Skip to main content
Glama
badchars

wifi-security-mcp-server

by badchars

The Problem

Wireless security assessment is one of the most fragmented disciplines in offensive security. WiFi auditing requires one set of tools, Bluetooth another, RF/SDR a third, IoT protocols yet another — and each domain has its own attack surface, its own vulnerabilities, its own compliance requirements. Today you run aircrack-ng for WPA, use Bettercap for BLE, fire up HackRF for SDR, consult different CVE databases for each chipset, reference NIST and PCI-DSS separately, and then spend hours manually correlating findings into a coherent assessment.

Traditional wireless security workflow:
  audit WiFi networks              ->  aircrack-ng / Wireshark / Kismet
  test Bluetooth security          ->  Bettercap / btlejack / Ubertooth
  analyze RF signals               ->  HackRF / GNU Radio / GQRX
  check NFC/RFID                   ->  Proxmark3 / libnfc
  assess cellular security         ->  srsRAN / OpenBTS
  test IoT protocols               ->  Zigbee sniffer / Z-Wave tools / MQTT clients
  look up wireless CVEs            ->  NVD / vendor advisories (manual search)
  check compliance                 ->  NIST / PCI-DSS / HIPAA docs (manual)
  map to MITRE ATT&CK              ->  ATT&CK Navigator (manual mapping)
  correlate everything             ->  copy-paste into a report
  ────────────────────────────────
  Total: hours per assessment, most of it context-switching between tools

wifi-security-mcp-server gives your AI agent 34 composite tools backed by 9 knowledge bases covering 139 individual capabilities via the Model Context Protocol. The agent analyzes networks, identifies vulnerabilities, maps attacks to MITRE ATT&CK, checks compliance, and generates actionable reports — in a single conversation.

With wifi-security-mcp-server:
  You: "Audit the wireless security of our office network running WPA2-Enterprise"

  Agent: -> scan_wifi_networks {encryption: "WPA2"}
         -> analyze_wifi_security {encryption: "WPA2-Enterprise", authentication: "EAP-PEAP"}
         -> find_wifi_attacks {target_type: "WPA2-Enterprise"}
         -> detect_wireless_attack {attack_indicators: "deauth frames"}
         -> audit_wireless_compliance {standard: "PCI-DSS", network_type: "WPA2-Enterprise"}
         -> "Your WPA2-Enterprise network has 3 critical findings:
            1. EAP-PEAP without certificate pinning — vulnerable to evil twin
               with hostapd-mana (MITRE T1557.002)
            2. No 802.11w (PMF) — susceptible to deauthentication attacks
               (MITRE T1498.001)
            3. PMKID hash extractable without client interaction — offline
               cracking possible with hashcat mode 22000
            PCI-DSS 4.0: 2 controls non-compliant (4.2.1, 11.2.1).
            Recommended: migrate to WPA3-Enterprise with SAE, enable PMF,
            deploy WIDS for rogue AP detection."

Related MCP server: Wireshark MCP Server

How It's Different

Existing tools give you raw packet captures and protocol-specific analysis. wifi-security-mcp-server gives your AI agent the ability to reason across all wireless domains simultaneously with deep knowledge-base backing.


Quick Start

Option 1: npx (no install)

npx wifi-security-mcp-server

All 34 tools work immediately. No API keys required — core functionality is knowledge-base driven.

Option 2: Clone

git clone https://github.com/badchars/wifi-security-mcp-server.git
cd wifi-security-mcp-server
bun install

Environment variables (optional)

# WiGLE — wardriving database for real-world WiFi network lookups
export WIGLE_API_KEY=your-key

# Kismet — live wireless intrusion detection
export KISMET_HOST=127.0.0.1      # Default: 127.0.0.1
export KISMET_PORT=2501           # Default: 2501
export KISMET_API_KEY=your-key

All API keys are optional. Without them, you still get full access to all 34 tools powered by 9 built-in knowledge bases covering WiFi attacks, Bluetooth attacks, RF/SDR, NFC/RFID, cellular, IoT, hardware databases, CVE intelligence, and compliance frameworks.

Connect to your AI agent

# With npx
claude mcp add wifi-security-mcp-server -- npx wifi-security-mcp-server

# With local clone
claude mcp add wifi-security-mcp-server -- bun run /path/to/wifi-security-mcp-server/src/index.ts

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "wifi-security": {
      "command": "npx",
      "args": ["-y", "wifi-security-mcp-server"],
      "env": {
        "WIGLE_API_KEY": "optional",
        "KISMET_HOST": "optional",
        "KISMET_PORT": "optional",
        "KISMET_API_KEY": "optional"
      }
    }
  }
}

Same JSON config format. Point the command to npx wifi-security-mcp-server or your local installation path.

Start querying

You: "What attacks are possible against a WPA3-SAE network and how do I test for them?"

That's it. The agent looks up attacks, maps them to MITRE ATT&CK, recommends tools, and provides step-by-step methodology — all from built-in knowledge bases.


What The AI Can Do

WiFi Security Assessment

You: "Analyze the security of a WPA2-PSK network with WPS enabled"

Agent: -> analyze_wifi_security {encryption: "WPA2-PSK", features: ["WPS"]}
       -> crack_wps {method: "pixie_dust"}
       -> analyze_pmkid {capture_method: "hcxdumptool"}
       -> find_wifi_attacks {target_type: "WPA2-PSK"}
       -> "Critical vulnerabilities found in WPA2-PSK + WPS configuration:
          1. WPS Pixie Dust Attack — PIN recoverable in seconds via
             offline brute-force of E-S1/E-S2 nonces (Reaver + PixieWPS).
             Gives full PSK recovery without client interaction.
          2. PMKID Attack — first packet of 4-way handshake contains
             PMKID hash, crackable offline with hashcat -m 22000.
             No deauth needed, no client needed.
          3. 4-Way Handshake Capture — EAPOL frames capturable with
             airodump-ng + deauth, then offline dictionary attack.
          Priority: Disable WPS immediately (highest risk), enforce
          strong 20+ char PSK, consider migration to WPA3-SAE."

Bluetooth & BLE Analysis

You: "What are the security risks of our BLE-based access control system?"

Agent: -> scan_bluetooth {scan_type: "BLE"}
       -> find_bluetooth_attacks {target_type: "BLE"}
       -> analyze_ble {feature: "GATT", pairing_method: "JustWorks"}
       -> "BLE access control system — 4 critical risks identified:
          1. JustWorks Pairing — no MITM protection. Attacker can
             intercept pairing with Ubertooth One (MITRE T1040).
          2. GATT Characteristic Sniffing — unlock commands sent in
             cleartext, replayable with gatttool (MITRE T1212).
          3. BLE Relay/Replay Attack — relay legitimate unlock signal
             using two devices + btlejack (MITRE T1557).
          4. MAC Address Tracking — static BLE MAC enables occupant
             tracking (MITRE T1592.002).
          Recommended: enforce LE Secure Connections (LESC) with
          Numeric Comparison, encrypt GATT characteristics, implement
          rolling nonces for replay protection."

IoT Wireless Audit

You: "Assess the wireless security of our smart building IoT deployment"

Agent: -> scan_iot_wireless {protocols: ["Zigbee", "Z-Wave", "MQTT"]}
       -> analyze_zigbee {network_key_type: "default"}
       -> find_mousejack {vendor: "Logitech"}
       -> analyze_wifi_security {encryption: "WPA2-PSK"}
       -> "Smart building IoT wireless assessment — 5 findings:
          1. Zigbee: Default trust center link key (ZigBeeAlliance09)
             allows network join interception with KillerBee (CRITICAL)
          2. MQTT: Broker on port 1883 without TLS — credentials
             and sensor data transmitted in cleartext
          3. Z-Wave: S0 security with known key exchange vulnerability
             — recommend S2 upgrade
          4. MouseJack: 3 Logitech Unifying receivers vulnerable to
             keystroke injection (CVE-2016-10761)
          5. WiFi: IoT devices on same VLAN as corporate — no
             network segmentation
          Priority remediation: MQTT TLS, Zigbee install codes,
          IoT VLAN isolation, replace vulnerable Logitech receivers."

Compliance Audit

You: "Check our hospital WiFi against HIPAA wireless requirements"

Agent: -> audit_wireless_compliance {standard: "HIPAA", network_type: "WPA2-Enterprise"}
       -> analyze_medical_wireless {device_types: ["infusion_pump", "patient_monitor"]}
       -> detect_wireless_attack {attack_indicators: "rogue_ap"}
       -> "HIPAA Wireless Compliance Audit — 6 findings:
          3 NON-COMPLIANT controls:
          - 164.312(a)(1): No wireless IDS deployed for rogue AP detection
          - 164.312(e)(1): Medical devices using WPA2-PSK (not Enterprise)
          - 164.312(e)(2): No wireless traffic encryption audit logging
          3 COMPLIANT controls:
          - 164.310(a)(1): Physical AP locations documented
          - 164.312(a)(2): 802.1X with RADIUS authentication
          - 164.312(d): Certificate-based EAP-TLS for staff devices
          Remediation plan: deploy WIDS (Kismet/AirMagnet), migrate
          medical devices to WPA2-Enterprise with MAB, enable wireless
          audit logging on WLAN controller."

