Skip to main content
Glama
gokulapap

BugBounty MCP Server

by gokulapap

Analyze TLS protocol support

tls_configuration_analysis
Read-onlyIdempotent

Tests TLS 1.0–1.3 support on scope-pinned targets and identifies obsolete protocols for security assessments.

Instructions

Test TLS 1.0 through 1.3 support against scope-pinned addresses and identify obsolete protocols.

Input Schema

NameRequiredDescriptionDefault
portNo
targetYes

Output Schema

NameRequiredDescriptionDefault
portYes
targetYes
protocolsYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv2.2.0

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, and open-world behavior, so the safety profile is covered. The description adds that it probes an explicit protocol range (1.0-1.3) and flags obsolete protocols, plus the scope-pinning constraint, but says nothing about timing, rate limits, or side effects beyond what annotations imply.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single efficiently worded sentence with the protocol range and goal front-loaded and no filler. It is terse to the point of under-specification, but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value explanation is not required, and annotations carry the safety profile. Still, for a tool with 0% parameter documentation and an obvious sibling overlap, the description leaves meaningful gaps in how to invoke it and when to prefer it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and neither 'target' nor 'port' is explained in the description. The phrase 'scope-pinned addresses' loosely maps to the target parameter but gives no format, syntax, or default guidance, and 'port' (default 443) is entirely unaddressed, so the description does not compensate for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Test) and resource (TLS 1.0 through 1.3 support) plus the outcome ('identify obsolete protocols'), which is clearer than a bare name restatement. However, it never distinguishes itself from the very close sibling ssl_scan, so an agent must guess which of the two to call.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description offers no when-to-use or when-not-to-use guidance and names no alternative. The only contextual hint is 'scope-pinned addresses', which implies authorization scoping but does not tell the agent when this tool is preferable to ssl_scan or other TLS-related siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.