e)(2): No wireless traffic encryption audit logging
3 COMPLIANT controls:
- 164.310(a)(1): Physical AP locations documented
- 164.312(a)(2): 802.1X with RADIUS authentication
- 164.312(d): Certificate-based EAP-TLS for staff devices
Remediation plan: deploy WIDS (Kismet/AirMagnet), migrate
medical devices to WPA2-Enterprise with MAB, enable wireless
audit logging on WLAN controller."Tools Reference (34 composite tools)
Tool | Description |
| Scan and analyze WiFi networks — discover SSIDs, channels, encryption types, signal strength, and security misconfigurations |
| Deep analysis of WiFi security configuration — encryption strength, authentication method, known weaknesses, attack surface |
| Find applicable attacks for a WiFi target — returns attack methodology, required tools, MITRE ATT&CK mapping, mitigations |
| Simulate and analyze evil twin AP attack scenarios — hostapd-mana configuration, captive portal, credential capture methodology |
| Analyze deauthentication attack vectors — 802.11w PMF status, deauth detection, countermeasures, WIDS integration |
| Analyze WPS cracking attack vectors — Pixie Dust, brute force, null PIN, default PIN generation, Reaver/Bully methodology |
| Analyze PMKID-based attack vectors — clientless WPA/WPA2 cracking via hcxdumptool + hashcat mode 22000 |
| Audit WiFi 6 (802.11ax) and WiFi 7 (802.11be) specific security features — OWE, SAE, Enhanced Open, Multi-Link Operation |
Tool | Description |
| Scan and analyze Bluetooth devices — BR/EDR classic and BLE discovery, service enumeration, pairing analysis |
| Find applicable Bluetooth attacks — BlueBorne, KNOB, BIAS, BLE relay, MITM, with tools and mitigations |
| Deep analysis of BLE security — GATT services, pairing methods, LE Secure Connections, characteristic encryption |
Tool | Description |
| Analyze RF signal security — frequency analysis, modulation identification, replay attack feasibility, SDR tool recommendations |
Tool | Description |
| Analyze NFC/RFID security — card type identification, access control weaknesses, cloning feasibility, Proxmark3 methodology |
Tool | Description |
| Analyze cellular network security — 2G/3G/4G/5G protocol weaknesses, IMSI catcher detection, fake base station analysis |
Tool | Description |
| Analyze Zigbee network security — trust center policy, network key management, KillerBee attack methodology |
| Scan IoT wireless protocols — Zigbee, Z-Wave, MQTT, LoRaWAN, CoAP discovery and vulnerability analysis |
| Analyze MouseJack wireless keyboard/mouse vulnerabilities — keystroke injection, unencrypted HID, vendor-specific bypasses |
Tool | Description |
| Analyze air-gap exfiltration techniques — electromagnetic, acoustic, thermal, optical covert channels and countermeasures |
| Analyze Ultra-Wideband (UWB) security — ranging manipulation, relay attacks on car key fobs and AirTags, distance fraud |
| Analyze WiFi Channel State Information (CSI) security — passive sensing, activity recognition, keystroke inference risks |
| Analyze Miracast/WiFi Display security — WFD session hijacking, screen capture, unauthorized display access |
| Analyze WiFi Direct (P2P) security — group owner negotiation attacks, WPS vulnerabilities in P2P, rogue group formation |
| Analyze drone RF security — control link hijacking, GPS spoofing, video downlink interception, counter-UAS techniques |
Tool | Description |
| Audit WLAN controller configuration — Cisco WLC, Aruba, Meraki security settings, rogue AP policies, RF management |
| Analyze captive portal security — bypass techniques, credential harvesting risks, network isolation, guest VLAN security |
| Analyze MAC address randomization — iOS/Android/Windows implementation differences, tracking resistance, fingerprinting bypasses |
| Analyze Hotspot 2.0 (Passpoint) security — ANQP, OSU, automatic network selection risks, EAP method analysis |
Tool | Description |
| Look up wireless-specific CVEs — WiFi chipset vulnerabilities, Bluetooth stack CVEs, driver exploits, firmware bugs |
| Look up wireless security hardware — WiFi adapters, Bluetooth sniffers, SDR devices, capabilities, chipset compatibility |
| Map wireless attacks to MITRE ATT&CK framework — technique IDs, tactic categories, detection strategies |
| Analyze medical device wireless security — infusion pumps, pacemakers, patient monitors, FDA guidance, HIPAA requirements |
Tool | Description |
| Detect wireless attacks in progress — deauth floods, evil twin, KARMA, rogue AP, BLE spoofing, RF jamming indicators |
| Audit wireless network against compliance frameworks — PCI-DSS 4.0, HIPAA, NIST 800-153, FedRAMP, ISO 27001 wireless controls |
Tool | Description |
| Export wireless security assessment report — findings, risk ratings, compliance status, remediation roadmap, executive summary |
CLI Usage
# List all available tools
npx wifi-security-mcp-server --list
# Run any tool directly
npx wifi-security-mcp-server --tool scan_wifi_networks '{"encryption":"WPA2"}'
npx wifi-security-mcp-server --tool find_wifi_attacks '{"target_type":"WPA3-SAE"}'
npx wifi-security-mcp-server --tool analyze_ble '{"pairing_method":"JustWorks"}'
npx wifi-security-mcp-server --tool lookup_wireless_cve '{"keyword":"Broadcom WiFi"}'
npx wifi-security-mcp-server --tool audit_wireless_compliance '{"standard":"PCI-DSS"}'
npx wifi-security-mcp-server --tool analyze_zigbee '{"network_key_type":"default"}'
npx wifi-security-mcp-server --tool export_report '{"format":"json"}'Knowledge Bases (9)
The server ships with 9 built-in knowledge bases — no API keys, no external dependencies, no rate limits. Every tool query is enriched with structured intelligence from these databases.
Knowledge Base | Entries | What it provides |
WiFi Attacks | 47 attacks | WPA/WPA2/WPA3 attack techniques, evil twin variants, PMKID, KRACK, FragAttacks, deauth, WPS exploits — each with tools, mitigations, MITRE ATT&CK mapping |
Bluetooth Attacks | 8 attacks | BlueBorne, KNOB, BIAS, BLE relay, MITM, BLE fuzzing, Bluetooth impersonation — with CVEs and detection strategies |
RF/SDR Attacks | 6 attacks | Replay attacks, jamming, signal injection, SDR-based interception, RF fingerprinting bypass, spectrum analysis techniques |
NFC/RFID Attacks | 6 attacks | Card cloning, relay attacks, MIFARE Classic cracking, NFC skimming, RFID fuzzing, access control bypass with Proxmark3 |
Cellular Attacks | 6 attacks | IMSI catching, fake base station (Stingray), SS7 exploitation, 5G NAS vulnerabilities, downgrade attacks, VoLTE interception |
IoT Attacks | 6 attacks | Zigbee network key sniffing, Z-Wave S0 downgrade, MQTT credential harvesting, LoRaWAN ABP replay, MouseJack, BLE IoT relay |
Hardware Database | 12 devices | WiFi adapters (Alfa, TP-Link), Bluetooth sniffers (Ubertooth), SDR (HackRF, RTL-SDR), NFC (Proxmark3) — chipsets, capabilities, monitor mode support |
CVE Database | 17 CVEs | Wireless-specific CVEs for WiFi chipsets (Broadcom, Qualcomm, Intel), Bluetooth stacks, IoT firmware — severity, affected versions, exploit availability |
Compliance Frameworks | 5 frameworks | PCI-DSS 4.0, HIPAA, NIST SP 800-153, FedRAMP, ISO 27001 — wireless-specific controls, audit checklists, gap analysis |
Architecture
src/
index.ts # CLI entrypoint (--help, --list, stdio server)
protocol/
mcp-server.ts # MCP server setup (stdio transport)
tools.ts # Tool registry — all 34 composite tools assembled here
types/
index.ts # Shared types (ToolDef, ToolContext, ToolResult)
knowledge/ # 9 built-in knowledge bases
wifi-attacks.ts # 47 WiFi attack definitions
bluetooth-attacks.ts # 8 Bluetooth attack definitions
rf-attacks.ts # 6 RF/SDR attack definitions
nfc-attacks.ts # 6 NFC/RFID attack definitions
cellular-attacks.ts # 6 Cellular/5G attack definitions
iot-attacks.ts # 6 IoT attack definitions
hardware.ts # 12 hardware device profiles
cve-database.ts # 17 wireless CVEs
compliance.ts # 5 compliance frameworks
wifi/ # WiFi Core tools (8)
bluetooth/ # Bluetooth tools (3)
rf/ # RF/SDR tools (1)
nfc/ # NFC/RFID tools (1)
cellular/ # Cellular/5G tools (1)
iot/ # IoT Wireless tools (3)
advanced/ # Advanced Wireless tools (6)
infrastructure/ # Infrastructure tools (4)
intelligence/ # Intelligence tools (4)
detection/ # Detection tools (2)
reporting/ # Reporting tools (1)Design decisions:
Knowledge-base driven — Unlike API-dependent tools, core functionality runs entirely offline from 9 built-in databases. No API keys, no rate limits, no external dependencies for the primary workflow.