Tools Reference (34 composite tools)

Tool

Description

scan_wifi_networks

Scan and analyze WiFi networks — discover SSIDs, channels, encryption types, signal strength, and security misconfigurations

analyze_wifi_security

Deep analysis of WiFi security configuration — encryption strength, authentication method, known weaknesses, attack surface

find_wifi_attacks

Find applicable attacks for a WiFi target — returns attack methodology, required tools, MITRE ATT&CK mapping, mitigations

simulate_evil_twin

Simulate and analyze evil twin AP attack scenarios — hostapd-mana configuration, captive portal, credential capture methodology

analyze_deauth

Analyze deauthentication attack vectors — 802.11w PMF status, deauth detection, countermeasures, WIDS integration

crack_wps

Analyze WPS cracking attack vectors — Pixie Dust, brute force, null PIN, default PIN generation, Reaver/Bully methodology

analyze_pmkid

Analyze PMKID-based attack vectors — clientless WPA/WPA2 cracking via hcxdumptool + hashcat mode 22000

audit_wifi67

Audit WiFi 6 (802.11ax) and WiFi 7 (802.11be) specific security features — OWE, SAE, Enhanced Open, Multi-Link Operation

Tool

Description

scan_bluetooth

Scan and analyze Bluetooth devices — BR/EDR classic and BLE discovery, service enumeration, pairing analysis

find_bluetooth_attacks

Find applicable Bluetooth attacks — BlueBorne, KNOB, BIAS, BLE relay, MITM, with tools and mitigations

analyze_ble

Deep analysis of BLE security — GATT services, pairing methods, LE Secure Connections, characteristic encryption

Tool

Description

analyze_rf_signal

Analyze RF signal security — frequency analysis, modulation identification, replay attack feasibility, SDR tool recommendations

Tool

Description

analyze_nfc_security

Analyze NFC/RFID security — card type identification, access control weaknesses, cloning feasibility, Proxmark3 methodology

Tool

Description

analyze_cellular_security

Analyze cellular network security — 2G/3G/4G/5G protocol weaknesses, IMSI catcher detection, fake base station analysis

Tool

Description

analyze_zigbee

Analyze Zigbee network security — trust center policy, network key management, KillerBee attack methodology

scan_iot_wireless

Scan IoT wireless protocols — Zigbee, Z-Wave, MQTT, LoRaWAN, CoAP discovery and vulnerability analysis

find_mousejack

Analyze MouseJack wireless keyboard/mouse vulnerabilities — keystroke injection, unencrypted HID, vendor-specific bypasses

Tool

Description

analyze_airgap

Analyze air-gap exfiltration techniques — electromagnetic, acoustic, thermal, optical covert channels and countermeasures

analyze_uwb

Analyze Ultra-Wideband (UWB) security — ranging manipulation, relay attacks on car key fobs and AirTags, distance fraud

analyze_wifi_csi

Analyze WiFi Channel State Information (CSI) security — passive sensing, activity recognition, keystroke inference risks

analyze_miracast

Analyze Miracast/WiFi Display security — WFD session hijacking, screen capture, unauthorized display access

analyze_wifi_direct

Analyze WiFi Direct (P2P) security — group owner negotiation attacks, WPS vulnerabilities in P2P, rogue group formation

analyze_drone_rf

Analyze drone RF security — control link hijacking, GPS spoofing, video downlink interception, counter-UAS techniques

Tool

Description

audit_wlan_controller

Audit WLAN controller configuration — Cisco WLC, Aruba, Meraki security settings, rogue AP policies, RF management

analyze_captive_portal

Analyze captive portal security — bypass techniques, credential harvesting risks, network isolation, guest VLAN security

detect_mac_randomization

Analyze MAC address randomization — iOS/Android/Windows implementation differences, tracking resistance, fingerprinting bypasses

analyze_hotspot20

Analyze Hotspot 2.0 (Passpoint) security — ANQP, OSU, automatic network selection risks, EAP method analysis

Tool

Description

lookup_wireless_cve

Look up wireless-specific CVEs — WiFi chipset vulnerabilities, Bluetooth stack CVEs, driver exploits, firmware bugs

lookup_hardware

Look up wireless security hardware — WiFi adapters, Bluetooth sniffers, SDR devices, capabilities, chipset compatibility

map_wireless_attck

Map wireless attacks to MITRE ATT&CK framework — technique IDs, tactic categories, detection strategies

analyze_medical_wireless

Analyze medical device wireless security — infusion pumps, pacemakers, patient monitors, FDA guidance, HIPAA requirements

Tool

Description

detect_wireless_attack

Detect wireless attacks in progress — deauth floods, evil twin, KARMA, rogue AP, BLE spoofing, RF jamming indicators

audit_wireless_compliance

Audit wireless network against compliance frameworks — PCI-DSS 4.0, HIPAA, NIST 800-153, FedRAMP, ISO 27001 wireless controls

Tool

Description

export_report

Export wireless security assessment report — findings, risk ratings, compliance status, remediation roadmap, executive summary


CLI Usage

# List all available tools
npx wifi-security-mcp-server --list

# Run any tool directly
npx wifi-security-mcp-server --tool scan_wifi_networks '{"encryption":"WPA2"}'
npx wifi-security-mcp-server --tool find_wifi_attacks '{"target_type":"WPA3-SAE"}'
npx wifi-security-mcp-server --tool analyze_ble '{"pairing_method":"JustWorks"}'
npx wifi-security-mcp-server --tool lookup_wireless_cve '{"keyword":"Broadcom WiFi"}'
npx wifi-security-mcp-server --tool audit_wireless_compliance '{"standard":"PCI-DSS"}'
npx wifi-security-mcp-server --tool analyze_zigbee '{"network_key_type":"default"}'
npx wifi-security-mcp-server --tool export_report '{"format":"json"}'

Knowledge Bases (9)

The server ships with 9 built-in knowledge bases — no API keys, no external dependencies, no rate limits. Every tool query is enriched with structured intelligence from these databases.

Knowledge Base

Entries

What it provides

WiFi Attacks

47 attacks

WPA/WPA2/WPA3 attack techniques, evil twin variants, PMKID, KRACK, FragAttacks, deauth, WPS exploits — each with tools, mitigations, MITRE ATT&CK mapping

Bluetooth Attacks

8 attacks

BlueBorne, KNOB, BIAS, BLE relay, MITM, BLE fuzzing, Bluetooth impersonation — with CVEs and detection strategies

RF/SDR Attacks

6 attacks

Replay attacks, jamming, signal injection, SDR-based interception, RF fingerprinting bypass, spectrum analysis techniques

NFC/RFID Attacks

6 attacks

Card cloning, relay attacks, MIFARE Classic cracking, NFC skimming, RFID fuzzing, access control bypass with Proxmark3

Cellular Attacks

6 attacks

IMSI catching, fake base station (Stingray), SS7 exploitation, 5G NAS vulnerabilities, downgrade attacks, VoLTE interception

IoT Attacks

6 attacks

Zigbee network key sniffing, Z-Wave S0 downgrade, MQTT credential harvesting, LoRaWAN ABP replay, MouseJack, BLE IoT relay

Hardware Database

12 devices

WiFi adapters (Alfa, TP-Link), Bluetooth sniffers (Ubertooth), SDR (HackRF, RTL-SDR), NFC (Proxmark3) — chipsets, capabilities, monitor mode support

CVE Database

17 CVEs

Wireless-specific CVEs for WiFi chipsets (Broadcom, Qualcomm, Intel), Bluetooth stacks, IoT firmware — severity, affected versions, exploit availability

Compliance Frameworks

5 frameworks

PCI-DSS 4.0, HIPAA, NIST SP 800-153, FedRAMP, ISO 27001 — wireless-specific controls, audit checklists, gap analysis


Architecture

src/
  index.ts                    # CLI entrypoint (--help, --list, stdio server)
  protocol/
    mcp-server.ts             # MCP server setup (stdio transport)
    tools.ts                  # Tool registry — all 34 composite tools assembled here
  types/
    index.ts                  # Shared types (ToolDef, ToolContext, ToolResult)
  knowledge/                  # 9 built-in knowledge bases
    wifi-attacks.ts           # 47 WiFi attack definitions
    bluetooth-attacks.ts      # 8 Bluetooth attack definitions
    rf-attacks.ts             # 6 RF/SDR attack definitions
    nfc-attacks.ts            # 6 NFC/RFID attack definitions
    cellular-attacks.ts       # 6 Cellular/5G attack definitions
    iot-attacks.ts            # 6 IoT attack definitions
    hardware.ts               # 12 hardware device profiles
    cve-database.ts           # 17 wireless CVEs
    compliance.ts             # 5 compliance frameworks
  wifi/                       # WiFi Core tools (8)
  bluetooth/                  # Bluetooth tools (3)
  rf/                         # RF/SDR tools (1)
  nfc/                        # NFC/RFID tools (1)
  cellular/                   # Cellular/5G tools (1)
  iot/                        # IoT Wireless tools (3)
  advanced/                   # Advanced Wireless tools (6)
  infrastructure/             # Infrastructure tools (4)
  intelligence/               # Intelligence tools (4)
  detection/                  # Detection tools (2)
  reporting/                  # Reporting tools (1)

Design decisions:

  • Knowledge-base driven — Unlike API-dependent tools, core functionality runs entirely offline from 9 built-in databases. No API keys, no rate limits, no external dependencies for the primary workflow.

  • 34 composite tools, 139 individual capabilities — Each tool is a composite that bundles related analyses. find_wifi_attacks doesn't just list attacks — it returns methodology, required hardware, MITRE ATT&CK mapping, detection strategies, and countermeasures.

  • 2 runtime dependencies — @modelcontextprotocol/sdk and zod. Nothing else. No native modules, no binary dependencies, no platform-specific code.

  • Optional live integration — WiGLE API for real-world network data, Kismet for live wireless IDS. Core analysis works without either.

  • Compliance-aware — Every finding is automatically mapped to relevant compliance frameworks (PCI-DSS, HIPAA, NIST, FedRAMP, ISO 27001) when applicable.

  • MITRE ATT&CK mapped — Attack techniques include ATT&CK technique IDs, tactic categories, and detection data sources for SOC integration.


