Skip to main content
Glama

Hunt Plan

hunt_plan
Read-only

Propose concrete security tests based on observed recon, without sending traffic. Get testable propositions and identify gaps that require more data.

Instructions

Propose concrete tests based on what recon actually observed.

Sends no traffic. Reads the engagement's asset store and returns testable propositions, each citing the observation behind it.

focus optionally narrows the request ("authentication", "idor", "business logic"). Leave it unset for a general pass.

Returns proposals — things to try — and gaps, which is the more valuable half: what the model would need in order to say anything sharper. On a target where everything interesting sits behind a login, gaps will say so, and that is the honest answer rather than five generic suggestions.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
focusNo
limitNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observedv2.1.0

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only and non-destructive behavior. The description adds valuable transparency by stating 'Sends no traffic' and explicitly describing that it reads the asset store and returns proposals/gaps, including edge-case behavior ('On a target where everything interesting sits behind a login, gaps will say so'). This goes beyond the annotation hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized, free of redundancy, and each sentence adds meaningful detail. It logically flows from purpose to behavior to parameters to output, making it easy to parse. No filler words or unnecessary technical jargon.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (parameters, output with proposals and gaps), the description provides sufficient context: it explains the output structure and the significance of 'gaps,' and the presence of an output schema reduces the need to detail return fields. It lacks explicit prerequisites or error conditions but these are not critical for basic invocation. Overall, it is nearly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides no descriptions (coverage 0%), so the description must explain parameters. It adequately describes 'focus' with examples ('authentication', 'idor', 'business logic') and its default behavior. However, 'limit' is completely omitted, leaving its purpose ambiguous. The description only covers half of the parameters, failing to fully compensate for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Propose concrete tests based on what recon actually observed.' It specifies the resource read ('engagement's asset store') and the output type (testable propositions, proposals/gaps). This distinguishes it from execution or triage tools among siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage after recon by referencing observed data and mentions the optional 'focus' parameter to narrow scope. However, it does not explicitly contrast with alternative planning tools (e.g., taskgraph_next, research_guidance) or state concrete conditions for when to prefer this tool over others. The guidance is implicit but not fully explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/iamsecure1920/Cordon-AI'

If you have feedback or need assistance with the MCP directory API, please join our Discord server