34 composite tools, 139 individual capabilities — Each tool is a composite that bundles related analyses.
find_wifi_attacksdoesn't just list attacks — it returns methodology, required hardware, MITRE ATT&CK mapping, detection strategies, and countermeasures.2 runtime dependencies —
@modelcontextprotocol/sdkandzod. Nothing else. No native modules, no binary dependencies, no platform-specific code.Optional live integration — WiGLE API for real-world network data, Kismet for live wireless IDS. Core analysis works without either.
Compliance-aware — Every finding is automatically mapped to relevant compliance frameworks (PCI-DSS, HIPAA, NIST, FedRAMP, ISO 27001) when applicable.
MITRE ATT&CK mapped — Attack techniques include ATT&CK technique IDs, tactic categories, and detection data sources for SOC integration.
Limitations
Knowledge bases are point-in-time snapshots — new attacks/CVEs require package updates
WiGLE integration requires a free API key for network lookups
Kismet live WIDS requires a running Kismet instance with API access
No active wireless transmission — the server provides intelligence and methodology, not packet injection
Hardware database covers the most common security research devices, not exhaustive
Compliance frameworks focus on wireless-specific controls, not full framework coverage
macOS / Linux tested (Windows not tested)
Part of the MCP Security Suite
Project | Domain | Tools |
Browser-based security testing | 39 tools, Firefox, injection testing | |
Cloud security (AWS/Azure/GCP) | 38 tools, 60+ checks | |
GitHub security posture | 39 tools, 45 checks | |
Vulnerability intelligence | 23 tools, 5 sources | |
OSINT & reconnaissance | 37 tools, 12 sources | |
Dark web & threat intelligence | 66 tools, 16 sources | |
wifi-security-mcp-server | Wireless security intelligence | 34 tools, 9 knowledge bases |
Available Tools
34 toolsanalyze_airgapA
Composite tool for air-gap exfiltration analysis. Supports modes: techniques (list exfiltration techniques), assess (assess feasibility), detect (detection methods), defense (hardening recommendations).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Mode: techniques, assess, detect, or defense | |
| category | No | Technique category filter for techniques mode | |
| technique_id | No | Technique ID for detect mode | |
| threat_level | No | Threat level for defense mode | |
| available_access | No | Available access vector for assess mode | |
| target_environment | No | Target environment for assess mode |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool is a 'composite' and lists modes, but does not mention behavioral traits like read-only nature, required permissions, or output size. This is minimal but not misleading.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no wasted words. It front-loads the purpose and then lists modes efficiently. Structure is appropriate for the information conveyed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (composite with multiple modes and 6 parameters) and lack of output schema, the description is incomplete. It does not explain parameter dependencies (e.g., which parameters apply to which modes) or hint at the return format, leaving gaps for an AI agent to infer.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds no additional meaning beyond the schema; the schema already documents each parameter's enums and descriptions. The tool description only elaborates on the mode parameter, not the others or their interdependencies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's domain (air-gap exfiltration analysis) and lists the four modes (techniques, assess, detect, defense), providing specific verb+resource for each. It distinguishes from the wireless-focused sibling tools by explicitly focusing on air-gap scenarios.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use each mode, giving clear context. However, it does not explicitly state when not to use the tool or name alternative tools, though the domain difference from siblings is implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_bleB
BLE security analysis — GATT service audit, pairing security assessment, sniffing guide, privacy/tracking analysis.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Operation mode: gatt_audit (GATT service security), pairing_security (pairing method assessment), sniff_guide (BLE sniffing setup), privacy_check (address tracking risk) | |
| services | No | [gatt_audit] JSON array of GATT services with characteristics [{uuid, characteristics: [{uuid, properties: [read,write,...]}]}] | |
| address_type | No | [privacy_check] BLE address type | |
| pairing_method | No | [pairing_security] BLE pairing method in use | |
| target_address | No | [sniff_guide] Target BLE device address (XX:XX:XX:XX:XX:XX) | |
| io_capabilities | No | [pairing_security] Device IO capabilities: NoInputNoOutput, DisplayOnly, DisplayYesNo, KeyboardOnly, KeyboardDisplay | |
| protocol_version | No | [sniff_guide] BLE protocol version (e.g. '4.0', '5.0') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations present, so description must bear full burden. It only lists analysis modes but does not disclose side effects, authentication requirements, rate limits, or whether any state is modified. For a security analysis tool, this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence efficiently communicates purpose and modes. No redundant words, information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite detailed parameter schema, the description is too brief. It omits expected output, interpretation of results, and any usage context. With no output schema, the description should compensate by explaining what the tool returns for each mode.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with per-parameter descriptions that explain the mode-specific usage. The tool description adds no additional meaning beyond the schema; baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'BLE security analysis' and enumerates four specific modes (GATT audit, pairing security, sniffing guide, privacy check). This distinguishes it from sibling tools like scan_bluetooth and find_bluetooth_attacks which focus on discovery or attack finding, not security analysis.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this vs alternatives. The description only lists modes but does not compare to scan_bluetooth or other BLE tools. No cautionary notes or prerequisites provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_captive_portalB
Unified captive portal analysis tool. Modes: bypass (bypass techniques by portal type), assess (security assessment of portal implementation), defense (hardening recommendations by deployment type).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Operation mode to execute | |
| deployment | No | Deployment environment (required for defense mode) | |
| portal_type | No | Type of captive portal (required for bypass mode) | |
| network_restrictions | No | Known network restrictions (used by bypass mode) | |
| implementation_details | No | Portal implementation description (required for assess mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It does not disclose critical behavioral traits such as whether the tool performs network interactions, is read-only or destructive, or requires permissions. The 'bypass' mode implies active engagement, but this is not clarified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loads the purpose, and wastes no words. Every sentence adds value by stating the tool's nature and listing modes with one-line explanations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description should indicate what the tool returns (e.g., report, recommendations). It also lacks information about prerequisites (network connectivity) and limitations. The tool's modes are covered, but overall completeness is insufficient for confident usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds context by linking modes to parameters (e.g., bypass uses portal_type), but the schema descriptions already adequately describe each parameter's purpose. No significant extra meaning is added.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a 'unified captive portal analysis tool' and lists three specific modes (bypass, assess, defense) with brief explanations. This distinguishes it from sibling tools which cover other wireless topics but not captive portals.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for captive portal analysis but provides no explicit guidance on when to use this tool versus alternatives (e.g., scan_wifi_networks) or when not to use it. No exclusions or prerequisites are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_cellular_securityA
Composite tool for comprehensive cellular network security analysis. Supports modes: lookup (look up attack by ID), search (search attacks by category/severity), imsi_detect (IMSI catcher detection guidance), assess (assess cellular security posture), defense (defense recommendations by threat model).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Analysis mode: lookup, search, imsi_detect, assess, or defense | |
| carrier | No | Carrier name for assess mode | |
| category | No | Category filter for search mode | |
| severity | No | Severity filter for search mode | |
| attack_id | No | Attack ID for lookup mode (e.g. 'imsi_catcher', 'ss7_intercept') | |
| device_os | No | Device OS for imsi_detect mode | |
| network_type | No | Network type for assess mode | |
| threat_model | No | Threat model for defense mode | |
| volte_enabled | No | VoLTE status for assess mode | |
| vowifi_enabled | No | VoWiFi status for assess mode |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description indicates it is a composite tool with multiple modes, but lacks behavioral details such as rate limits, authorization needs, or side effects. With no annotations, the description provides moderate transparency but not in-depth.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that packs essential information, including all modes. It is front-loaded and efficient, though it could benefit from structured formatting for clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (10 parameters, multiple modes, no output schema), the description provides a useful overview but lacks details on return values or behavior per mode. It is adequate for basic understanding but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so all parameters have descriptions. The tool description adds high-level context for modes but does not significantly enhance understanding beyond what the schema already provides for individual parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states it is a composite tool for cellular network security analysis and lists all supported modes, clearly distinguishing it from sibling tools focused on Wi-Fi, Bluetooth, NFC, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage through mode names but does not provide explicit guidance on when to use this tool vs. alternatives or when not to use it. No exclusions or sibling comparisons are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_deauthA