Limitations

  • Knowledge bases are point-in-time snapshots — new attacks/CVEs require package updates

  • WiGLE integration requires a free API key for network lookups

  • Kismet live WIDS requires a running Kismet instance with API access

  • No active wireless transmission — the server provides intelligence and methodology, not packet injection

  • Hardware database covers the most common security research devices, not exhaustive

  • Compliance frameworks focus on wireless-specific controls, not full framework coverage

  • macOS / Linux tested (Windows not tested)


Part of the MCP Security Suite

Project

Domain

Tools

hackbrowser-mcp

Browser-based security testing

39 tools, Firefox, injection testing

cloud-audit-mcp

Cloud security (AWS/Azure/GCP)

38 tools, 60+ checks

github-security-mcp

GitHub security posture

39 tools, 45 checks

cve-mcp

Vulnerability intelligence

23 tools, 5 sources

osint-mcp-server

OSINT & reconnaissance

37 tools, 12 sources

darknet-mcp-server

Dark web & threat intelligence

66 tools, 16 sources

wifi-security-mcp-server

Wireless security intelligence

34 tools, 9 knowledge bases


Available Tools

34 tools
analyze_airgapA

Composite tool for air-gap exfiltration analysis. Supports modes: techniques (list exfiltration techniques), assess (assess feasibility), detect (detection methods), defense (hardening recommendations).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesMode: techniques, assess, detect, or defense
categoryNoTechnique category filter for techniques mode
technique_idNoTechnique ID for detect mode
threat_levelNoThreat level for defense mode
available_accessNoAvailable access vector for assess mode
target_environmentNoTarget environment for assess mode

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that the tool is a 'composite' and lists modes, but does not mention behavioral traits like read-only nature, required permissions, or output size. This is minimal but not misleading.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no wasted words. It front-loads the purpose and then lists modes efficiently. Structure is appropriate for the information conveyed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (composite with multiple modes and 6 parameters) and lack of output schema, the description is incomplete. It does not explain parameter dependencies (e.g., which parameters apply to which modes) or hint at the return format, leaving gaps for an AI agent to infer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds no additional meaning beyond the schema; the schema already documents each parameter's enums and descriptions. The tool description only elaborates on the mode parameter, not the others or their interdependencies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's domain (air-gap exfiltration analysis) and lists the four modes (techniques, assess, detect, defense), providing specific verb+resource for each. It distinguishes from the wireless-focused sibling tools by explicitly focusing on air-gap scenarios.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use each mode, giving clear context. However, it does not explicitly state when not to use the tool or name alternative tools, though the domain difference from siblings is implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_bleB

BLE security analysis — GATT service audit, pairing security assessment, sniffing guide, privacy/tracking analysis.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesOperation mode: gatt_audit (GATT service security), pairing_security (pairing method assessment), sniff_guide (BLE sniffing setup), privacy_check (address tracking risk)
servicesNo[gatt_audit] JSON array of GATT services with characteristics [{uuid, characteristics: [{uuid, properties: [read,write,...]}]}]
address_typeNo[privacy_check] BLE address type
pairing_methodNo[pairing_security] BLE pairing method in use
target_addressNo[sniff_guide] Target BLE device address (XX:XX:XX:XX:XX:XX)
io_capabilitiesNo[pairing_security] Device IO capabilities: NoInputNoOutput, DisplayOnly, DisplayYesNo, KeyboardOnly, KeyboardDisplay
protocol_versionNo[sniff_guide] BLE protocol version (e.g. '4.0', '5.0')

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations present, so description must bear full burden. It only lists analysis modes but does not disclose side effects, authentication requirements, rate limits, or whether any state is modified. For a security analysis tool, this is insufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence efficiently communicates purpose and modes. No redundant words, information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite detailed parameter schema, the description is too brief. It omits expected output, interpretation of results, and any usage context. With no output schema, the description should compensate by explaining what the tool returns for each mode.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with per-parameter descriptions that explain the mode-specific usage. The tool description adds no additional meaning beyond the schema; baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'BLE security analysis' and enumerates four specific modes (GATT audit, pairing security, sniffing guide, privacy check). This distinguishes it from sibling tools like scan_bluetooth and find_bluetooth_attacks which focus on discovery or attack finding, not security analysis.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this vs alternatives. The description only lists modes but does not compare to scan_bluetooth or other BLE tools. No cautionary notes or prerequisites provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_captive_portalB

Unified captive portal analysis tool. Modes: bypass (bypass techniques by portal type), assess (security assessment of portal implementation), defense (hardening recommendations by deployment type).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesOperation mode to execute
deploymentNoDeployment environment (required for defense mode)
portal_typeNoType of captive portal (required for bypass mode)
network_restrictionsNoKnown network restrictions (used by bypass mode)
implementation_detailsNoPortal implementation description (required for assess mode)

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It does not disclose critical behavioral traits such as whether the tool performs network interactions, is read-only or destructive, or requires permissions. The 'bypass' mode implies active engagement, but this is not clarified.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loads the purpose, and wastes no words. Every sentence adds value by stating the tool's nature and listing modes with one-line explanations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description should indicate what the tool returns (e.g., report, recommendations). It also lacks information about prerequisites (network connectivity) and limitations. The tool's modes are covered, but overall completeness is insufficient for confident usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds context by linking modes to parameters (e.g., bypass uses portal_type), but the schema descriptions already adequately describe each parameter's purpose. No significant extra meaning is added.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is a 'unified captive portal analysis tool' and lists three specific modes (bypass, assess, defense) with brief explanations. This distinguishes it from sibling tools which cover other wireless topics but not captive portals.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for captive portal analysis but provides no explicit guidance on when to use this tool versus alternatives (e.g., scan_wifi_networks) or when not to use it. No exclusions or prerequisites are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_cellular_securityA

Composite tool for comprehensive cellular network security analysis. Supports modes: lookup (look up attack by ID), search (search attacks by category/severity), imsi_detect (IMSI catcher detection guidance), assess (assess cellular security posture), defense (defense recommendations by threat model).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesAnalysis mode: lookup, search, imsi_detect, assess, or defense
carrierNoCarrier name for assess mode
categoryNoCategory filter for search mode
severityNoSeverity filter for search mode
attack_idNoAttack ID for lookup mode (e.g. 'imsi_catcher', 'ss7_intercept')
device_osNoDevice OS for imsi_detect mode
network_typeNoNetwork type for assess mode
threat_modelNoThreat model for defense mode
volte_enabledNoVoLTE status for assess mode
vowifi_enabledNoVoWiFi status for assess mode

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description indicates it is a composite tool with multiple modes, but lacks behavioral details such as rate limits, authorization needs, or side effects. With no annotations, the description provides moderate transparency but not in-depth.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that packs essential information, including all modes. It is front-loaded and efficient, though it could benefit from structured formatting for clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (10 parameters, multiple modes, no output schema), the description provides a useful overview but lacks details on return values or behavior per mode. It is adequate for basic understanding but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so all parameters have descriptions. The tool description adds high-level context for modes but does not significantly enhance understanding beyond what the schema already provides for individual parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states it is a composite tool for cellular network security analysis and lists all supported modes, clearly distinguishing it from sibling tools focused on Wi-Fi, Bluetooth, NFC, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage through mode names but does not provide explicit guidance on when to use this tool vs. alternatives or when not to use it. No exclusions or sibling comparisons are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_deauthA

Deauthentication attack analysis and defense. Analyze feasibility, generate detection rules, get attack commands, recommend defenses.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesMode: analyze feasibility, detect attacks, get commands, recommend defenses
countNoDeauth frame count (for commands mode)
interfaceNoInterface name (for commands mode)
client_macNoClient MAC (for commands mode)
target_pmfNoPMF status: enabled/disabled (for analyze mode)
edr_presentNoWhether WIDS/EDR is present (for analyze mode)
target_bandNoTarget band: 2.4/5/6 (for analyze mode)
target_bssidNoTarget BSSID (for commands mode)
wids_platformNoWIDS platform: Kismet/Snort/Suricata/custom (for detect mode)
infrastructureNoInfrastructure description (for defense mode)

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must carry full burden. It lists actions but does not disclose side effects (e.g., does 'get attack commands' imply execution? Are changes made to the system?). Lacks clarity on whether it is read-only or potentially destructive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero fluff. Each phrase adds distinct information (tool purpose, four modes). Efficient and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite 10 parameters and no output schema, the description fails to explain how parameters map to modes (e.g., which params are needed for 'analyze'). The schema provides some detail, but the description lacks integration. Adequate but incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so each parameter has a description that adds meaning (e.g., 'for detect mode'). The description enumerates modes but adds no value beyond the schema. Baseline 3 is appropriate as schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool is for 'Deauthentication attack analysis and defense' and lists four specific modes (analyze feasibility, generate detection rules, get attack commands, recommend defenses). This clearly distinguishes it from sibling tools like find_wifi_attacks (general discovery) and analyze_wifi_security (broader security analysis).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for deauth-specific tasks but provides no explicit guidance on when to use this tool versus alternatives like find_wifi_attacks or analyze_wifi_security. No 'when not to use' or prerequisites mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_drone_rfC

Composite tool for drone RF security analysis. Supports modes: detect (drone RF detection guide), analyze (analyze drone communication protocol), counter (counter-drone RF techniques).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesMode: detect, analyze, or counter
hardwareNoSDR hardware for detect mode
protocolNoDrone protocol for analyze mode
frequency_bandsNoFrequency bands for detect mode (e.g. ['2.4ghz', '5.8ghz'])

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It mentions 'composite tool' and 'guide', suggesting it is non-destructive, but does not detail behavior such as whether it requires active scanning, user input, or has side effects. Significant gaps remain.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence of 25 words, which is concise. It efficiently conveys the tool's purpose and modes. However, it could be better structured (e.g., bullet points) to improve readability for an AI agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (composite with 3 modes, 4 parameters, no output schema), the description is incomplete. It does not explain which parameters apply to which mode, nor does it hint at return values or output format. The schema partially compensates, but the description lacks essential context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds minimal value by briefly explaining each mode, but the schema already documents parameters with enums and descriptions. The description does not clarify mode-parameter relationships or provide additional semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states it is for drone RF security analysis with three modes (detect, analyze, counter), clearly specifying the resource and actions. It distinguishes from sibling tools that target other wireless technologies, making the purpose fairly clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. The description only lists the modes but does not explain when to choose this composite tool over other RF or wireless tools, nor does it mention any prerequisites or limitations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_hotspot20A

