Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@ProjectDiscovery MCP Server Run a full reconnaissance and vulnerability scan on example.com"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol (MCP) server that integrates ProjectDiscovery security tools for automated bug bounty reconnaissance and vulnerability scanning.
This MCP server provides comprehensive security reconnaissance capabilities:
subfinder - Subdomain discovery using passive sources
dnsx - DNS resolution and probing
naabu - Fast port scanning
httpx - HTTP/HTTPS probing and analysis
katana - Web crawling and endpoint discovery
nuclei - Vulnerability scanning with YAML templates
Bug Hunting workflow - End-to-end reconnaissance pipeline that chains all tools together
Related MCP server: VulneraMCP
Target Domain
│
▼
┌─────────────────────────────────────────────┐
│ Step 1: Subdomain Discovery (subfinder) │
│ Find all subdomains via passive sources │
└──────────────────┬──────────────────────────┘
│
▼
┌─────────────────────────────────────────────┐
│ Step 2: DNS Resolution (dnsx) │
│ Resolve domains to IP addresses │
└──────────────────┬──────────────────────────┘
│
▼
┌─────────────────────────────────────────────┐
│ Step 3: Port Scanning (naabu) [OPTIONAL] │
│ Scan top ports on resolved hosts │
└──────────────────┬──────────────────────────┘
│
▼
┌─────────────────────────────────────────────┐
│ Step 4: HTTP Probing (httpx) │
│ Identify live web services │
└──────────────────┬──────────────────────────┘
│
▼
┌─────────────────────────────────────────────┐
│ Step 5: Web Crawling (katana) [OPTIONAL] │
│ Discover endpoints & paths │
└──────────────────┬──────────────────────────┘
│
▼
┌─────────────────────────────────────────────┐
│ Step 6: Vulnerability Scan (nuclei) │
│ Test for known vulnerabilities │
└──────────────────┬──────────────────────────┘
│
▼
Comprehensive Report
├─ Attack surface mapping
├─ Open ports & services
├─ Live web applications
├─ Discovered endpoints
└─ Security vulnerabilitiesExecution Time: ~2 minutes (varies by target size)
Output: JSON report with:
Total subdomains, resolved hosts, open ports
Live HTTP services with status codes and titles
Crawled endpoints and paths
Vulnerabilities categorized by severity (critical/high/medium/low)
Before using this MCP server, you must install the ProjectDiscovery tools:
# Install Go (required)
# On Ubuntu/Debian
sudo apt update
sudo apt install golang-go
# On macOS
brew install go
# Install ProjectDiscovery tools
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest
go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
go install -v github.com/projectdiscovery/katana/cmd/katana@latest
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
# Update Nuclei templates
nuclei -update-templates
# Ensure tools are in PATH
export PATH=$PATH:$(go env GOPATH)/bin# Clone the repository
git clone https://github.com/intelligent-ears/pd-tools-mcp
cd pd-tools-mcp
# Install dependencies
npm install
# Build the server
npm run buildAdd to your Claude Desktop configuration (claude_desktop_config.json):
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"projectdiscovery": {
"command": "node",
"args": ["/absolute/path/to/pdmcp/build/index.js"]
}
}
}Create or update .vscode/mcp.json in your workspace:
{
"projectdiscovery": {
"type": "stdio",
"command": "node",
"args": ["/absolute/path/to/pdmcp/build/index.js"]
}
}npm startDiscover subdomains for a target domain.
Input:
domain (string, required): Target domain (e.g., "example.com")
silent (boolean, optional): Show only subdomains in output
Example:
{
"domain": "example.com",
"silent": true
}Resolve DNS records for domains.
Input:
domains (array of strings, required): List of domains to resolve
recordType (string, optional): DNS record type (A, AAAA, CNAME, etc.)
Example:
{
"domains": ["example.com", "sub.example.com"],
"recordType": "A"
}Scan for open ports on hosts.
Input:
hosts (array of strings, required): List of hosts to scan
ports (string, optional): Ports to scan (e.g., "80,443" or "1-1000")
topPorts (number, optional): Scan top N ports
Example:
{
"hosts": ["example.com"],
"topPorts": 100
}Probe HTTP/HTTPS servers.
Input:
urls (array of strings, required): List of URLs or hosts
followRedirects (boolean, optional): Follow HTTP redirects
screenshot (boolean, optional): Take screenshots
Example:
{
"urls": ["https://example.com"],
"followRedirects": true
}Crawl websites and discover endpoints.