Deauthentication attack analysis and defense. Analyze feasibility, generate detection rules, get attack commands, recommend defenses.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Mode: analyze feasibility, detect attacks, get commands, recommend defenses | |
| count | No | Deauth frame count (for commands mode) | |
| interface | No | Interface name (for commands mode) | |
| client_mac | No | Client MAC (for commands mode) | |
| target_pmf | No | PMF status: enabled/disabled (for analyze mode) | |
| edr_present | No | Whether WIDS/EDR is present (for analyze mode) | |
| target_band | No | Target band: 2.4/5/6 (for analyze mode) | |
| target_bssid | No | Target BSSID (for commands mode) | |
| wids_platform | No | WIDS platform: Kismet/Snort/Suricata/custom (for detect mode) | |
| infrastructure | No | Infrastructure description (for defense mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must carry full burden. It lists actions but does not disclose side effects (e.g., does 'get attack commands' imply execution? Are changes made to the system?). Lacks clarity on whether it is read-only or potentially destructive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero fluff. Each phrase adds distinct information (tool purpose, four modes). Efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite 10 parameters and no output schema, the description fails to explain how parameters map to modes (e.g., which params are needed for 'analyze'). The schema provides some detail, but the description lacks integration. Adequate but incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so each parameter has a description that adds meaning (e.g., 'for detect mode'). The description enumerates modes but adds no value beyond the schema. Baseline 3 is appropriate as schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool is for 'Deauthentication attack analysis and defense' and lists four specific modes (analyze feasibility, generate detection rules, get attack commands, recommend defenses). This clearly distinguishes it from sibling tools like find_wifi_attacks (general discovery) and analyze_wifi_security (broader security analysis).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for deauth-specific tasks but provides no explicit guidance on when to use this tool versus alternatives like find_wifi_attacks or analyze_wifi_security. No 'when not to use' or prerequisites mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_drone_rfC
Composite tool for drone RF security analysis. Supports modes: detect (drone RF detection guide), analyze (analyze drone communication protocol), counter (counter-drone RF techniques).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Mode: detect, analyze, or counter | |
| hardware | No | SDR hardware for detect mode | |
| protocol | No | Drone protocol for analyze mode | |
| frequency_bands | No | Frequency bands for detect mode (e.g. ['2.4ghz', '5.8ghz']) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It mentions 'composite tool' and 'guide', suggesting it is non-destructive, but does not detail behavior such as whether it requires active scanning, user input, or has side effects. Significant gaps remain.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of 25 words, which is concise. It efficiently conveys the tool's purpose and modes. However, it could be better structured (e.g., bullet points) to improve readability for an AI agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (composite with 3 modes, 4 parameters, no output schema), the description is incomplete. It does not explain which parameters apply to which mode, nor does it hint at return values or output format. The schema partially compensates, but the description lacks essential context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds minimal value by briefly explaining each mode, but the schema already documents parameters with enums and descriptions. The description does not clarify mode-parameter relationships or provide additional semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it is for drone RF security analysis with three modes (detect, analyze, counter), clearly specifying the resource and actions. It distinguishes from sibling tools that target other wireless technologies, making the purpose fairly clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The description only lists the modes but does not explain when to choose this composite tool over other RF or wireless tools, nor does it mention any prerequisites or limitations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_hotspot20A
Unified Hotspot 2.0 / Passpoint analysis tool. Modes: assess (security assessment of HS20 configuration), attack (attack techniques and methodologies), defense (defense recommendations and hardening).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Operation mode to execute | |
| auth_method | No | Authentication method (required for assess mode) | |
| osu_enabled | No | Whether OSU is enabled (used by assess mode) | |
| hs20_version | No | Hotspot 2.0 version (required for assess mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It only names modes without explaining side effects, required permissions, or whether the tool is destructive. Lacks safety or impact information.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences: first sentence states the main purpose, second lists modes with brief explanations. No wasted words, front-loaded key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description should explain what each mode returns. It does not mention return values, expected results, or error conditions. For a multi-mode tool, this is a gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds value beyond the schema by stating that auth_method is required for assess mode, osu_enabled is used by assess mode, and hs20_version is required for assess mode. This clarifies parameter usage context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a unified Hotspot 2.0 / Passpoint analysis tool with three distinct modes (assess, attack, defense). It differentiates from sibling tools by being specific to Hotspot 2.0, not general Wi-Fi analysis.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description lists modes but does not provide explicit guidance on when to use this tool versus alternatives like analyze_wifi_security or find_wifi_attacks. There is no 'when to use' or 'when not to use' advice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_medical_wirelessA
Unified medical wireless security tool. Modes: assess (risk assessment by device type and protocol), attacks (known attacks and CVEs for device type), defense (HIPAA-aligned hardening by deployment).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Operation mode to execute | |
| deployment | No | Deployment environment (required for defense mode) | |
| device_type | No | Medical device type (required for assess and attacks modes) | |
| wireless_protocol | No | Wireless protocol used by the device (required for assess mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It lacks information on whether the tool is read-only or destructive, authentication requirements, or side effects. The 'defense' mode likely modifies settings, but this is not stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences efficiently convey the tool's purpose and mode structure. Every word earns its place; no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 4 parameters and no output schema, the description covers the main behavioral aspects (modes, parameter dependencies). It lacks return value or error details, but overall provides sufficient context for an agent to understand core functionality.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds value by logically grouping parameters with modes (e.g., deployment for defense, device_type for assess/attacks, wireless_protocol for assess), providing context beyond the schema's simple 'required for' labels.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly defines it as a unified medical wireless security tool with three distinct modes (assess, attacks, defense), each briefly explained. This differentiates it from sibling tools that are focused on specific protocols or general wireless security.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for medical wireless contexts through the title and scope, but does not explicitly state when to choose this tool over siblings like scan_wifi_networks or analyze_zigbee. No exclusions or alternative recommendations are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_miracastB
Composite tool for wireless display (Miracast/AirPlay/Chromecast) security analysis. Supports modes: assess (assess protocol security), attack (attack techniques), defense (defense recommendations).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Mode: assess, attack, or defense | |
| protocol | No | Wireless display protocol for assess and attack modes | |
| pin_required | No | Whether PIN is required (for assess mode) | |
| target_display | No | Target display name/identifier (for attack mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It only states it is a 'composite tool' with modes but does not disclose behavioral traits such as potential destructiveness (e.g., attack mode), permissions needed, or any side effects. This is insufficient for safe invocation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one sentence, concise and front-loaded with the core purpose. It uses a colon to list modes efficiently, with no redundant information. Every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 4 parameters, no output schema, and no annotations, the description is too minimal. It does not explain return values, prerequisites, or behavior per mode. For a composite tool, more context is needed for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%; each parameter already has a description. The tool description adds high-level context (e.g., modes and protocols) but does not provide additional semantic detail beyond what is in the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a composite tool for wireless display (Miracast/AirPlay/Chromecast) security analysis with distinct modes. This differentiates it from sibling tools like scan_wifi_networks or analyze_ble, which target other protocols.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions three modes (assess, attack, defense) but does not provide explicit guidance on when to use this tool versus alternatives. The usage is implied by the protocol focus, but no when-not scenarios or alternative tool references are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_nfc_securityA
NFC/RFID security analysis — card identification, attack lookup, cloning guides (Mifare, HID, EM4100), EMV relay analysis, defense recommendations.