Unified Hotspot 2.0 / Passpoint analysis tool. Modes: assess (security assessment of HS20 configuration), attack (attack techniques and methodologies), defense (defense recommendations and hardening).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesOperation mode to execute
auth_methodNoAuthentication method (required for assess mode)
osu_enabledNoWhether OSU is enabled (used by assess mode)
hs20_versionNoHotspot 2.0 version (required for assess mode)

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It only names modes without explaining side effects, required permissions, or whether the tool is destructive. Lacks safety or impact information.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: first sentence states the main purpose, second lists modes with brief explanations. No wasted words, front-loaded key information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description should explain what each mode returns. It does not mention return values, expected results, or error conditions. For a multi-mode tool, this is a gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds value beyond the schema by stating that auth_method is required for assess mode, osu_enabled is used by assess mode, and hs20_version is required for assess mode. This clarifies parameter usage context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is a unified Hotspot 2.0 / Passpoint analysis tool with three distinct modes (assess, attack, defense). It differentiates from sibling tools by being specific to Hotspot 2.0, not general Wi-Fi analysis.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description lists modes but does not provide explicit guidance on when to use this tool versus alternatives like analyze_wifi_security or find_wifi_attacks. There is no 'when to use' or 'when not to use' advice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_medical_wirelessA

Unified medical wireless security tool. Modes: assess (risk assessment by device type and protocol), attacks (known attacks and CVEs for device type), defense (HIPAA-aligned hardening by deployment).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesOperation mode to execute
deploymentNoDeployment environment (required for defense mode)
device_typeNoMedical device type (required for assess and attacks modes)
wireless_protocolNoWireless protocol used by the device (required for assess mode)

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It lacks information on whether the tool is read-only or destructive, authentication requirements, or side effects. The 'defense' mode likely modifies settings, but this is not stated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences efficiently convey the tool's purpose and mode structure. Every word earns its place; no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 4 parameters and no output schema, the description covers the main behavioral aspects (modes, parameter dependencies). It lacks return value or error details, but overall provides sufficient context for an agent to understand core functionality.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds value by logically grouping parameters with modes (e.g., deployment for defense, device_type for assess/attacks, wireless_protocol for assess), providing context beyond the schema's simple 'required for' labels.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly defines it as a unified medical wireless security tool with three distinct modes (assess, attacks, defense), each briefly explained. This differentiates it from sibling tools that are focused on specific protocols or general wireless security.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for medical wireless contexts through the title and scope, but does not explicitly state when to choose this tool over siblings like scan_wifi_networks or analyze_zigbee. No exclusions or alternative recommendations are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_miracastB

Composite tool for wireless display (Miracast/AirPlay/Chromecast) security analysis. Supports modes: assess (assess protocol security), attack (attack techniques), defense (defense recommendations).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesMode: assess, attack, or defense
protocolNoWireless display protocol for assess and attack modes
pin_requiredNoWhether PIN is required (for assess mode)
target_displayNoTarget display name/identifier (for attack mode)

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It only states it is a 'composite tool' with modes but does not disclose behavioral traits such as potential destructiveness (e.g., attack mode), permissions needed, or any side effects. This is insufficient for safe invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one sentence, concise and front-loaded with the core purpose. It uses a colon to list modes efficiently, with no redundant information. Every word adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 4 parameters, no output schema, and no annotations, the description is too minimal. It does not explain return values, prerequisites, or behavior per mode. For a composite tool, more context is needed for effective use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%; each parameter already has a description. The tool description adds high-level context (e.g., modes and protocols) but does not provide additional semantic detail beyond what is in the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is a composite tool for wireless display (Miracast/AirPlay/Chromecast) security analysis with distinct modes. This differentiates it from sibling tools like scan_wifi_networks or analyze_ble, which target other protocols.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions three modes (assess, attack, defense) but does not provide explicit guidance on when to use this tool versus alternatives. The usage is implied by the protocol focus, but no when-not scenarios or alternative tool references are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_nfc_securityA

NFC/RFID security analysis — card identification, attack lookup, cloning guides (Mifare, HID, EM4100), EMV relay analysis, defense recommendations.

ParametersJSON Schema
NameRequiredDescriptionDefault
sakNo[identify_card] SAK value as hex string (HF cards)
atqaNo[identify_card] ATQA value as hex string (HF cards)
modeYesOperation mode: lookup_attack (by ID), search_attacks (by criteria), identify_card (from scan params), clone_guide (step-by-step cloning), defense (security recommendations)
categoryNo[search_attacks] Filter by attack category
protocolNo[search_attacks] Filter by protocol name (e.g. 'Mifare', 'HID', 'EM4100')
attack_idNo[lookup_attack] NFC/RFID attack ID (e.g. 'mifare_classic_darkside', 'emv_relay', 'lf_clone')
card_typeNo[clone_guide] Card type to clone
data_rateNo[identify_card] Data rate for LF cards
frequencyNo[search_attacks] Filter by frequency (e.g. '125 kHz', '13.56 MHz')
deploymentNo[defense] Deployment type for defense recommendations
known_keysNo[clone_guide] Known sector keys as comma-separated hex (for Mifare Classic)
modulationNo[identify_card] Modulation type for LF cards
uid_lengthNo[identify_card] UID length in bytes

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It implies a read/analyze tool but does not explicitly state that it is non-destructive or disclose any permissions, rate limits, or side effects. The modes suggest lookups and guides, which are typically safe, but not explicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that efficiently captures the tool's scope. It is front-loaded and concise, though slightly dense with bullet-style lists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (13 parameters, multiple modes), the description provides a useful summary but lacks detail on how to use each mode or which parameters are needed for each. However, the schema fills in the gaps, so overall it is minimally complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the description does not need to add much about parameters. It provides a high-level overview but no additional detail beyond what the schema already covers. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is for NFC/RFID security analysis, listing specific capabilities like card identification, attack lookup, cloning guides, and defense recommendations. It distinguishes itself from siblings which are primarily WiFi and Bluetooth tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for NFC/RFID security tasks but does not explicitly state when to use it over alternatives. The mode parameter provides some guidance, but there are no when-not or alternative tool mentions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_pmkidA

PMKID attack analysis. Assess feasibility, get capture commands (hcxdumptool), get cracking commands (hashcat) with optimized settings.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesMode: assess feasibility, get capture commands, or get cracking commands
rulesNoHashcat rules file (for crack_commands mode)
hardwareNoGPU hardware (for crack_commands mode)
wordlistNoWordlist path (for crack_commands mode)
hash_fileNoHash file path (for crack_commands mode)
interfaceNoInterface name (for capture_commands mode)
psk_lengthNoEstimated PSK length (for assess mode)
target_bssidNoTarget BSSID (for capture_commands mode)
target_roamingNo802.11r enabled (for assess mode)
target_encryptionNoTarget encryption (for assess mode)

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the tool 'gets' commands but does not clarify whether it executes them or merely outputs strings. Additionally, it omits any mention of prerequisites, permissions, or side effects, leaving behavioral traits partially unclear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that front-loads the core purpose ('PMKID attack analysis') and immediately lists the three modes and related tools. Every word adds value; there is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the three modes and the general purpose, but it lacks any mention of the output format (e.g., text, structured data, command lines). Without an output schema, the agent is left to infer what the tool returns. For a tool with 10 parameters and no output schema, this is a notable gap in completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds minimal extra meaning beyond the schema; it mentions 'optimized settings' but does not detail which parameters are relevant per mode. The schema already describes each parameter, so the description does not significantly enhance understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is for PMKID attack analysis, lists three specific modes (assess, capture commands, crack commands) and mentions exact tools (hcxdumptool, hashcat). This differentiates it from sibling tools like analyze_wifi_security or find_wifi_attacks which cover broader or different attack vectors.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The three modes explicitly guide usage: assess feasibility, get capture commands, or get cracking commands. While it does not compare directly to sibling tools, the mode enumeration makes clear when each function is appropriate, providing sufficient context for an agent to decide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_rf_signalC

RF signal analysis and attack planning — protocol identification, signal analysis, replay attack guides, SDR hardware selection and setup.

ParametersJSON Schema
NameRequiredDescriptionDefault
osNo[setup_guide] Target operating system
modeYesOperation mode: lookup_attack, search_attacks, analyze_signal, replay_guide, identify_protocol, hardware_guide, setup_guide, frequency_guide
budgetNo[hardware_guide] Maximum budget (e.g. '$100', '$500')
categoryNo[search_attacks] Attack category filter
hardwareNo[replay_guide] Hardware platform for replay commands
protocolNo[replay_guide, identify_protocol, frequency_guide] Protocol type or name (fixed_code/rolling_code for replay, or protocol name for identify/frequency)
severityNo[search_attacks] Minimum severity filter
use_caseNo[hardware_guide] Primary use case for hardware selection
attack_idNo[lookup_attack] RF attack ID (e.g. 'rolljam', 'subghz_replay', 'gps_spoofing')
bandwidthNo[analyze_signal] Signal bandwidth (e.g. '200 kHz', '1 MHz')
data_rateNo[identify_protocol] Detected data rate (e.g. '1 kbps', '250 kbps')
frequencyNo[search_attacks, analyze_signal, replay_guide, identify_protocol] Frequency (e.g. '433 MHz', '2.4 GHz')
modulationNo[analyze_signal, replay_guide, identify_protocol] Modulation type (ASK, FSK, GFSK, PSK, CSS, etc.)
sdr_hardwareNo[setup_guide] SDR hardware platform for setup instructions

