Skip to main content
Glama

Run Phase

run_phase

Execute a single VAPT pipeline phase (probe, scan, exploit) on a target and persist the result to pipeline state and audit log for later use.

Instructions

[AGGRESSIVE — requires human approval] Run a single phase against a target and record its state.

phase is one of the pipeline phases (probe, scan, exploit, …). target defaults to the engagement's first seed. extra_json is an optional JSON object of extra kwargs for the phase's tool (e.g. {"include_heavy": true} for the exploit phase).

The phase result is persisted to pipeline-state.json and the audit log, so run_pipeline/pipeline_status and later sessions see it.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
phaseYes
targetNo
extra_jsonNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observedv2.1.0

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the main side effects: it records state and persists to pipeline-state.json and the audit log. This is sufficient given readOnlyHint=false and destructiveHint=false. It does not mention potential external network impact on the target, but openWorldHint=true suggests external actions are possible; the description is somewhat vague on that point.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with no redundant words. It uses backticks for inline code, making it readable. Each sentence adds value: purpose, parameter clarifications, and persistence behavior. The structure is logical and easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers essential context: what the tool does, how parameters behave, and what side effects occur. Since an output schema exists (per context signals), not describing return values is acceptable. The description also mentions the relationship to other tools (run_pipeline, pipeline_status), providing complete operational context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description provides meaningful explanations for all three parameters: phase is defined as one of the pipeline phases, target defaults to the engagement's first seed, and extra_json is an optional JSON object of extra kwargs. This goes far beyond the schema's type-only definitions, achieving high coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Run a single phase against a target and record its state.' It distinguishes itself from run_pipeline by specifying it runs a single phase, and from specific scanner tools (e.g., jaeles_scan) by being a generic phase runner. The verb 'run' and resource 'phase' are unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when a single pipeline phase is needed, and explicitly notes the persistence so that run_pipeline and pipeline_status reflect the result, signaling how it fits into the ecosystem. However, it does not directly contrast with run_pipeline or other phase-specific tools, leaving some inference needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/iamsecure1920/Cordon-AI'

If you have feedback or need assistance with the MCP directory API, please join our Discord server