| Name | Required | Description | Default |
|---|---|---|---|
| sak | No | [identify_card] SAK value as hex string (HF cards) | |
| atqa | No | [identify_card] ATQA value as hex string (HF cards) | |
| mode | Yes | Operation mode: lookup_attack (by ID), search_attacks (by criteria), identify_card (from scan params), clone_guide (step-by-step cloning), defense (security recommendations) | |
| category | No | [search_attacks] Filter by attack category | |
| protocol | No | [search_attacks] Filter by protocol name (e.g. 'Mifare', 'HID', 'EM4100') | |
| attack_id | No | [lookup_attack] NFC/RFID attack ID (e.g. 'mifare_classic_darkside', 'emv_relay', 'lf_clone') | |
| card_type | No | [clone_guide] Card type to clone | |
| data_rate | No | [identify_card] Data rate for LF cards | |
| frequency | No | [search_attacks] Filter by frequency (e.g. '125 kHz', '13.56 MHz') | |
| deployment | No | [defense] Deployment type for defense recommendations | |
| known_keys | No | [clone_guide] Known sector keys as comma-separated hex (for Mifare Classic) | |
| modulation | No | [identify_card] Modulation type for LF cards | |
| uid_length | No | [identify_card] UID length in bytes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It implies a read/analyze tool but does not explicitly state that it is non-destructive or disclose any permissions, rate limits, or side effects. The modes suggest lookups and guides, which are typically safe, but not explicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that efficiently captures the tool's scope. It is front-loaded and concise, though slightly dense with bullet-style lists.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (13 parameters, multiple modes), the description provides a useful summary but lacks detail on how to use each mode or which parameters are needed for each. However, the schema fills in the gaps, so overall it is minimally complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the description does not need to add much about parameters. It provides a high-level overview but no additional detail beyond what the schema already covers. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is for NFC/RFID security analysis, listing specific capabilities like card identification, attack lookup, cloning guides, and defense recommendations. It distinguishes itself from siblings which are primarily WiFi and Bluetooth tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for NFC/RFID security tasks but does not explicitly state when to use it over alternatives. The mode parameter provides some guidance, but there are no when-not or alternative tool mentions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_pmkidA
PMKID attack analysis. Assess feasibility, get capture commands (hcxdumptool), get cracking commands (hashcat) with optimized settings.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Mode: assess feasibility, get capture commands, or get cracking commands | |
| rules | No | Hashcat rules file (for crack_commands mode) | |
| hardware | No | GPU hardware (for crack_commands mode) | |
| wordlist | No | Wordlist path (for crack_commands mode) | |
| hash_file | No | Hash file path (for crack_commands mode) | |
| interface | No | Interface name (for capture_commands mode) | |
| psk_length | No | Estimated PSK length (for assess mode) | |
| target_bssid | No | Target BSSID (for capture_commands mode) | |
| target_roaming | No | 802.11r enabled (for assess mode) | |
| target_encryption | No | Target encryption (for assess mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the tool 'gets' commands but does not clarify whether it executes them or merely outputs strings. Additionally, it omits any mention of prerequisites, permissions, or side effects, leaving behavioral traits partially unclear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the core purpose ('PMKID attack analysis') and immediately lists the three modes and related tools. Every word adds value; there is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the three modes and the general purpose, but it lacks any mention of the output format (e.g., text, structured data, command lines). Without an output schema, the agent is left to infer what the tool returns. For a tool with 10 parameters and no output schema, this is a notable gap in completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds minimal extra meaning beyond the schema; it mentions 'optimized settings' but does not detail which parameters are relevant per mode. The schema already describes each parameter, so the description does not significantly enhance understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is for PMKID attack analysis, lists three specific modes (assess, capture commands, crack commands) and mentions exact tools (hcxdumptool, hashcat). This differentiates it from sibling tools like analyze_wifi_security or find_wifi_attacks which cover broader or different attack vectors.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The three modes explicitly guide usage: assess feasibility, get capture commands, or get cracking commands. While it does not compare directly to sibling tools, the mode enumeration makes clear when each function is appropriate, providing sufficient context for an agent to decide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_rf_signalC
RF signal analysis and attack planning — protocol identification, signal analysis, replay attack guides, SDR hardware selection and setup.
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | [setup_guide] Target operating system | |
| mode | Yes | Operation mode: lookup_attack, search_attacks, analyze_signal, replay_guide, identify_protocol, hardware_guide, setup_guide, frequency_guide | |
| budget | No | [hardware_guide] Maximum budget (e.g. '$100', '$500') | |
| category | No | [search_attacks] Attack category filter | |
| hardware | No | [replay_guide] Hardware platform for replay commands | |
| protocol | No | [replay_guide, identify_protocol, frequency_guide] Protocol type or name (fixed_code/rolling_code for replay, or protocol name for identify/frequency) | |
| severity | No | [search_attacks] Minimum severity filter | |
| use_case | No | [hardware_guide] Primary use case for hardware selection | |
| attack_id | No | [lookup_attack] RF attack ID (e.g. 'rolljam', 'subghz_replay', 'gps_spoofing') | |
| bandwidth | No | [analyze_signal] Signal bandwidth (e.g. '200 kHz', '1 MHz') | |
| data_rate | No | [identify_protocol] Detected data rate (e.g. '1 kbps', '250 kbps') | |
| frequency | No | [search_attacks, analyze_signal, replay_guide, identify_protocol] Frequency (e.g. '433 MHz', '2.4 GHz') | |
| modulation | No | [analyze_signal, replay_guide, identify_protocol] Modulation type (ASK, FSK, GFSK, PSK, CSS, etc.) | |
| sdr_hardware | No | [setup_guide] SDR hardware platform for setup instructions |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions 'attack planning' and 'replay attack guides' which imply potentially destructive actions, but it does not disclose any behavioral traits such as required permissions, side effects, rate limits, or whether modifications are irreversible. This is a critical gap for a tool with attack capabilities.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that efficiently lists core capabilities. It is front-loaded with key terms, but could be more structured with bullet points or separation of modes for clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 14 parameters, 8 modes, and no output schema. The description is too vague to fully guide an agent; it does not explain what each mode returns, prerequisites, or how parameters interact. For a complex tool, this is incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and each parameter has a descriptive role (e.g., [setup_guide] for OS). The main description adds minimal additional meaning beyond the schema, just listing high-level capabilities. Baseline 3 is appropriate given the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool does 'RF signal analysis and attack planning' and lists specific capabilities like protocol identification, signal analysis, replay attack guides, and SDR hardware selection. This is a clear verb+resource, but it does not differentiate from sibling tools such as scan_wifi_networks or analyze_wifi_security which also involve RF analysis.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. The description lists operation modes but does not explain when each mode is appropriate or exclude sibling tools. For example, an agent might not know whether to use analyze_rf_signal or find_wifi_attacks for a specific task.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_uwbA
Composite tool for UWB (Ultra-Wideband) security analysis. Supports modes: assess (assess UWB security for a use case), attack (attack techniques including Ghost Peak), defense (secure ranging best practices).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Mode: assess, attack, or defense | |
| use_case | No | UWB use case for assess mode |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden. It states the tool is composite and describes modes, but it does not disclose behavioral traits such as what happens when parameters are used in conflicting modes, whether the tool is destructive, rate limits, or output format. For a mutation-capable tool (attack mode), this lack of transparency is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise at two sentences, with a clear structure introducing the tool and listing modes. It is front-loaded with the purpose. However, it could be slightly more structured (e.g., bullet points for modes explicitly), but overall it is effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema or annotations exist. The description does not explain return values, error states, prerequisites, or confirm whether the tool modifies state. For a composite tool with multiple modes, this incompleteness leaves the agent with significant ambiguity about how to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the description adds value beyond the enum values by providing brief context: 'assess UWB security for a use case', 'attack techniques including Ghost Peak', 'secure ranging best practices'. It also clarifies that use_case is for assess mode, which the schema does not explicitly enforce.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a composite tool for UWB security analysis with specific modes (assess, attack, defense). This distinguishes it from sibling tools which cover other wireless technologies like Wi-Fi, Bluetooth, etc. The verb 'analyze' and resource 'UWB' are specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions the three modes and briefly explains each, but does not provide explicit guidance on when to use this tool versus alternatives. While it is implied for UWB analysis, there is no mention of when not to use it or scenarios where other tools might be more appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_wifi_csiB
Composite tool for WiFi Channel State Information (CSI) sensing analysis. Supports modes: techniques (CSI sensing overview), privacy (privacy implications), detect (CSI surveillance detection).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Mode: techniques, privacy, or detect | |
| scenario | No | Environment scenario for privacy mode |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must fully disclose behavioral traits. It only states it is a 'composite tool' and lists modes, but does not describe side effects, network activity, hardware requirements, or result types. This is insufficient for understanding the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, consisting of two sentences with the key information front-loaded. It wastes no words, but could benefit from better structuring (e.g., bullet points for modes). Still, it is efficient and easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description should explain return values or outcomes. It does not mention what each mode produces (e.g., overview, privacy risks, detection results). Additionally, prerequisites or limitations are omitted, leaving the tool's full functionality unclear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with enum descriptions, so the description adds minimal extra meaning. It repeats the mode enum values in the description but does not explain specifics like what each mode does or how the scenario parameter affects behavior. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as a composite tool for WiFi CSI analysis and lists three distinct modes (techniques, privacy, detect). The verb 'analyze' and resource 'WiFi CSI' are specific, and the tool differentiates itself from siblings like 'scan_wifi_networks' and 'analyze_wifi_security' by focusing on CSI sensing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions three modes, giving some guidance on when to use each. However, it lacks explicit guidance on when not to use this tool or how it compares to alternatives like 'find_wifi_attacks' or 'analyze_wifi_security'. No exclusions or context for appropriate scenarios are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_wifi_directA
Composite tool for WiFi Direct (P2P) security analysis. Supports modes: assess (assess security posture), attack (attack techniques), defense (hardening recommendations).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Mode: assess, attack, or defense | |
| go_intent | No | WiFi Direct Group Owner intent 0-15 (for assess mode) | |
| wps_method | No | WPS method (for assess mode) | |
| persistent_group | No | Persistent group enabled (for assess mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must fully convey behavioral traits. It mentions 'attack techniques' which may be destructive, but does not disclose side effects, permissions needed, or what the tool modifies. This is insufficient for a multi-mode tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with a parenthetical explanation of modes. No unnecessary words, and front-loaded with the tool's purpose and modes.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 4 parameters, no output schema, and multi-modal behavior, the description covers the modes but lacks information on return values, expected output per mode, or any preconditions. Adequate but with gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so each parameter already has a clear description. The tool description adds no further meaning to parameters besides grouping modes. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a composite tool for WiFi Direct security analysis, with three distinct modes. This distinguishes it from sibling tools like analyze_wifi_security, which cover general WiFi, and the mention of P2P adds specificity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description lists modes but does not explicitly state when to use this tool versus alternatives like analyze_wifi_security or find_wifi_attacks. Usage context is implied but not directly stated, and no when-not guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_wifi_securityB
Comprehensive WiFi security analysis -- WPA/WPA2/WPA3 configuration assessment, PSK strength, EAP security, PMF status, protocol comparison, crack time estimation.