TDQS

C2.7/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It mentions 'attack planning' and 'replay attack guides' which imply potentially destructive actions, but it does not disclose any behavioral traits such as required permissions, side effects, rate limits, or whether modifications are irreversible. This is a critical gap for a tool with attack capabilities.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that efficiently lists core capabilities. It is front-loaded with key terms, but could be more structured with bullet points or separation of modes for clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 14 parameters, 8 modes, and no output schema. The description is too vague to fully guide an agent; it does not explain what each mode returns, prerequisites, or how parameters interact. For a complex tool, this is incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and each parameter has a descriptive role (e.g., [setup_guide] for OS). The main description adds minimal additional meaning beyond the schema, just listing high-level capabilities. Baseline 3 is appropriate given the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the tool does 'RF signal analysis and attack planning' and lists specific capabilities like protocol identification, signal analysis, replay attack guides, and SDR hardware selection. This is a clear verb+resource, but it does not differentiate from sibling tools such as scan_wifi_networks or analyze_wifi_security which also involve RF analysis.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. The description lists operation modes but does not explain when each mode is appropriate or exclude sibling tools. For example, an agent might not know whether to use analyze_rf_signal or find_wifi_attacks for a specific task.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_uwbA

Composite tool for UWB (Ultra-Wideband) security analysis. Supports modes: assess (assess UWB security for a use case), attack (attack techniques including Ghost Peak), defense (secure ranging best practices).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesMode: assess, attack, or defense
use_caseNoUWB use case for assess mode

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It states the tool is composite and describes modes, but it does not disclose behavioral traits such as what happens when parameters are used in conflicting modes, whether the tool is destructive, rate limits, or output format. For a mutation-capable tool (attack mode), this lack of transparency is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise at two sentences, with a clear structure introducing the tool and listing modes. It is front-loaded with the purpose. However, it could be slightly more structured (e.g., bullet points for modes explicitly), but overall it is effective.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema or annotations exist. The description does not explain return values, error states, prerequisites, or confirm whether the tool modifies state. For a composite tool with multiple modes, this incompleteness leaves the agent with significant ambiguity about how to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the description adds value beyond the enum values by providing brief context: 'assess UWB security for a use case', 'attack techniques including Ghost Peak', 'secure ranging best practices'. It also clarifies that use_case is for assess mode, which the schema does not explicitly enforce.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is a composite tool for UWB security analysis with specific modes (assess, attack, defense). This distinguishes it from sibling tools which cover other wireless technologies like Wi-Fi, Bluetooth, etc. The verb 'analyze' and resource 'UWB' are specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions the three modes and briefly explains each, but does not provide explicit guidance on when to use this tool versus alternatives. While it is implied for UWB analysis, there is no mention of when not to use it or scenarios where other tools might be more appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_wifi_csiB

Composite tool for WiFi Channel State Information (CSI) sensing analysis. Supports modes: techniques (CSI sensing overview), privacy (privacy implications), detect (CSI surveillance detection).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesMode: techniques, privacy, or detect
scenarioNoEnvironment scenario for privacy mode

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must fully disclose behavioral traits. It only states it is a 'composite tool' and lists modes, but does not describe side effects, network activity, hardware requirements, or result types. This is insufficient for understanding the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, consisting of two sentences with the key information front-loaded. It wastes no words, but could benefit from better structuring (e.g., bullet points for modes). Still, it is efficient and easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description should explain return values or outcomes. It does not mention what each mode produces (e.g., overview, privacy risks, detection results). Additionally, prerequisites or limitations are omitted, leaving the tool's full functionality unclear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage with enum descriptions, so the description adds minimal extra meaning. It repeats the mode enum values in the description but does not explain specifics like what each mode does or how the scenario parameter affects behavior. Baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as a composite tool for WiFi CSI analysis and lists three distinct modes (techniques, privacy, detect). The verb 'analyze' and resource 'WiFi CSI' are specific, and the tool differentiates itself from siblings like 'scan_wifi_networks' and 'analyze_wifi_security' by focusing on CSI sensing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions three modes, giving some guidance on when to use each. However, it lacks explicit guidance on when not to use this tool or how it compares to alternatives like 'find_wifi_attacks' or 'analyze_wifi_security'. No exclusions or context for appropriate scenarios are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_wifi_directA

Composite tool for WiFi Direct (P2P) security analysis. Supports modes: assess (assess security posture), attack (attack techniques), defense (hardening recommendations).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesMode: assess, attack, or defense
go_intentNoWiFi Direct Group Owner intent 0-15 (for assess mode)
wps_methodNoWPS method (for assess mode)
persistent_groupNoPersistent group enabled (for assess mode)

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must fully convey behavioral traits. It mentions 'attack techniques' which may be destructive, but does not disclose side effects, permissions needed, or what the tool modifies. This is insufficient for a multi-mode tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with a parenthetical explanation of modes. No unnecessary words, and front-loaded with the tool's purpose and modes.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 4 parameters, no output schema, and multi-modal behavior, the description covers the modes but lacks information on return values, expected output per mode, or any preconditions. Adequate but with gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so each parameter already has a clear description. The tool description adds no further meaning to parameters besides grouping modes. Baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is a composite tool for WiFi Direct security analysis, with three distinct modes. This distinguishes it from sibling tools like analyze_wifi_security, which cover general WiFi, and the mention of P2P adds specificity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description lists modes but does not explicitly state when to use this tool versus alternatives like analyze_wifi_security or find_wifi_attacks. Usage context is implied but not directly stated, and no when-not guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_wifi_securityB

Comprehensive WiFi security analysis -- WPA/WPA2/WPA3 configuration assessment, PSK strength, EAP security, PMF status, protocol comparison, crack time estimation.

ParametersJSON Schema
NameRequiredDescriptionDefault
pskNoPSK key or description (for psk_strength mode)
modeYesAnalysis mode
hardwareNoHardware description (for crack_time mode)
hash_typeNoHash type: PMKID/handshake (for crack_time mode)
protocolsNoProtocol list to compare (for compare_protocols mode)
eap_methodNoEAP method (for eap_config mode)
pmf_statusNoPMF status: disabled/optional/required (for pmf_check mode)
psk_policyNoPSK policy description (for crack_time mode)
inner_methodNoInner auth method (for eap_config mode)
cert_validationNoCertificate validation (for eap_config mode)

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully convey behavioral traits. It mentions 'assessment' and 'estimation' but does not disclose whether the tool is read-only, destructive, or has any side effects. It lacks details on permissions, rate limits, or what happens to the system.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that efficiently conveys the tool's purpose. Every clause adds value, with no redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 10 parameters and no output schema, the description is incomplete. It does not explain return values, how modes work in detail, or the expected behavior for different inputs. The tool's complexity demands more guidance.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already describes each parameter. The description adds a summary of modes but does not provide additional meaning beyond the schema. Baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it performs comprehensive WiFi security analysis, listing specific areas like WPA/WPA2/WPA3 configuration, PSK strength, EAP security, PMF status, protocol comparison, and crack time estimation. This distinguishes it from sibling tools like scan_wifi_networks (scanning) and find_wifi_attacks (finding attacks).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description lists modes but provides no guidance on when to use this tool versus alternatives. There is no explicit when-to-use or when-not-to-use advice, making it hard for an agent to decide between this and sibling tools like crack_wps or analyze_pmkid.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_zigbeeB

Composite tool for Zigbee network security analysis. Supports modes: analyze (assess network security), sniff_guide (sniffing setup guide), key_extract (key extraction during join), replay (frame replay guide).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesAnalysis mode: analyze, sniff_guide, key_extract, or replay
channelNoZigbee channel 11-26 (for sniff_guide mode)
hardwareNoSniffing hardware (for sniff_guide mode)
join_methodNoJoin method (for key_extract mode)
security_levelNoZigbee security level (for analyze mode)
coordinator_infoNoCoordinator info (for analyze mode)
network_key_knownNoWhether network key is known (for analyze mode)
target_device_typeNoTarget device type (for replay mode)

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It only lists modes without disclosing behavioral traits such as destructiveness, authorization needs, or rate limits. Operations like key_extract may be active but are not described, leaving significant gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, using two sentences to convey the core purpose and modes. Although a bullet list could improve scannability, there is no wasted text. It is appropriately front-loaded with the primary purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (8 parameters, 4 modes, no output schema or annotations), the description is insufficient. It omits output behavior, mode-specific use cases, and prerequisites, leaving the agent without a complete understanding of what each mode entails.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so each parameter is already explained in the schema. The description adds no extra meaning beyond listing the mode names; it does not clarify parameter relationships or constraints beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is a composite tool for Zigbee network security analysis and lists four specific modes (analyze, sniff_guide, key_extract, replay). This uniquely identifies the tool's purpose and distinguishes it from sibling tools focused on other wireless protocols.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for Zigbee security analysis but provides no explicit guidance on when to use this tool over alternatives like scan_iot_wireless. It lacks when-not or direct comparisons, though sibling differentiation is somewhat inherent due to protocol specificity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

audit_wifi67C

WiFi 6/6E/7 security audit. Assess WiFi 6 features, WiFi 7 MLO security, compare generations, analyze new attack surfaces.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesMode: assess WiFi 6, assess WiFi 7 MLO, compare 6/6E/7, or analyze new attack surface
bandsNoActive bands (for wifi7_assess mode)
mlo_enabledNoMLO enabled (for wifi7_assess mode)
features_enabledNoWiFi 6 features list (for wifi6_assess mode)

TDQS

C2.7/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavioral traits. It fails to mention whether the tool is read-only, requires permissions, has side effects, or what outputs/results to expect. This is a critical gap for a security audit tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that front-loads the main purpose and lists key actions. It is concise with no wasted words, though it could benefit from slightly more structure (e.g., bullet points).

