Skip to main content
Glama

Xss Validate

xss_validate
Destructive

Confirm reflected XSS on a URL with dalfox. Optionally use tier B payload lists or vendor-specific WAF bypass sets to trigger payloads when standard tests fail.

Instructions

[EXPLOIT — requires human approval] Confirm reflected XSS on a URL with dalfox.

payload_list optionally names a tier B list from the vetted payload store to hand dalfox via --custom-payload. Leave it unset first: dalfox's built-in payloads are context-aware and prove most reflected XSS on their own. Reach for a list when a parameter reflects but nothing fires — xss-waf-bypass against a filtering target, xss-polyglots when the injection context is unclear, xss-js-frameworks for a Vue/Angular front end. Tier B is injection payloads, not discovery wordlists, and this is the only tool that can request one.

bypass_vendor names a WAF vendor whose ordered XSS bypass set is looked up from the knowledge base and handed to dalfox via --custom-payload the same way a tier B list would be. The exploit chain uses it to re-test a point whose base pass came back clean: the WAF may have eaten the textbook payloads while the vendor-specific set gets through.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
targetYes
payload_listNo
bypass_vendorNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observedv2.1.0

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description openly states this is an 'EXPLOIT' requiring human approval, which aligns with and extends the annotations (destructiveHint=true). It explains that it runs dalfox and how it uses custom payloads and WAF bypasses. This provides behavioral detail beyond the annotations without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with three clear paragraphs, but it is somewhat repetitive. The second and third paragraphs follow the same template ('Leave it unset first...', 'Reach for a list when...'), which adds length without much additional insight. Still, it remains focused and readable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's purpose, parameters, approval requirement, and exploit nature. It does not describe the output or return value, but given the tool's role as a validator, the output is likely a result set of confirmed vulnerabilities. The absence of explicit output details is a minor gap, but the overall context is sufficient for an agent to use it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has no descriptions for any parameters, so the tool description must compensate. It explains payload_list and bypass_vendor thoroughly, including when to set them and what they do. The 'target' parameter is not explicitly described, but its meaning is easily inferred from the phrase 'on a URL'. Coverage is high for two of three parameters, with the third being self-evident.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Confirm reflected XSS on a URL with dalfox.' This is specific, uses a verb, and distinguishes it from sibling tools like sqli_validate or cmdi_probe. The exploit context is immediately clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives excellent guidance on when to use the optional payload_list and bypass_vendor parameters ('Leave it unset first', 'Reach for a list when a parameter reflects but nothing fires'). It also mentions the human approval requirement. However, it does not explicitly compare this tool to alternatives like waf_bypass or guided_validate, though the name and purpose make the choice obvious in most contexts.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/iamsecure1920/Cordon-AI'

If you have feedback or need assistance with the MCP directory API, please join our Discord server