| Name | Required | Description | Default |
|---|---|---|---|
| psk | No | PSK key or description (for psk_strength mode) | |
| mode | Yes | Analysis mode | |
| hardware | No | Hardware description (for crack_time mode) | |
| hash_type | No | Hash type: PMKID/handshake (for crack_time mode) | |
| protocols | No | Protocol list to compare (for compare_protocols mode) | |
| eap_method | No | EAP method (for eap_config mode) | |
| pmf_status | No | PMF status: disabled/optional/required (for pmf_check mode) | |
| psk_policy | No | PSK policy description (for crack_time mode) | |
| inner_method | No | Inner auth method (for eap_config mode) | |
| cert_validation | No | Certificate validation (for eap_config mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully convey behavioral traits. It mentions 'assessment' and 'estimation' but does not disclose whether the tool is read-only, destructive, or has any side effects. It lacks details on permissions, rate limits, or what happens to the system.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that efficiently conveys the tool's purpose. Every clause adds value, with no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 10 parameters and no output schema, the description is incomplete. It does not explain return values, how modes work in detail, or the expected behavior for different inputs. The tool's complexity demands more guidance.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already describes each parameter. The description adds a summary of modes but does not provide additional meaning beyond the schema. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it performs comprehensive WiFi security analysis, listing specific areas like WPA/WPA2/WPA3 configuration, PSK strength, EAP security, PMF status, protocol comparison, and crack time estimation. This distinguishes it from sibling tools like scan_wifi_networks (scanning) and find_wifi_attacks (finding attacks).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description lists modes but provides no guidance on when to use this tool versus alternatives. There is no explicit when-to-use or when-not-to-use advice, making it hard for an agent to decide between this and sibling tools like crack_wps or analyze_pmkid.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_zigbeeB
Composite tool for Zigbee network security analysis. Supports modes: analyze (assess network security), sniff_guide (sniffing setup guide), key_extract (key extraction during join), replay (frame replay guide).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Analysis mode: analyze, sniff_guide, key_extract, or replay | |
| channel | No | Zigbee channel 11-26 (for sniff_guide mode) | |
| hardware | No | Sniffing hardware (for sniff_guide mode) | |
| join_method | No | Join method (for key_extract mode) | |
| security_level | No | Zigbee security level (for analyze mode) | |
| coordinator_info | No | Coordinator info (for analyze mode) | |
| network_key_known | No | Whether network key is known (for analyze mode) | |
| target_device_type | No | Target device type (for replay mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It only lists modes without disclosing behavioral traits such as destructiveness, authorization needs, or rate limits. Operations like key_extract may be active but are not described, leaving significant gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, using two sentences to convey the core purpose and modes. Although a bullet list could improve scannability, there is no wasted text. It is appropriately front-loaded with the primary purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (8 parameters, 4 modes, no output schema or annotations), the description is insufficient. It omits output behavior, mode-specific use cases, and prerequisites, leaving the agent without a complete understanding of what each mode entails.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so each parameter is already explained in the schema. The description adds no extra meaning beyond listing the mode names; it does not clarify parameter relationships or constraints beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a composite tool for Zigbee network security analysis and lists four specific modes (analyze, sniff_guide, key_extract, replay). This uniquely identifies the tool's purpose and distinguishes it from sibling tools focused on other wireless protocols.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for Zigbee security analysis but provides no explicit guidance on when to use this tool over alternatives like scan_iot_wireless. It lacks when-not or direct comparisons, though sibling differentiation is somewhat inherent due to protocol specificity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
audit_wifi67C
WiFi 6/6E/7 security audit. Assess WiFi 6 features, WiFi 7 MLO security, compare generations, analyze new attack surfaces.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Mode: assess WiFi 6, assess WiFi 7 MLO, compare 6/6E/7, or analyze new attack surface | |
| bands | No | Active bands (for wifi7_assess mode) | |
| mlo_enabled | No | MLO enabled (for wifi7_assess mode) | |
| features_enabled | No | WiFi 6 features list (for wifi6_assess mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavioral traits. It fails to mention whether the tool is read-only, requires permissions, has side effects, or what outputs/results to expect. This is a critical gap for a security audit tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the main purpose and lists key actions. It is concise with no wasted words, though it could benefit from slightly more structure (e.g., bullet points).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has multiple modes and no output schema, the description should clarify what each mode returns (e.g., reports, vulnerabilities). It also lacks prerequisites or invocation context. The description is incomplete for effective agent use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all parameter purposes. The description adds no new meaning beyond summarizing the modes, which the schema already enumerates. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it is a WiFi 6/6E/7 security audit and lists four modes (assess, assess MLO, compare, attack surfaces), giving clear verb+resource. However, it does not explicitly differentiate from sibling tools like analyze_wifi_security or find_wifi_attacks, though the modes imply unique functionality.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. With many sibling tools covering similar domains (scan_wifi_networks, analyze_wifi_security), the description lacks context for appropriate selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
audit_wireless_complianceA
Unified wireless compliance auditing tool. Modes: check (compliance check against framework), gap_analysis (identify gaps in deployed controls), compare_frameworks (compare all frameworks), report (generate compliance report).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Operation mode to execute | |
| findings | No | Assessment findings as JSON array (required for report mode) | |
| framework | No | Compliance framework (required for check, gap_analysis, report modes) | |
| config_data | No | Current wireless configuration (used by check mode) | |
| current_controls | No | Description of deployed controls (required for gap_analysis mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden for behavioral traits. It describes each mode's purpose and parameter requirements but omits side effects (e.g., read-only vs. mutation), access requirements, or error handling. The description is adequate but lacks depth.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact (two sentences) with a clear front-loaded statement and a structured list of modes. Every sentence adds value, though a very brief usage hint could further improve efficiency.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 params, 4 modes, no output schema), the description covers mode purposes and parameter dependencies adequately. It does not explain return format but the absence of output schema reduces the deficit. Sibling context reinforces its compliance niche.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the description adds context by linking parameters to specific modes (e.g., 'findings required for report mode') and enumerating modes without redundancy. This enhances the schema's per-parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Unified wireless compliance auditing tool' and lists four distinct modes (check, gap_analysis, compare_frameworks, report), making the tool's purpose clear. It distinguishes itself from siblings focused on signal analysis or attacks by centering on compliance frameworks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage through mode enumeration but provides no explicit guidance on when to choose this tool over alternatives. It does not include when-not-to-use or exclusion criteria, leaving the agent to infer context from the tool name and sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
audit_wlan_controllerA
Unified WLAN controller auditing tool. Modes: audit_config (audit controller configuration), rogue_ap (rogue AP detection guidance), audit_ssid (SSID security assessment), hardening (vendor-specific hardening guide).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Operation mode to execute | |
| config_data | No | Raw WLAN controller configuration text (required for audit_config) | |
| ssid_config | No | SSID configuration as JSON string (required for audit_ssid) | |
| wids_enabled | No | Whether WIDS/WIPS is currently enabled (used by rogue_ap mode) | |
| controller_type | No | WLAN controller vendor/platform type (required for audit_config, rogue_ap, hardening) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the behavioral burden. It states the tool audits and guides but does not disclose side effects, required permissions, output format, or error behavior. For a read-like tool, it is minimally adequate but lacks depth.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that efficiently communicates the tool's purpose and modes. It is concise without being under-specified, earning a high score for structure, though a touch more detail on mode usage could improve clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given five parameters, no output schema, and no annotations, the description is incomplete. It does not explain return values, prerequisites, or post-condition effects. It provides enough to understand the tool's scope but not enough for fully informed invocation without external knowledge.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, meaning each parameter is already documented in the schema. The description does not add new semantic value beyond listing modes; it merely repeats the mode names. Baseline of 3 is appropriate as the schema handles parameter explanations.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies it as a 'Unified WLAN controller auditing tool' and lists four distinct modes, making the purpose specific and unambiguous. Sibling tools like scan_wifi_networks or find_wifi_attacks focus on client-side or attack scanning, so this tool is well-differentiated as a controller-side auditing tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage via mode selection but does not explicitly state when to use this tool over siblings (e.g., when to choose audit_ssid mode vs analyze_wifi_security). No when-not-to-use or alternative recommendations are provided, leaving the agent to infer context from mode names alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
crack_wpsA
WPS security analysis and attack. Assess WPS vulnerabilities, get attack commands for brute force / Pixie Dust / null PIN, and defense recommendations.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Mode: assess vulnerabilities, get attack commands, or defense recommendations | |
| method | No | Attack method: brute/pixiedust/null_pin (for attack_commands mode) | |
| interface | No | Interface name (for attack_commands mode) | |
| wps_locked | No | WPS lock status (for assess mode) | |
| wps_enabled | No | WPS enabled status (for assess mode) | |
| wps_version | No | WPS version (for assess mode) | |
| target_bssid | No | Target BSSID (for attack_commands mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description mentions attack commands including brute force, Pixie Dust, and null PIN, implying potentially destructive or intrusive behavior, but does not disclose prerequisites (e.g., monitor mode, root access) or ethical/legal warnings. No annotations exist to supplement this.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that efficiently conveys the tool's purpose and key modes, but it could be better structured (e.g., separated into bullet points or clearer sections). No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 7 parameters and no output schema, the description provides minimal guidance on what results to expect or how parameters interact. It covers the three modes sufficiently but lacks detail on output or usage order.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains each parameter. The description adds no new semantic value beyond summarizing the mode options. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly specifies the tool's purpose: WPS security analysis and attack, including specific modes (assess, attack_commands, defense). It distinguishes itself from sibling tools by focusing exclusively on WPS, not general Wi-Fi analysis.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description and mode parameter clearly indicate when to use which mode (assess, attack_commands, defense). However, it lacks explicit guidance on when not to use this tool or comparisons to alternatives like analyze_wifi_security or find_wifi_attacks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
detect_mac_randomizationA
Unified MAC randomization analysis tool. Modes: bypass (OS-specific bypass techniques), assess (implementation quality assessment per OS/version), tracking (device tracking techniques despite randomization).