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has multiple modes and no output schema, the description should clarify what each mode returns (e.g., reports, vulnerabilities). It also lacks prerequisites or invocation context. The description is incomplete for effective agent use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents all parameter purposes. The description adds no new meaning beyond summarizing the modes, which the schema already enumerates. Baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states it is a WiFi 6/6E/7 security audit and lists four modes (assess, assess MLO, compare, attack surfaces), giving clear verb+resource. However, it does not explicitly differentiate from sibling tools like analyze_wifi_security or find_wifi_attacks, though the modes imply unique functionality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. With many sibling tools covering similar domains (scan_wifi_networks, analyze_wifi_security), the description lacks context for appropriate selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

audit_wireless_complianceA

Unified wireless compliance auditing tool. Modes: check (compliance check against framework), gap_analysis (identify gaps in deployed controls), compare_frameworks (compare all frameworks), report (generate compliance report).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesOperation mode to execute
findingsNoAssessment findings as JSON array (required for report mode)
frameworkNoCompliance framework (required for check, gap_analysis, report modes)
config_dataNoCurrent wireless configuration (used by check mode)
current_controlsNoDescription of deployed controls (required for gap_analysis mode)

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden for behavioral traits. It describes each mode's purpose and parameter requirements but omits side effects (e.g., read-only vs. mutation), access requirements, or error handling. The description is adequate but lacks depth.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact (two sentences) with a clear front-loaded statement and a structured list of modes. Every sentence adds value, though a very brief usage hint could further improve efficiency.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (5 params, 4 modes, no output schema), the description covers mode purposes and parameter dependencies adequately. It does not explain return format but the absence of output schema reduces the deficit. Sibling context reinforces its compliance niche.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the description adds context by linking parameters to specific modes (e.g., 'findings required for report mode') and enumerating modes without redundancy. This enhances the schema's per-parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states 'Unified wireless compliance auditing tool' and lists four distinct modes (check, gap_analysis, compare_frameworks, report), making the tool's purpose clear. It distinguishes itself from siblings focused on signal analysis or attacks by centering on compliance frameworks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage through mode enumeration but provides no explicit guidance on when to choose this tool over alternatives. It does not include when-not-to-use or exclusion criteria, leaving the agent to infer context from the tool name and sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

audit_wlan_controllerA

Unified WLAN controller auditing tool. Modes: audit_config (audit controller configuration), rogue_ap (rogue AP detection guidance), audit_ssid (SSID security assessment), hardening (vendor-specific hardening guide).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesOperation mode to execute
config_dataNoRaw WLAN controller configuration text (required for audit_config)
ssid_configNoSSID configuration as JSON string (required for audit_ssid)
wids_enabledNoWhether WIDS/WIPS is currently enabled (used by rogue_ap mode)
controller_typeNoWLAN controller vendor/platform type (required for audit_config, rogue_ap, hardening)

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the behavioral burden. It states the tool audits and guides but does not disclose side effects, required permissions, output format, or error behavior. For a read-like tool, it is minimally adequate but lacks depth.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that efficiently communicates the tool's purpose and modes. It is concise without being under-specified, earning a high score for structure, though a touch more detail on mode usage could improve clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given five parameters, no output schema, and no annotations, the description is incomplete. It does not explain return values, prerequisites, or post-condition effects. It provides enough to understand the tool's scope but not enough for fully informed invocation without external knowledge.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, meaning each parameter is already documented in the schema. The description does not add new semantic value beyond listing modes; it merely repeats the mode names. Baseline of 3 is appropriate as the schema handles parameter explanations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies it as a 'Unified WLAN controller auditing tool' and lists four distinct modes, making the purpose specific and unambiguous. Sibling tools like scan_wifi_networks or find_wifi_attacks focus on client-side or attack scanning, so this tool is well-differentiated as a controller-side auditing tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage via mode selection but does not explicitly state when to use this tool over siblings (e.g., when to choose audit_ssid mode vs analyze_wifi_security). No when-not-to-use or alternative recommendations are provided, leaving the agent to infer context from mode names alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

crack_wpsA

WPS security analysis and attack. Assess WPS vulnerabilities, get attack commands for brute force / Pixie Dust / null PIN, and defense recommendations.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesMode: assess vulnerabilities, get attack commands, or defense recommendations
methodNoAttack method: brute/pixiedust/null_pin (for attack_commands mode)
interfaceNoInterface name (for attack_commands mode)
wps_lockedNoWPS lock status (for assess mode)
wps_enabledNoWPS enabled status (for assess mode)
wps_versionNoWPS version (for assess mode)
target_bssidNoTarget BSSID (for attack_commands mode)

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description mentions attack commands including brute force, Pixie Dust, and null PIN, implying potentially destructive or intrusive behavior, but does not disclose prerequisites (e.g., monitor mode, root access) or ethical/legal warnings. No annotations exist to supplement this.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that efficiently conveys the tool's purpose and key modes, but it could be better structured (e.g., separated into bullet points or clearer sections). No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 7 parameters and no output schema, the description provides minimal guidance on what results to expect or how parameters interact. It covers the three modes sufficiently but lacks detail on output or usage order.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already explains each parameter. The description adds no new semantic value beyond summarizing the mode options. Baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly specifies the tool's purpose: WPS security analysis and attack, including specific modes (assess, attack_commands, defense). It distinguishes itself from sibling tools by focusing exclusively on WPS, not general Wi-Fi analysis.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description and mode parameter clearly indicate when to use which mode (assess, attack_commands, defense). However, it lacks explicit guidance on when not to use this tool or comparisons to alternatives like analyze_wifi_security or find_wifi_attacks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

detect_mac_randomizationA

Unified MAC randomization analysis tool. Modes: bypass (OS-specific bypass techniques), assess (implementation quality assessment per OS/version), tracking (device tracking techniques despite randomization).

ParametersJSON Schema
NameRequiredDescriptionDefault
osNoOperating system to assess (required for assess mode)
modeYesOperation mode to execute
versionNoOS version to assess (required for assess mode)
target_osNoTarget operating system (required for bypass mode)
target_versionNoTarget OS version (required for bypass mode)

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It describes the high-level modes but does not disclose behavioral details such as whether the tool is passive or active, required permissions, or potential side effects. More transparency is needed for safe invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, with two sentences plus a bullet-like list of modes. Every word is informative and contributes to understanding the tool's purpose and modes.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the high schema coverage and no output schema, the description adequately covers the core functionality (three modes). It does not explain return values, but the tool is a analysis tool with likely output that is self-explanatory. Overall, fairly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description does not add significant meaning beyond the schema; it explains modes but not parameter details. The schema already provides adequate descriptions for each parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is a unified MAC randomization analysis tool with three distinct modes (bypass, assess, tracking), each with a brief explanation. This distinguishes it from sibling tools, which focus on other wireless security aspects.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for each mode (bypass for OS-specific bypass techniques, assess for implementation quality, tracking for device tracking). It does not explicitly state when not to use the tool or mention alternatives, but given the sibling list, no direct alternative exists.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

detect_wireless_attackB

Unified wireless attack detection tool. Modes: wids_rules (WIDS/WIPS rule generation), sigma_gen (Sigma rule generation), forensics (forensics analysis guide), indicators (detection IoCs for attacks), monitor_setup (monitoring platform setup).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesOperation mode to execute
platformNoMonitoring platform (required for monitor_setup mode)
attack_idNoAttack ID from knowledge base (required for sigma_gen and indicators modes)
attack_typeNoWireless attack type (required for wids_rules mode)
artifact_typeNoForensic artifact type (required for forensics mode)
wids_platformNoTarget WIDS platform (used by wids_rules mode)
monitoring_goalNoMonitoring objective (required for monitor_setup mode)

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It only lists mode outputs (e.g., rule generation, guide, indicators) without disclosing operations, side effects, or prerequisites. Agent lacks insight into what the tool actually does beyond generating text.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with clear enumeration of modes. Concise and front-loaded, but could be more structured (e.g., bullet format) for easier scanning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, yet description does not explain return values or behavior. Given 5 modes and 7 parameters, the description is incomplete—it omits output details and fails to specify action (e.g., returns text rules, guides, or recommendations).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with param descriptions. The description adds no extra semantic meaning beyond listing mode names; however, baseline is 3 due to high coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Unified wireless attack detection tool' and enumerates five distinct modes, providing a specific verb+resource. This distinguishes it from more specialized sibling tools like scan_wifi_networks or analyze_deauth.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. The description lists modes but does not provide when-not or compare to siblings, leaving the agent to infer usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

export_reportA

Unified report export tool. Modes: json (export as JSON), markdown (export as Markdown report), executive_summary (generate executive summary), csv (export as CSV).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesExport format / operation mode
scopeNoAssessment scope description (required for executive_summary mode)
titleNoReport title (required for markdown mode)
findingsNoFindings data as JSON string (required for all modes)
sectionsNoJSON array of additional section names (used by markdown mode)
risk_ratingNoOverall risk rating override (used by executive_summary mode)
classificationNoReport classification marking (used by json mode)

TDQS

A3.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It does not disclose side effects, permissions, rate limits, or whether the operation is read-only. While 'export' suggests non-destructive behavior, this is not explicitly stated, and there is no mention of output format or behavior beyond mode selection.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences: one sentence defining the tool's unified nature, and one sentence listing all modes. No redundant information; every word contributes to clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite 7 parameters, no output schema, and no behavioral details, the description is too minimal. It does not explain parameter dependencies (e.g., 'scope' required for executive_summary), error handling, or return format. The schema descriptions partially compensate, but overall completeness is insufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage with descriptions for each parameter. The description adds value by explaining the purpose of each mode (e.g., 'export as JSON', 'generate executive summary'), which goes beyond the schema's enum listing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is a 'Unified report export tool' and lists four specific modes (json, markdown, executive_summary, csv) with their output types. This distinguishes it from sibling tools (all wireless security analyzers) and provides a specific verb-resource combination.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when exporting reports in various formats but does not give explicit when-to-use or when-not-to-use guidance. However, given the sibling tools are all wireless-focused, this is the only export tool, minimizing confusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_bluetooth_attacksB