Input:
urls (array of strings, required): List of URLs to crawl
depth (number, optional): Crawl depth (default: 2)
scope (string, optional): Crawl scope regex pattern
Example:
{
"urls": ["https://example.com"],
"depth": 3
}Scan for vulnerabilities using templates.
Input:
targets (array of strings, required): List of targets
templates (array of strings, optional): Specific templates to use
severity (array of strings, optional): Filter by severity (critical, high, medium, low, info)
Example:
{
"targets": ["https://example.com"],
"severity": ["critical", "high"]
}Execute complete automated reconnaissance workflow.
Input:
domain (string, required): Target domain
portScan (boolean, optional): Include port scanning (default: true)
crawl (boolean, optional): Include web crawling (default: true)
vulnerabilityScan (boolean, optional): Include vulnerability scanning (default: true)
severityFilter (array of strings, optional): Nuclei severity filter
Rate Limiting Options:
maxCrawlUrls (number, optional): Maximum URLs to crawl (default: 10)
maxScanUrls (number, optional): Maximum URLs to scan with Nuclei (default: 20)
maxTopPorts (number, optional): Maximum top ports for Naabu (default: 100)
batchSize (number, optional): Batch size for DNS/HTTP requests (default: 50)
delayBetweenBatches (number, optional): Delay in milliseconds between batches (default: 1000)
crawlDepth (number, optional): Crawl depth for Katana (default: 2)
Example:
{
"domain": "example.com",
"portScan": true,
"crawl": true,
"vulnerabilityScan": true,
"severityFilter": ["critical", "high"],
"maxCrawlUrls": 50,
"maxScanUrls": 100,
"maxTopPorts": 200,
"batchSize": 25,
"delayBetweenBatches": 2000,
"crawlDepth": 3
}Example (Conservative Rate Limiting):
{
"domain": "example.com",
"maxCrawlUrls": 5,
"maxScanUrls": 10,
"delayBetweenBatches": 5000
}Workflow Steps:
Subdomain Discovery - Find all subdomains
DNS Resolution - Resolve subdomains to IPs
Port Scanning - Identify open ports (optional)
HTTP Probing - Find live web services
Web Crawling - Discover endpoints (optional)
Vulnerability Scanning - Detect security issues (optional)
The bug bounty workflow includes configurable rate limiting to prevent overwhelming target infrastructure and respect responsible disclosure practices.
Parameter | Default | Description |
| 10 | Maximum number of URLs to crawl with Katana |
| 20 | Maximum number of URLs to scan with Nuclei |
| 100 | Maximum number of top ports to scan with Naabu |
| 50 | Number of items to process in each batch |
| 1000 | Delay in milliseconds between batches |
| 2 | Maximum depth for web crawling |
Aggressive Scan (use responsibly):
{
"domain": "example.com",
"maxCrawlUrls": 100,
"maxScanUrls": 200,
"maxTopPorts": 1000,
"batchSize": 100,
"delayBetweenBatches": 500,
"crawlDepth": 3
}Conservative Scan (recommended for production sites):
{
"domain": "example.com",
"maxCrawlUrls": 5,
"maxScanUrls": 10,
"maxTopPorts": 50,
"batchSize": 10,
"delayBetweenBatches": 5000,
"crawlDepth": 1
}Stealth Scan (minimal footprint):
{
"domain": "example.com",
"maxCrawlUrls": 3,
"maxScanUrls": 5,
"maxTopPorts": 20,
"batchSize": 5,
"delayBetweenBatches": 10000,
"crawlDepth": 1
}Start Conservative: Begin with lower limits and increase gradually
Respect Target Infrastructure: Use appropriate delays to avoid overwhelming servers
Bug Bounty Programs: Always follow the program's rules of engagement
Production Systems: Use extended delays and lower batch sizes
Monitor Logs: Check stderr output for rate limiting status messages
Once configured with an MCP client like Claude Desktop, you can use natural language:
"Use the bug_bounty_workflow tool to scan example.com for vulnerabilities"
"Find all subdomains for hackerone.com using subfinder"
"Scan the top 100 ports on example.com with naabu"
"Crawl https://example.com and find all endpoints with katana"
# Watch mode for development
npm run dev
# Build
npm run build
# Run
npm startBuilt with:
Contributions are welcome! Please feel free to submit a Pull Request.