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Operating system to assess (required for assess mode) | |
| mode | Yes | Operation mode to execute | |
| version | No | OS version to assess (required for assess mode) | |
| target_os | No | Target operating system (required for bypass mode) | |
| target_version | No | Target OS version (required for bypass mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It describes the high-level modes but does not disclose behavioral details such as whether the tool is passive or active, required permissions, or potential side effects. More transparency is needed for safe invocation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, with two sentences plus a bullet-like list of modes. Every word is informative and contributes to understanding the tool's purpose and modes.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the high schema coverage and no output schema, the description adequately covers the core functionality (three modes). It does not explain return values, but the tool is a analysis tool with likely output that is self-explanatory. Overall, fairly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description does not add significant meaning beyond the schema; it explains modes but not parameter details. The schema already provides adequate descriptions for each parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a unified MAC randomization analysis tool with three distinct modes (bypass, assess, tracking), each with a brief explanation. This distinguishes it from sibling tools, which focus on other wireless security aspects.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for each mode (bypass for OS-specific bypass techniques, assess for implementation quality, tracking for device tracking). It does not explicitly state when not to use the tool or mention alternatives, but given the sibling list, no direct alternative exists.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
detect_wireless_attackB
Unified wireless attack detection tool. Modes: wids_rules (WIDS/WIPS rule generation), sigma_gen (Sigma rule generation), forensics (forensics analysis guide), indicators (detection IoCs for attacks), monitor_setup (monitoring platform setup).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Operation mode to execute | |
| platform | No | Monitoring platform (required for monitor_setup mode) | |
| attack_id | No | Attack ID from knowledge base (required for sigma_gen and indicators modes) | |
| attack_type | No | Wireless attack type (required for wids_rules mode) | |
| artifact_type | No | Forensic artifact type (required for forensics mode) | |
| wids_platform | No | Target WIDS platform (used by wids_rules mode) | |
| monitoring_goal | No | Monitoring objective (required for monitor_setup mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It only lists mode outputs (e.g., rule generation, guide, indicators) without disclosing operations, side effects, or prerequisites. Agent lacks insight into what the tool actually does beyond generating text.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with clear enumeration of modes. Concise and front-loaded, but could be more structured (e.g., bullet format) for easier scanning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, yet description does not explain return values or behavior. Given 5 modes and 7 parameters, the description is incomplete—it omits output details and fails to specify action (e.g., returns text rules, guides, or recommendations).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with param descriptions. The description adds no extra semantic meaning beyond listing mode names; however, baseline is 3 due to high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Unified wireless attack detection tool' and enumerates five distinct modes, providing a specific verb+resource. This distinguishes it from more specialized sibling tools like scan_wifi_networks or analyze_deauth.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. The description lists modes but does not provide when-not or compare to siblings, leaving the agent to infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
export_reportA
Unified report export tool. Modes: json (export as JSON), markdown (export as Markdown report), executive_summary (generate executive summary), csv (export as CSV).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Export format / operation mode | |
| scope | No | Assessment scope description (required for executive_summary mode) | |
| title | No | Report title (required for markdown mode) | |
| findings | No | Findings data as JSON string (required for all modes) | |
| sections | No | JSON array of additional section names (used by markdown mode) | |
| risk_rating | No | Overall risk rating override (used by executive_summary mode) | |
| classification | No | Report classification marking (used by json mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It does not disclose side effects, permissions, rate limits, or whether the operation is read-only. While 'export' suggests non-destructive behavior, this is not explicitly stated, and there is no mention of output format or behavior beyond mode selection.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences: one sentence defining the tool's unified nature, and one sentence listing all modes. No redundant information; every word contributes to clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite 7 parameters, no output schema, and no behavioral details, the description is too minimal. It does not explain parameter dependencies (e.g., 'scope' required for executive_summary), error handling, or return format. The schema descriptions partially compensate, but overall completeness is insufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with descriptions for each parameter. The description adds value by explaining the purpose of each mode (e.g., 'export as JSON', 'generate executive summary'), which goes beyond the schema's enum listing.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a 'Unified report export tool' and lists four specific modes (json, markdown, executive_summary, csv) with their output types. This distinguishes it from sibling tools (all wireless security analyzers) and provides a specific verb-resource combination.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when exporting reports in various formats but does not give explicit when-to-use or when-not-to-use guidance. However, given the sibling tools are all wireless-focused, this is the only export tool, minimizing confusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_bluetooth_attacksB
Bluetooth attack technique lookup — search by CVE, protocol (BR/EDR, BLE, Mesh), severity, category. Get attack commands and assess target feasibility.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Operation mode: lookup (by ID), search (by criteria), by_cve (CVE search), commands (get attack commands), assess_target (feasibility analysis) | |
| cve_id | No | [by_cve] CVE identifier (e.g. 'CVE-2017-0781', 'CVE-2023-24023') | |
| category | No | [search] Filter by attack category | |
| protocol | No | [search, assess_target] Filter by Bluetooth protocol | |
| severity | No | [search] Filter by minimum severity level | |
| attack_id | No | [lookup, commands] Attack ID (e.g. 'blueborne', 'knob', 'bluffs', 'ble_gatt_abuse') | |
| bt_version | No | [assess_target] Target's Bluetooth version (e.g. '4.2', '5.0') | |
| max_stealth | No | [search] Maximum stealth score (1-5) | |
| target_address | No | [commands] Target Bluetooth address for command templating | |
| secure_connections | No | [assess_target] Whether Secure Connections is enabled on target |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears full responsibility. It only lists capabilities but does not disclose whether the tool is read-only, whether it has side effects, authentication needs, rate limits, or what the output format is. This lack of behavioral context is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is concise and front-loaded with the core purpose. It avoids unnecessary detail but could benefit from slight restructuring (e.g., bullets) for clarity. It is appropriately sized for the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 10 parameters, no output schema, and no annotations, the description provides a functional overview but lacks details about return values, error handling, parameter combinations, or prerequisites. It is adequate but not fully complete for an agent to use without additional inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, so the schema already documents each parameter's meaning. The description adds a high-level overview but no additional semantics beyond what the schema provides. With full schema coverage, a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool is for Bluetooth attack technique lookup, specifying search dimensions (CVE, protocol, severity, category) and actions (get commands, assess feasibility). It distinguishes from sibling tools like scan_bluetooth and analyze_ble by focusing on attack technique lookup rather than scanning or analysis.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for lookup and assessment but does not explicitly state when to use this tool versus alternatives like scan_bluetooth or lookup_wireless_cve. No exclusions or comparative guidance are provided, leaving the agent to infer.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_mousejackA
Composite tool for MouseJack wireless keyboard/mouse vulnerability assessment. Supports modes: scan (scan for vulnerable devices), assess (assess specific device vulnerability), inject (keystroke injection guide), defense (defense recommendations).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Mode: scan, assess, inject, or defense | |
| payload | No | Ducky Script payload for inject mode | |
| hardware | No | Scanning hardware for scan mode | |
| device_type | No | Device type for assess mode | |
| device_vendor | No | Device vendor for assess mode | |
| target_address | No | nRF24 device address for inject mode (e.g. '61:D9:50:3F:A8') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It names four modes and mentions hardware parameters, but does not disclose behavioral details such as what each mode does internally, potential destructive effects (e.g., keystroke injection), or authentication requirements. The description is adequate but lacks depth.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is concise and front-loaded with the tool's purpose. There is no irrelevant text, and every part contributes meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is composite with multiple modes and 6 parameters, but no output schema exists. The description does not explain what each mode returns (e.g., scan results format, inject confirmation). This is a significant gap for an agent to understand the tool's full behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%. The description adds minimal extra meaning beyond the schema: it lists modes but does not elaborate on parameter interactions or examples. For a compound tool with 6 parameters, the description could better explain parameter relevance per mode.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it's a composite tool for MouseJack vulnerability assessment and explicitly lists four modes (scan, assess, inject, defense). This distinguishes it from sibling tools like scan_wifi_networks or scan_bluetooth, which target different wireless protocols.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by listing modes, providing context for when to use each. However, it does not explicitly state when not to use this tool or mention alternatives among siblings, which are all different wireless domains.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_wifi_attacksA
