Skip to main content
Glama

Technique Lookup

technique_lookup
Read-only

Find how to test a vulnerability class via PayloadsAllTheThings: get matching Cordon tools, vetted payload lists, and gf pattern packs. Search by class, tool, technologies, phase, or free-text query.

Instructions

Query the PayloadsAllTheThings technique index for how to test a bug class.

The counterpart to wstg_lookup: WSTG says what to check, this says how. Each record names the Cordon tools that test the class, the vetted payload lists, and the gf pattern packs that correspond to it. Retrieval, not automation — nothing here fires anything, and it costs no budget.

Five ways in, most specific first:

  • class_name — one technique in full ("sql-injection", "open-redirect")

  • tool — every technique a given Cordon tool covers ("sqli_validate")

  • technologies— comma-separated stack from http_probe ("Rails,MongoDB,GraphQL")

  • query — free text ("jwt forgery", "deserialization")

  • phase — everything in a phase (input_validation, authentication …)

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
toolNo
phaseNo
queryNo
class_nameNo
technologiesNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observedv2.1.0

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only and non-destructive; description reinforces this by stating 'Retrieval, not automation' and 'nothing here fires anything'. It adds value by explaining the tool has no side effects and no cost.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is compact and well-structured: a one-sentence purpose, a useful comparison, and a scannable bullet list of parameters. No filler or redundant explanation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Provides enough context about what records contain (tool names, payload lists, gf pattern packs) and how to query, though it does not describe the output shape beyond that; the output schema is not shown in the description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides only nullable strings, but the description fully maps each parameter to a lookup mode and gives example values, effectively compensating for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it queries the PayloadsAllTheThings technique index to learn how to test a bug class, and distinguishes itself as the 'how' counterpart to wstg_lookup. Specific verbs and resource identify the tool's role among many sibling scanners.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly frames usage via 'WSTG says what to check, this says how' and enumerates five lookup modes with concrete examples. This gives an agent clear conditions for when to prefer technique_lookup over related lookup tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/iamsecure1920/Cordon-AI'

If you have feedback or need assistance with the MCP directory API, please join our Discord server