Bluetooth attack technique lookup — search by CVE, protocol (BR/EDR, BLE, Mesh), severity, category. Get attack commands and assess target feasibility.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesOperation mode: lookup (by ID), search (by criteria), by_cve (CVE search), commands (get attack commands), assess_target (feasibility analysis)
cve_idNo[by_cve] CVE identifier (e.g. 'CVE-2017-0781', 'CVE-2023-24023')
categoryNo[search] Filter by attack category
protocolNo[search, assess_target] Filter by Bluetooth protocol
severityNo[search] Filter by minimum severity level
attack_idNo[lookup, commands] Attack ID (e.g. 'blueborne', 'knob', 'bluffs', 'ble_gatt_abuse')
bt_versionNo[assess_target] Target's Bluetooth version (e.g. '4.2', '5.0')
max_stealthNo[search] Maximum stealth score (1-5)
target_addressNo[commands] Target Bluetooth address for command templating
secure_connectionsNo[assess_target] Whether Secure Connections is enabled on target

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility. It only lists capabilities but does not disclose whether the tool is read-only, whether it has side effects, authentication needs, rate limits, or what the output format is. This lack of behavioral context is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is concise and front-loaded with the core purpose. It avoids unnecessary detail but could benefit from slight restructuring (e.g., bullets) for clarity. It is appropriately sized for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 10 parameters, no output schema, and no annotations, the description provides a functional overview but lacks details about return values, error handling, parameter combinations, or prerequisites. It is adequate but not fully complete for an agent to use without additional inference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, so the schema already documents each parameter's meaning. The description adds a high-level overview but no additional semantics beyond what the schema provides. With full schema coverage, a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool is for Bluetooth attack technique lookup, specifying search dimensions (CVE, protocol, severity, category) and actions (get commands, assess feasibility). It distinguishes from sibling tools like scan_bluetooth and analyze_ble by focusing on attack technique lookup rather than scanning or analysis.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for lookup and assessment but does not explicitly state when to use this tool versus alternatives like scan_bluetooth or lookup_wireless_cve. No exclusions or comparative guidance are provided, leaving the agent to infer.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_mousejackA

Composite tool for MouseJack wireless keyboard/mouse vulnerability assessment. Supports modes: scan (scan for vulnerable devices), assess (assess specific device vulnerability), inject (keystroke injection guide), defense (defense recommendations).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesMode: scan, assess, inject, or defense
payloadNoDucky Script payload for inject mode
hardwareNoScanning hardware for scan mode
device_typeNoDevice type for assess mode
device_vendorNoDevice vendor for assess mode
target_addressNonRF24 device address for inject mode (e.g. '61:D9:50:3F:A8')

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It names four modes and mentions hardware parameters, but does not disclose behavioral details such as what each mode does internally, potential destructive effects (e.g., keystroke injection), or authentication requirements. The description is adequate but lacks depth.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is concise and front-loaded with the tool's purpose. There is no irrelevant text, and every part contributes meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is composite with multiple modes and 6 parameters, but no output schema exists. The description does not explain what each mode returns (e.g., scan results format, inject confirmation). This is a significant gap for an agent to understand the tool's full behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%. The description adds minimal extra meaning beyond the schema: it lists modes but does not elaborate on parameter interactions or examples. For a compound tool with 6 parameters, the description could better explain parameter relevance per mode.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it's a composite tool for MouseJack vulnerability assessment and explicitly lists four modes (scan, assess, inject, defense). This distinguishes it from sibling tools like scan_wifi_networks or scan_bluetooth, which target different wireless protocols.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by listing modes, providing context for when to use each. However, it does not explicitly state when not to use this tool or mention alternatives among siblings, which are all different wireless domains.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_wifi_attacksA

Search and explore WiFi attacks in the knowledge base. Look up attacks by ID, search by protocol/category/severity, find by CVE or tool, get attack commands.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesSearch mode
cve_idNoCVE identifier (for find_by_cve mode)
channelNoChannel number (for get_commands mode)
categoryNoCategory: handshake/protocol/implementation/infrastructure/client/dos/mitm (for search mode)
protocolNoProtocol filter: WPA/WPA2/WPA3/WEP/WPS/EAP/Open (for search mode)
severityNoMinimum severity: critical/high/medium/low (for search mode)
attack_idNoAttack ID (for lookup and get_commands modes)
interfaceNoInterface name (for get_commands mode)
tool_nameNoTool name (for find_by_tool mode)
client_macNoClient MAC (for get_commands mode)
max_stealthNoMaximum stealth score 1-5 (for search mode)
target_ssidNoTarget SSID (for get_commands mode)
target_bssidNoTarget BSSID (for get_commands mode)

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description bears full burden. It correctly implies that the tool performs read-only searches and explorations without destructive side effects. While it doesn't detail authentication or rate limits, the behavioral scope is clear and consistent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that front-loads the core purpose and lists key modes. Every phrase contributes meaning, with no redundant or irrelevant text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (13 parameters, no output schema) and 100% schema coverage, the description sufficiently covers the tool's capabilities. It lacks details on return values but the modes are clearly explained, making it complete enough for an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with all parameters described. The description adds context by enumerating modes but does not explain parameter interplay or syntax beyond what the schema already provides, meeting the baseline expectation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: searching and exploring WiFi attacks in a knowledge base. It lists distinct actions (lookup by ID, search by protocol/category/severity, find by CVE/tool, get commands) which distinguishes it from sibling tools like scan_wifi_networks or analyze_wifi_security.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for querying attack data but does not explicitly guide when to use this tool versus alternatives. No exclusions or when-not-to-use instructions are provided, leaving ambiguity for an AI agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lookup_hardwareA

Unified pentest hardware lookup tool. Modes: lookup (look up device by ID), search (search by category/price/capability), recommend (recommendations for use case), compare (side-by-side device comparison).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesOperation mode to execute
budgetNoMaximum budget in USD (used by recommend mode)
categoryNoHardware category filter (used by search mode)
device_aNoFirst device ID for comparison (required for compare mode)
device_bNoSecond device ID for comparison (required for compare mode)
use_caseNoUse case for recommendation (required for recommend mode)
max_priceNoMaximum price in USD (used by search mode)
capabilityNoCapability keyword (used by search mode)
hardware_idNoHardware device ID (required for lookup mode)

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It only describes modes but gives no information about side effects, data sources, rate limits, or whether it is read-only. This is insufficient for an agent to fully understand the tool's impact.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short, front-loaded sentences. No unnecessary words. Each sentence earns its place by stating the tool's purpose and listing modes with brief clarifications. Extremely concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description explains the tool's function and modes adequately, but given the complexity of 9 parameters and no output schema, it could benefit from details about return values, parameter interactions, or examples. It is minimally complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All parameters have schema descriptions (100% coverage). The description adds value by mapping parameters to modes (e.g., 'hardware_id' for lookup, 'use_case' for recommend), providing a high-level understanding beyond individual field descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is a unified pentest hardware lookup tool and lists four specific modes: lookup, search, recommend, compare. This distinguishes it from sibling tools that focus on specific wireless technologies or attacks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description lists the modes but does not explicitly guide when to use each mode or when to prefer sibling tools. Usage context is implied but not stated, leaving room for ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lookup_wireless_cveB

Unified wireless CVE lookup tool. Modes: lookup (look up CVE by ID), search (search by domain/severity/exploit), by_product (find CVEs by affected product), stats (database statistics).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesOperation mode to execute
cve_idNoCVE identifier (required for lookup mode)
domainNoWireless domain filter (used by search mode)
productNoProduct name to search for (required for by_product mode)
severityNoMinimum severity filter (used by search mode)
exploit_availableNoFilter for CVEs with public exploits (used by search mode)

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility for behavioral disclosure. It states the tool performs lookups and searches, but fails to mention whether it is read-only, requires authentication, has rate limits, or what side effects (if any) occur. Minimal behavioral context is given.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that efficiently conveys the core functionality and lists modes. Every word is meaningful, and the structure is front-loaded with the tool's purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has six parameters, four modes, and no output schema, the description is incomplete. It does not specify what each mode returns, any constraints, or expected output format. The agent lacks information to correctly interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage, so baseline is 3. The description does not add meaning beyond the schema; it merely repeats mode names. No examples, parameter interactions, or additional semantics are provided.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is a unified wireless CVE lookup tool with four distinct modes (lookup, search, by_product, stats). This distinguishes it from sibling tools that focus on scanning, analyzing, or attacking wireless networks, not on vulnerability lookup.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description lists modes but does not provide explicit guidance on when to use each mode or when to choose an alternative sibling tool. Usage is implied by mode names (e.g., lookup for specific CVE, search for filtering), but no exclusions or context for selection are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

map_wireless_attckA

Unified wireless ATT&CK mapping tool. Modes: lookup (lookup technique by ID), coverage (full ATT&CK matrix coverage), by_tactic (attacks for a specific tactic), heatmap (heatmap data for visualization).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesOperation mode to execute
tacticNoATT&CK tactic (required for by_tactic mode)
technique_idNoMITRE ATT&CK technique ID (required for lookup mode)

TDQS

A3.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full responsibility. It describes the tool as a 'mapping tool' without stating whether it is read-only, requires network access, or has side effects. The modes imply data retrieval, but the description does not clarify behavior (e.g., does it query external databases? Are results cached?). This is insufficient for safe agent decision-making.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the main purpose ('Unified wireless ATT&CK mapping tool'), and follows with a compact list of modes. Every word contributes information; there is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has four modes with different returns (lookup returns technique details, coverage returns full matrix, etc.), but the description does not explain what each mode outputs or what the return format is. No output schema exists. While the description covers the modes, it lacks details on data shape (e.g., heatmap data structure) and does not differentiate from sibling tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with descriptions for all three parameters. The description adds value by explaining each mode's purpose beyond the schema's enum labels (e.g., 'lookup technique by ID' vs. just 'lookup'), and lists valid tactics for by_tactic mode. This enhances understanding of how parameters interact with modes.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as a 'wireless ATT&CK mapping tool,' specifies four distinct modes (lookup, coverage, by_tactic, heatmap), and distinguishes it from sibling tools that focus on scanning, analyzing, or attacking wireless networks. Verb 'map' plus 'wireless ATT&CK' is specific and concrete.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a concise usage guide for each mode (e.g., 'lookup technique by ID' for lookup mode), but does not explicitly state when to use this tool versus alternatives or note any prerequisites or exclusions. The sibling tools are not mentioned, so no comparative guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_bluetoothB