Search and explore WiFi attacks in the knowledge base. Look up attacks by ID, search by protocol/category/severity, find by CVE or tool, get attack commands.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Search mode | |
| cve_id | No | CVE identifier (for find_by_cve mode) | |
| channel | No | Channel number (for get_commands mode) | |
| category | No | Category: handshake/protocol/implementation/infrastructure/client/dos/mitm (for search mode) | |
| protocol | No | Protocol filter: WPA/WPA2/WPA3/WEP/WPS/EAP/Open (for search mode) | |
| severity | No | Minimum severity: critical/high/medium/low (for search mode) | |
| attack_id | No | Attack ID (for lookup and get_commands modes) | |
| interface | No | Interface name (for get_commands mode) | |
| tool_name | No | Tool name (for find_by_tool mode) | |
| client_mac | No | Client MAC (for get_commands mode) | |
| max_stealth | No | Maximum stealth score 1-5 (for search mode) | |
| target_ssid | No | Target SSID (for get_commands mode) | |
| target_bssid | No | Target BSSID (for get_commands mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description bears full burden. It correctly implies that the tool performs read-only searches and explorations without destructive side effects. While it doesn't detail authentication or rate limits, the behavioral scope is clear and consistent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the core purpose and lists key modes. Every phrase contributes meaning, with no redundant or irrelevant text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (13 parameters, no output schema) and 100% schema coverage, the description sufficiently covers the tool's capabilities. It lacks details on return values but the modes are clearly explained, making it complete enough for an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with all parameters described. The description adds context by enumerating modes but does not explain parameter interplay or syntax beyond what the schema already provides, meeting the baseline expectation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: searching and exploring WiFi attacks in a knowledge base. It lists distinct actions (lookup by ID, search by protocol/category/severity, find by CVE/tool, get commands) which distinguishes it from sibling tools like scan_wifi_networks or analyze_wifi_security.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for querying attack data but does not explicitly guide when to use this tool versus alternatives. No exclusions or when-not-to-use instructions are provided, leaving ambiguity for an AI agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
lookup_hardwareA
Unified pentest hardware lookup tool. Modes: lookup (look up device by ID), search (search by category/price/capability), recommend (recommendations for use case), compare (side-by-side device comparison).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Operation mode to execute | |
| budget | No | Maximum budget in USD (used by recommend mode) | |
| category | No | Hardware category filter (used by search mode) | |
| device_a | No | First device ID for comparison (required for compare mode) | |
| device_b | No | Second device ID for comparison (required for compare mode) | |
| use_case | No | Use case for recommendation (required for recommend mode) | |
| max_price | No | Maximum price in USD (used by search mode) | |
| capability | No | Capability keyword (used by search mode) | |
| hardware_id | No | Hardware device ID (required for lookup mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It only describes modes but gives no information about side effects, data sources, rate limits, or whether it is read-only. This is insufficient for an agent to fully understand the tool's impact.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short, front-loaded sentences. No unnecessary words. Each sentence earns its place by stating the tool's purpose and listing modes with brief clarifications. Extremely concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description explains the tool's function and modes adequately, but given the complexity of 9 parameters and no output schema, it could benefit from details about return values, parameter interactions, or examples. It is minimally complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All parameters have schema descriptions (100% coverage). The description adds value by mapping parameters to modes (e.g., 'hardware_id' for lookup, 'use_case' for recommend), providing a high-level understanding beyond individual field descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a unified pentest hardware lookup tool and lists four specific modes: lookup, search, recommend, compare. This distinguishes it from sibling tools that focus on specific wireless technologies or attacks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description lists the modes but does not explicitly guide when to use each mode or when to prefer sibling tools. Usage context is implied but not stated, leaving room for ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
lookup_wireless_cveB
Unified wireless CVE lookup tool. Modes: lookup (look up CVE by ID), search (search by domain/severity/exploit), by_product (find CVEs by affected product), stats (database statistics).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Operation mode to execute | |
| cve_id | No | CVE identifier (required for lookup mode) | |
| domain | No | Wireless domain filter (used by search mode) | |
| product | No | Product name to search for (required for by_product mode) | |
| severity | No | Minimum severity filter (used by search mode) | |
| exploit_available | No | Filter for CVEs with public exploits (used by search mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears full responsibility for behavioral disclosure. It states the tool performs lookups and searches, but fails to mention whether it is read-only, requires authentication, has rate limits, or what side effects (if any) occur. Minimal behavioral context is given.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that efficiently conveys the core functionality and lists modes. Every word is meaningful, and the structure is front-loaded with the tool's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has six parameters, four modes, and no output schema, the description is incomplete. It does not specify what each mode returns, any constraints, or expected output format. The agent lacks information to correctly interpret results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage, so baseline is 3. The description does not add meaning beyond the schema; it merely repeats mode names. No examples, parameter interactions, or additional semantics are provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a unified wireless CVE lookup tool with four distinct modes (lookup, search, by_product, stats). This distinguishes it from sibling tools that focus on scanning, analyzing, or attacking wireless networks, not on vulnerability lookup.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description lists modes but does not provide explicit guidance on when to use each mode or when to choose an alternative sibling tool. Usage is implied by mode names (e.g., lookup for specific CVE, search for filtering), but no exclusions or context for selection are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
map_wireless_attckA
Unified wireless ATT&CK mapping tool. Modes: lookup (lookup technique by ID), coverage (full ATT&CK matrix coverage), by_tactic (attacks for a specific tactic), heatmap (heatmap data for visualization).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Operation mode to execute | |
| tactic | No | ATT&CK tactic (required for by_tactic mode) | |
| technique_id | No | MITRE ATT&CK technique ID (required for lookup mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full responsibility. It describes the tool as a 'mapping tool' without stating whether it is read-only, requires network access, or has side effects. The modes imply data retrieval, but the description does not clarify behavior (e.g., does it query external databases? Are results cached?). This is insufficient for safe agent decision-making.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the main purpose ('Unified wireless ATT&CK mapping tool'), and follows with a compact list of modes. Every word contributes information; there is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has four modes with different returns (lookup returns technique details, coverage returns full matrix, etc.), but the description does not explain what each mode outputs or what the return format is. No output schema exists. While the description covers the modes, it lacks details on data shape (e.g., heatmap data structure) and does not differentiate from sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with descriptions for all three parameters. The description adds value by explaining each mode's purpose beyond the schema's enum labels (e.g., 'lookup technique by ID' vs. just 'lookup'), and lists valid tactics for by_tactic mode. This enhances understanding of how parameters interact with modes.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as a 'wireless ATT&CK mapping tool,' specifies four distinct modes (lookup, coverage, by_tactic, heatmap), and distinguishes it from sibling tools that focus on scanning, analyzing, or attacking wireless networks. Verb 'map' plus 'wireless ATT&CK' is specific and concrete.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a concise usage guide for each mode (e.g., 'lookup technique by ID' for lookup mode), but does not explicitly state when to use this tool versus alternatives or note any prerequisites or exclusions. The sibling tools are not mentioned, so no comparative guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_bluetoothB
Bluetooth device reconnaissance — scan devices, enumerate services, analyze BLE GATT, check security configuration, identify Bluetooth version and vulnerabilities.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Operation mode: scan_devices (parse scan results), enumerate_services (SDP/GATT enum), check_security (config assessment), ble_scan (BLE advertisement parsing), identify_version (version + vuln mapping) | |
| protocol | No | [enumerate_services] Bluetooth protocol type | |
| scan_data | No | [scan_devices, ble_scan] Raw scan output text or JSON array of device objects | |
| bt_version | No | [check_security, identify_version] Bluetooth version (e.g. '4.2', '5.0') | |
| device_info | No | [identify_version] Device info string with LMP version, features, or BT version | |
| pairing_mode | No | [check_security] Pairing mode: JustWorks, Passkey, NumericComparison, OOB, Legacy, None | |
| device_address | No | [enumerate_services] Target Bluetooth device address (XX:XX:XX:XX:XX:XX) | |