Execute complete bug bounty reconnaissance workflow: subdomain discovery, DNS resolution, port scanning, HTTP probing, crawling, and vulnerability scanning
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Target domain for bug bounty reconnaissance | |
| portScan | No | Include port scanning (default: true) | |
| crawl | No | Include web crawling (default: true) | |
| vulnerabilityScan | No | Include vulnerability scanning (default: true) | |
| severityFilter | No | Nuclei severity filter (critical, high, medium, low) | |
| maxCrawlUrls | No | Maximum URLs to crawl (default: 10) | |
| maxScanUrls | No | Maximum URLs to scan with Nuclei (default: 20) | |
| maxTopPorts | No | Maximum top ports for Naabu (default: 100) | |
| batchSize | No | Batch size for DNS/HTTP requests (default: 50) | |
| delayBetweenBatches | No | Delay in milliseconds between batches (default: 1000) | |
| crawlDepth | No | Crawl depth for Katana (default: 2) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. While it lists the workflow components, it doesn't describe critical behavioral traits like execution time, resource requirements, rate limits, permission needs, or what happens when the tool fails. For a complex 11-parameter tool with no annotation coverage, this is a significant gap in transparency about how the tool actually behaves.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that lists all workflow components without unnecessary words. It's appropriately sized for the tool's complexity and front-loads the comprehensive nature of the workflow. Every component mentioned earns its place by clarifying the tool's scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's high complexity (11 parameters, no output schema, no annotations), the description is insufficiently complete. It doesn't explain what the tool returns, how results are structured, error handling, or performance characteristics. For a workflow tool that orchestrates multiple security scanning components, users need more context about outputs and operational behavior to use it effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 11 parameters thoroughly. The description doesn't add any parameter-specific information beyond what's in the schema - it doesn't explain parameter interactions, dependencies, or provide examples. With complete schema coverage, the baseline of 3 is appropriate as the description doesn't compensate but doesn't need to since the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool executes a 'complete bug bounty reconnaissance workflow' and lists specific components: subdomain discovery, DNS resolution, port scanning, HTTP probing, crawling, and vulnerability scanning. This provides a clear verb+resource+scope combination that distinguishes it from sibling tools like dnsx, httpx, katana, naabu, nuclei, and subfinder, which appear to be individual components of this comprehensive workflow.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool should be used for comprehensive bug bounty reconnaissance rather than individual tasks, but it doesn't explicitly state when to use it versus the sibling tools. There's no guidance on prerequisites, exclusions, or specific scenarios where this workflow is preferred over running individual tools separately. The context is clear but lacks explicit alternatives or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Resolve DNS records for domains and subdomains
| Name | Required | Description | Default |
|---|---|---|---|
| domains | Yes | List of domains to resolve | |
| recordType | No | DNS record type (A, AAAA, CNAME, etc.) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the action ('Resolve DNS records') but lacks details on behavior: e.g., whether it queries public DNS or internal servers, rate limits, error handling, or output format (though no output schema exists). For a network tool with zero annotation coverage, this is a significant gap in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with zero waste. It front-loads the core purpose ('Resolve DNS records') and specifies the target ('for domains and subdomains'). Every word earns its place, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (network operation with 2 parameters), lack of annotations, and no output schema, the description is incomplete. It doesn't explain what 'resolve' entails operationally, potential side effects (e.g., network traffic), or return values. For a tool in a security testing context (based on sibling names), more context on use cases and limitations is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters ('domains' and 'recordType') adequately. The description implies these parameters by mentioning 'domains and subdomains' and 'DNS records', but adds no additional meaning beyond what the schema provides (e.g., examples of record types, domain formatting). Baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('Resolve') and resource ('DNS records for domains and subdomains'). It distinguishes itself from sibling tools like httpx (HTTP probing) or subfinder (subdomain enumeration) by focusing on DNS resolution. However, it doesn't explicitly mention what 'resolve' entails (e.g., querying DNS servers, returning IP addresses).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention use cases (e.g., troubleshooting, reconnaissance), prerequisites (e.g., network access), or comparisons with sibling tools like httpx (which may also perform DNS lookups). Without this context, an agent must infer usage from the tool name and description alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Probe HTTP/HTTPS servers and gather information
| Name | Required | Description | Default |
|---|---|---|---|
| urls | Yes | List of URLs or hosts to probe | |
| followRedirects | No | Follow HTTP redirects | |
