AnJian Agent
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| anjian_doctorC | 只读检查安鉴台、外部安全工具和报告能力，不对任何网络目标执行检查。 |
| anjian_quick_assessA | 一键深度评估已登记目标：自动运行可用的非破坏性工具、合并证据并生成 Markdown 报告。只需网址。 |
| anjian_list_authorized_targetsA | 只读列出已通过本机终端一次性确认的一键评估目标，不访问任何网站。 |
| anjian_create_assessmentB | 创建严格限定目标、端口和有效期的授权评估。不会运行网络检查。 |
| anjian_list_assessmentsC | 列出本机安鉴台评估及最近运行编号。 |
| anjian_get_assessmentC | 读取一个评估的授权范围、最近观察与人工确认结果。 |
| anjian_capability_planC | 根据本机真实工具状态生成分层执行计划，并说明其他 Claude MCP 的安全路由。 |
| anjian_run_assessmentC | 运行授权评估。active 只有在用户已通过终端单独解锁时才会执行。 |
| anjian_import_web_evidenceA | 导入 Burp XML 或 HAR；只保存授权范围内的脱敏元数据，不保存 Cookie、令牌或正文。 |
| anjian_import_pcapA | 使用 TShark 只读分析指定 PCAP/PCAPNG，不启动全机抓包，不导出载荷。 |
| anjian_scan_sourceC | 扫描用户明确提供的本地源码目录，结果脱敏并并入统一报告。 |
| anjian_run_controlled_active_toolC | 运行终端已按工具解锁的受控 SQLMap/FFUF；MCP 本身无权授权或扩大范围。 |
| anjian_consolidateC | 合并所有运行、Burp/HAR、PCAP 与源码结果，按资产和问题指纹去重并标记交叉印证。 |
| anjian_validate_observationC | 记录人工辅助复核决定。必须说明复现、适用条件或误报理由，交付前仍需人类最终审阅。 |
| anjian_generate_reportC | 从最近运行生成中文 Markdown/HTML/Obsidian 报告和 SHA-256 清单。 |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| authorized_web_assessment | 生成一套不会绕过授权门禁的网站安全评估工作流。 |
| authorized_full_assessment | 生成覆盖 Web、Burp、PCAP、源码和受控主动工具的完整授权工作流。 |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 15 tools
Tools are generally well-distinguished by action (assess, list, run, import, generate, scan, validate) and resource. However, anjian_doctor, anjian_capability_plan, and anjian_list_assessments all touch capability/status inspection and could occasionally confuse an agent about which to use for checking system state.
All tools share the anjian_ prefix with snake_case, showing consistency. However, the naming is inconsistent in granularity and verb style: some use domain-specific verbs (consolidate, validate_observation, import_pcap) while others are action-focused (run, list, create, get). The nouns range from concrete (assessment, target) to abstract (doctor, consolidate), lacking a uniform verb_noun pattern.
At 15 tools, this is near the high end of the ideal range but reasonable for a security assessment platform covering assessment lifecycle, evidence import, analysis, and reporting. Each tool serves a distinct stage of the workflow. Slightly heavy but justifiable given the breadth of the domain.
The surface covers the full assessment lifecycle: create/get/list/run assessments, import evidence (Burp/HAR/PCAP/source), consolidate, validate, and generate reports. Minor gaps include no explicit tool for deleting/deprecating assessments or managing report history/cleanup, and no dedicated tool for listing imported evidence, but agents can work around these.