Bluetooth device reconnaissance — scan devices, enumerate services, analyze BLE GATT, check security configuration, identify Bluetooth version and vulnerabilities.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesOperation mode: scan_devices (parse scan results), enumerate_services (SDP/GATT enum), check_security (config assessment), ble_scan (BLE advertisement parsing), identify_version (version + vuln mapping)
protocolNo[enumerate_services] Bluetooth protocol type
scan_dataNo[scan_devices, ble_scan] Raw scan output text or JSON array of device objects
bt_versionNo[check_security, identify_version] Bluetooth version (e.g. '4.2', '5.0')
device_infoNo[identify_version] Device info string with LMP version, features, or BT version
pairing_modeNo[check_security] Pairing mode: JustWorks, Passkey, NumericComparison, OOB, Legacy, None
device_addressNo[enumerate_services] Target Bluetooth device address (XX:XX:XX:XX:XX:XX)
secure_connectionsNo[check_security] Whether Secure Connections mode is enabled

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are absent, so description carries full burden. It lists what the tool does but does not disclose behavioral traits such as whether it is active/scans, potential destructiveness, permissions needed, or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence attempting to cover many capabilities; moderately sized but could be more structured or broken into bullet points for clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 8 parameters, high schema coverage, and no output schema, the description provides a reasonable overview but lacks usage context for each mode and expected output format.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so description adds minimal value over parameter descriptions. Baseline is 3; the description provides high-level context but no additional per-parameter detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function as Bluetooth reconnaissance including scanning, enumeration, security checks, and vulnerability identification. It distinguishes from sibling tools by covering a broad range of Bluetooth operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like find_bluetooth_attacks or analyze_ble. The description lists modes but does not specify scenarios or sequencing with sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_iot_wirelessB

Composite tool for IoT wireless protocol security scanning. Supports modes: lookup (look up attack by ID), search (search attacks by protocol/category), assess_protocol (assess protocol security), scan_guide (scanning setup guide), defense (defense recommendations).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesScan mode: lookup, search, assess_protocol, scan_guide, or defense
versionNoProtocol version for assess_protocol mode
categoryNoAttack category filter for search mode
hardwareNoAvailable hardware for scan_guide mode
protocolNoIoT protocol for search, assess_protocol, scan_guide, and defense modes
attack_idNoAttack ID for lookup mode
deployment_typeNoDeployment type for defense mode
encryption_enabledNoEncryption status for assess_protocol mode

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It describes the tool as a 'composite tool' for scanning but does not disclose whether scanning is passive or active, whether it modifies anything, or any potential side effects (e.g., network disruption). The behavioral impact of each mode is not detailed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences: first states the tool's purpose, second lists modes and their functions. It is concise, front-loaded, and contains no redundant information. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 8 parameters (1 required) and no output schema, the description does not explain what each mode returns or the structure of results. For a composite tool with varied outputs (e.g., lookup returns attack details, scan_guide returns setup instructions), missing this information reduces completeness. No prerequisites or context are provided.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for all 8 parameters, including enum values. The description briefly explains each mode but adds little beyond the schema's parameter descriptions. For example, mode is already fully described in the schema. The description does not compensate further, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states it's a composite tool for IoT wireless protocol security scanning and lists five distinct modes. It uses specific verbs (scan) and resources (IoT wireless protocols), clearly defining its scope. This distinguishes it from sibling tools that focus on specific protocols (e.g., analyze_zigbee) by offering a composite structure.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description only lists the modes without providing any guidance on when to use this tool versus its siblings (e.g., analyze_zigbee, scan_bluetooth). There is no mention of prerequisites, alternative tools, or when-not-to-use scenarios. The agent has no basis to choose this over similar tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_wifi_networksC

WiFi network reconnaissance and analysis. Scan networks, analyze encryption, enumerate clients, check channel usage, assess handshake captures.

ParametersJSON Schema
NameRequiredDescriptionDefault
pmfNoPMF enabled (for check_encryption mode)
authNoAuth method: PSK/Enterprise (for check_encryption mode)
bandNoBand filter: 2.4, 5, 6 (for scan mode)
modeYesScan mode
ssidNoNetwork SSID (for check_encryption mode)
channelNoChannel filter (for scan mode)
ap_bssidNoAP BSSID (for enumerate_clients mode)
interfaceNoWireless interface (for scan mode)
scan_dataNoRaw scan data (for channel_analysis mode)
encryptionNoEncryption type: WEP/WPA/WPA2/WPA3/Open (for check_encryption mode)
client_dataNoRaw client data (for enumerate_clients mode)
handshake_dataNoHandshake description (for analyze_handshake mode)

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description bears full responsibility. It lists actions (scan, analyze, enumerate) but does not disclose side effects, permissions, or hardware requirements. It lacks information on whether the tool modifies state, requires root, or has safety implications. The description is merely a feature list.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with a comma-separated list of capabilities. It is reasonably concise but lacks structure (e.g., bullet points or sections). It conveys core functions but could be more readable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 12 parameters and no output schema, the description is insufficient. It does not explain return values, error conditions, or how to chain with sibling tools. The agent lacks context for proper usage, especially given the many related tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with clear parameter descriptions. The tool description adds little beyond repeating the modes. It does not explain how parameters interact or provide format details. Baseline 3 is appropriate as the schema already documents parameters adequately.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is for WiFi network reconnaissance and analysis, listing specific capabilities like scanning, encryption analysis, client enumeration, etc. The name and description align, and it differentiates from sibling tools like 'scan_bluetooth' and 'scan_iot_wireless' by focusing on WiFi. However, it does not explicitly distinguish from similarly-named WiFi analysis tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus the many sibling tools (e.g., analyze_wifi_security, find_wifi_attacks). It does not mention prerequisites, alternative tools, or specific scenarios. The agent must infer from the list of capabilities.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

simulate_evil_twinB

Evil Twin attack planning and defense. Plan attacks, configure EAP credential capture, design captive portals, generate detection rules.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYesMode: plan attack, capture EAP creds, design portal, or detect/defend
eap_methodNoEAP method (for eap_capture mode)
target_orgNoTarget org name (for captive_portal mode)
environmentNoEnvironment description (for detect mode)
portal_typeNoPortal type: login/update/terms (for captive_portal mode)
target_ssidNoTarget SSID (for plan, eap_capture modes)
deauth_neededNoWhether deauth is needed (for plan mode)
target_channelNoTarget channel (for plan mode)
target_encryptionNoTarget encryption (for plan mode)

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It only lists modes without disclosing whether the tool actually executes attacks, captures credentials, or modifies the environment (e.g., it says 'design captive portals' but not if it creates files or connections). The behavioral impact is unclear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences; the first sentence repeats 'Evil Twin attack planning and defense' which is redundant. It could be more concise by merging. However, it front-loads the purpose and enumerates modes, so it is structurally adequate but not optimal.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description should explain what the tool returns, but it does not. Given the complexity of 4 modes and 9 parameters, the description is incomplete—it omits return values, side effects, and prerequisites, making it hard for an agent to use correctly without additional knowledge.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with each parameter having a brief description in the schema. The tool description groups parameters by mode (e.g., 'target_ssid' for plan mode) but does not add meaning beyond what the schema provides. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Evil Twin attack planning and defense. Plan attacks, configure EAP credential capture, design captive portals, generate detection rules.' It specifies the verb (simulate/plan) and resource (evil twin attacks) and distinguishes from siblings like scan_wifi_networks or analyze_wifi_security which are more about reconnaissance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description lists four modes but does not provide guidance on when to use this tool versus the many sibling tools (e.g., when to simulate vs. scan or analyze). No explicit context for decision-making is given, leaving the agent to infer usage from the mode list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

A3.6/5.0
Disambiguation4/5

Most tools have distinct purposes (e.g., scan_wifi_networks vs. analyze_wifi_security), but some overlap exists, such as multiple WiFi auditing and analysis tools that could confuse an agent.

Naming Consistency5/5

All tools use consistent snake_case with a verb_noun pattern (e.g., scan_wifi_networks, analyze_ble, export_report). Minor typo in map_wireless_attck does not affect overall consistency.

Tool Count4/5

At 34 tools, the server is large but justified by the broad domain of wireless security. Each tool serves a specific sub-domain; however, a slightly smaller set might improve efficiency.

Completeness5/5

The server covers a vast range of wireless technologies (WiFi, Bluetooth, NFC, Cellular, IoT, etc.) with tools for reconnaissance, analysis, attack, defense, compliance, and reporting. No obvious gaps for the stated domain.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    B
    maintenance
    An MCP server that exposes over 20 standard penetration testing utilities, such as Nmap, SQLMap, and OWASP ZAP, as callable tools for AI agents. It enables natural language control over complex security workflows for automated and interactive penetration testing.
    93
  • A
    license
    Not graded
    quality
    D
    maintenance
    A comprehensive MCP server that provides AI assistants with professional-grade network analysis capabilities, combining Wireshark packet analysis, nmap scanning, and threat intelligence for enhanced network troubleshooting and security analysis.
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    MCP server that provides AI clients with 26 security and developer tools, enabling tasks like JWT decoding, HTTP header analysis, and phishing URL inspection.

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/badchars/wifi-security-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server