| secure_connections | No | [check_security] Whether Secure Connections mode is enabled |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are absent, so description carries full burden. It lists what the tool does but does not disclose behavioral traits such as whether it is active/scans, potential destructiveness, permissions needed, or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence attempting to cover many capabilities; moderately sized but could be more structured or broken into bullet points for clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 8 parameters, high schema coverage, and no output schema, the description provides a reasonable overview but lacks usage context for each mode and expected output format.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so description adds minimal value over parameter descriptions. Baseline is 3; the description provides high-level context but no additional per-parameter detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function as Bluetooth reconnaissance including scanning, enumeration, security checks, and vulnerability identification. It distinguishes from sibling tools by covering a broad range of Bluetooth operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like find_bluetooth_attacks or analyze_ble. The description lists modes but does not specify scenarios or sequencing with sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_iot_wirelessB
Composite tool for IoT wireless protocol security scanning. Supports modes: lookup (look up attack by ID), search (search attacks by protocol/category), assess_protocol (assess protocol security), scan_guide (scanning setup guide), defense (defense recommendations).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Scan mode: lookup, search, assess_protocol, scan_guide, or defense | |
| version | No | Protocol version for assess_protocol mode | |
| category | No | Attack category filter for search mode | |
| hardware | No | Available hardware for scan_guide mode | |
| protocol | No | IoT protocol for search, assess_protocol, scan_guide, and defense modes | |
| attack_id | No | Attack ID for lookup mode | |
| deployment_type | No | Deployment type for defense mode | |
| encryption_enabled | No | Encryption status for assess_protocol mode |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It describes the tool as a 'composite tool' for scanning but does not disclose whether scanning is passive or active, whether it modifies anything, or any potential side effects (e.g., network disruption). The behavioral impact of each mode is not detailed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences: first states the tool's purpose, second lists modes and their functions. It is concise, front-loaded, and contains no redundant information. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 8 parameters (1 required) and no output schema, the description does not explain what each mode returns or the structure of results. For a composite tool with varied outputs (e.g., lookup returns attack details, scan_guide returns setup instructions), missing this information reduces completeness. No prerequisites or context are provided.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for all 8 parameters, including enum values. The description briefly explains each mode but adds little beyond the schema's parameter descriptions. For example, mode is already fully described in the schema. The description does not compensate further, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states it's a composite tool for IoT wireless protocol security scanning and lists five distinct modes. It uses specific verbs (scan) and resources (IoT wireless protocols), clearly defining its scope. This distinguishes it from sibling tools that focus on specific protocols (e.g., analyze_zigbee) by offering a composite structure.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description only lists the modes without providing any guidance on when to use this tool versus its siblings (e.g., analyze_zigbee, scan_bluetooth). There is no mention of prerequisites, alternative tools, or when-not-to-use scenarios. The agent has no basis to choose this over similar tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_wifi_networksC
WiFi network reconnaissance and analysis. Scan networks, analyze encryption, enumerate clients, check channel usage, assess handshake captures.
| Name | Required | Description | Default |
|---|---|---|---|
| pmf | No | PMF enabled (for check_encryption mode) | |
| auth | No | Auth method: PSK/Enterprise (for check_encryption mode) | |
| band | No | Band filter: 2.4, 5, 6 (for scan mode) | |
| mode | Yes | Scan mode | |
| ssid | No | Network SSID (for check_encryption mode) | |
| channel | No | Channel filter (for scan mode) | |
| ap_bssid | No | AP BSSID (for enumerate_clients mode) | |
| interface | No | Wireless interface (for scan mode) | |
| scan_data | No | Raw scan data (for channel_analysis mode) | |
| encryption | No | Encryption type: WEP/WPA/WPA2/WPA3/Open (for check_encryption mode) | |
| client_data | No | Raw client data (for enumerate_clients mode) | |
| handshake_data | No | Handshake description (for analyze_handshake mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears full responsibility. It lists actions (scan, analyze, enumerate) but does not disclose side effects, permissions, or hardware requirements. It lacks information on whether the tool modifies state, requires root, or has safety implications. The description is merely a feature list.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with a comma-separated list of capabilities. It is reasonably concise but lacks structure (e.g., bullet points or sections). It conveys core functions but could be more readable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 12 parameters and no output schema, the description is insufficient. It does not explain return values, error conditions, or how to chain with sibling tools. The agent lacks context for proper usage, especially given the many related tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear parameter descriptions. The tool description adds little beyond repeating the modes. It does not explain how parameters interact or provide format details. Baseline 3 is appropriate as the schema already documents parameters adequately.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is for WiFi network reconnaissance and analysis, listing specific capabilities like scanning, encryption analysis, client enumeration, etc. The name and description align, and it differentiates from sibling tools like 'scan_bluetooth' and 'scan_iot_wireless' by focusing on WiFi. However, it does not explicitly distinguish from similarly-named WiFi analysis tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus the many sibling tools (e.g., analyze_wifi_security, find_wifi_attacks). It does not mention prerequisites, alternative tools, or specific scenarios. The agent must infer from the list of capabilities.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simulate_evil_twinB
Evil Twin attack planning and defense. Plan attacks, configure EAP credential capture, design captive portals, generate detection rules.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Mode: plan attack, capture EAP creds, design portal, or detect/defend | |
| eap_method | No | EAP method (for eap_capture mode) | |
| target_org | No | Target org name (for captive_portal mode) | |
| environment | No | Environment description (for detect mode) | |
| portal_type | No | Portal type: login/update/terms (for captive_portal mode) | |
| target_ssid | No | Target SSID (for plan, eap_capture modes) | |
| deauth_needed | No | Whether deauth is needed (for plan mode) | |
| target_channel | No | Target channel (for plan mode) | |
| target_encryption | No | Target encryption (for plan mode) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It only lists modes without disclosing whether the tool actually executes attacks, captures credentials, or modifies the environment (e.g., it says 'design captive portals' but not if it creates files or connections). The behavioral impact is unclear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences; the first sentence repeats 'Evil Twin attack planning and defense' which is redundant. It could be more concise by merging. However, it front-loads the purpose and enumerates modes, so it is structurally adequate but not optimal.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description should explain what the tool returns, but it does not. Given the complexity of 4 modes and 9 parameters, the description is incomplete—it omits return values, side effects, and prerequisites, making it hard for an agent to use correctly without additional knowledge.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with each parameter having a brief description in the schema. The tool description groups parameters by mode (e.g., 'target_ssid' for plan mode) but does not add meaning beyond what the schema provides. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Evil Twin attack planning and defense. Plan attacks, configure EAP credential capture, design captive portals, generate detection rules.' It specifies the verb (simulate/plan) and resource (evil twin attacks) and distinguishes from siblings like scan_wifi_networks or analyze_wifi_security which are more about reconnaissance.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description lists four modes but does not provide guidance on when to use this tool versus the many sibling tools (e.g., when to simulate vs. scan or analyze). No explicit context for decision-making is given, leaving the agent to infer usage from the mode list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Most tools have distinct purposes (e.g., scan_wifi_networks vs. analyze_wifi_security), but some overlap exists, such as multiple WiFi auditing and analysis tools that could confuse an agent.
All tools use consistent snake_case with a verb_noun pattern (e.g., scan_wifi_networks, analyze_ble, export_report). Minor typo in map_wireless_attck does not affect overall consistency.
At 34 tools, the server is large but justified by the broad domain of wireless security. Each tool serves a specific sub-domain; however, a slightly smaller set might improve efficiency.
The server covers a vast range of wireless technologies (WiFi, Bluetooth, NFC, Cellular, IoT, etc.) with tools for reconnaissance, analysis, attack, defense, compliance, and reporting. No obvious gaps for the stated domain.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
MCP server for building and testing AI agents with multi-model experimentation and insights.
MCP server connecting AI agents to 100+ apps (Gmail, Slack, Notion, GitHub) via one-click OAuth.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
Related MCP Servers
- FlicenseNot gradedqualityBmaintenanceAn MCP server that exposes over 20 standard penetration testing utilities, such as Nmap, SQLMap, and OWASP ZAP, as callable tools for AI agents. It enables natural language control over complex security workflows for automated and interactive penetration testing.93
- AlicenseNot gradedqualityDmaintenanceA comprehensive MCP server that provides AI assistants with professional-grade network analysis capabilities, combining Wireshark packet analysis, nmap scanning, and threat intelligence for enhanced network troubleshooting and security analysis.MIT
- FlicenseNot gradedqualityBmaintenanceMCP server for auditing AI agent permissions and access by scanning for the trifecta of credentials, injection, and reach without heavy infrastructure.
- FlicenseNot gradedqualityDmaintenanceMCP server that provides AI clients with 26 security and developer tools, enabling tasks like JWT decoding, HTTP header analysis, and phishing URL inspection.
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/badchars/wifi-security-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server