| screenshot | No | Take screenshots |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. While 'probe' and 'gather information' imply a read-only reconnaissance operation, it doesn't specify whether this is passive or active, what information is gathered (e.g., headers, status codes, technologies), potential rate limits, authentication requirements, or any destructive effects. The description is too vague about the tool's actual behavior beyond the high-level purpose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at just 7 words, with zero wasted language. It's front-loaded with the core purpose ('probe HTTP/HTTPS servers') followed by the outcome ('gather information'). Every word earns its place in communicating the essential function without unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 3 parameters, no annotations, and no output schema, the description is insufficiently complete. It doesn't explain what 'information' is gathered, the format of results, potential side effects, or how it differs from sibling tools. The agent would need to guess about the tool's behavior, output format, and appropriate usage context given the security-focused sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, with clear parameter documentation. The description adds no additional parameter semantics beyond what's already in the schema. It doesn't explain how 'urls' should be formatted, what 'probe' entails for each URL, or how the boolean flags affect the probing behavior. The baseline score of 3 reflects adequate schema coverage without description enhancement.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('probe') and resource ('HTTP/HTTPS servers'), and specifies the action ('gather information'). It distinguishes itself from potential siblings by focusing on HTTP/HTTPS server probing rather than DNS enumeration, subdomain discovery, or vulnerability scanning. However, it doesn't explicitly differentiate from all siblings (like 'katana' which might also interact with web servers).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention any prerequisites, constraints, or typical use cases. Given the sibling tools include various reconnaissance and scanning tools (dnsx, naabu, nuclei, subfinder), the description fails to help an agent choose between them for specific scenarios like web server enumeration versus vulnerability assessment.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Fast web crawler for discovering endpoints and paths
| Name | Required | Description | Default |
|---|---|---|---|
| urls | Yes | List of URLs to crawl | |
| depth | No | Crawl depth (default: 2) | |
| scope | No | Crawl scope (e.g., regex pattern) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. While 'fast web crawler' implies performance characteristics and 'discovering endpoints and paths' suggests read-only reconnaissance, it lacks critical behavioral details: whether authentication is needed, rate limits, what happens with malformed URLs, output format, or error handling. The description doesn't adequately compensate for missing annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise (7 words) and front-loaded with all essential information. Every word earns its place: 'fast' sets expectations, 'web crawler' defines the category, and 'for discovering endpoints and paths' specifies the exact purpose without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a web crawling tool with 3 parameters and no annotations or output schema, the description is insufficiently complete. It doesn't explain what 'endpoints and paths' means in practice, how results are returned, error conditions, or security considerations. The high schema coverage helps, but the description should provide more operational context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all three parameters (urls, depth, scope) adequately. The description adds no additional parameter semantics beyond what's in the schema, maintaining the baseline score of 3 for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('crawler for discovering') and resource ('endpoints and paths'), and the qualifier 'fast' adds useful context. However, it doesn't explicitly differentiate from sibling tools like httpx or nuclei, which might have overlapping web reconnaissance functions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With siblings like httpx (HTTP probing) and nuclei (vulnerability scanning) available, there's no indication of katana's specific use cases, prerequisites, or limitations compared to these tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Fast port scanner to discover open ports on hosts
| Name | Required | Description | Default |
|---|---|---|---|
| hosts | Yes | List of hosts to scan | |
| ports | No | Ports to scan (e.g., '80,443' or '1-1000') | |
| topPorts | No | Scan top N ports |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions 'fast port scanner' which implies performance characteristics, but lacks details on rate limits, network impact, authentication needs, output format, or error handling. For a scanning tool with zero annotation coverage, this is a significant gap in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the core functionality ('Fast port scanner') and purpose ('to discover open ports on hosts'). There is no wasted text, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of a port scanning tool (which involves network operations and potential side effects), the description is incomplete. With no annotations and no output schema, it fails to address critical aspects like what the tool returns, error conditions, performance constraints, or security implications, leaving significant gaps for agent understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, so the schema already documents all three parameters thoroughly. The description doesn't add any parameter-specific information beyond what's in the schema (e.g., it doesn't explain parameter interactions or provide examples beyond the schema's port format example). This meets the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('scan') and resource ('open ports on hosts'), and the adjective 'fast' adds useful context. However, it doesn't explicitly differentiate from potential sibling tools like 'nuclei' (which might scan for vulnerabilities rather than just ports) or 'httpx' (which might focus on HTTP services), leaving room for improvement in sibling distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention any specific scenarios, prerequisites, or exclusions, nor does it reference sibling tools like 'nuclei' for vulnerability scanning or 'httpx' for HTTP service detection, leaving the agent without usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Fast vulnerability scanner using YAML-based templates
| Name | Required | Description | Default |
|---|---|---|---|
| targets | Yes | List of targets to scan | |
| templates | No | Specific templates to use | |
| severity | No | Filter by severity (critical, high, medium, low, info) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions 'Fast vulnerability scanner' but lacks critical details like whether it's read-only or destructive, permission requirements, rate limits, or output format. This is a significant gap for a scanning tool with potential security implications.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with no wasted words. It's appropriately sized and front-loaded, clearly stating the core functionality without unnecessary elaboration, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of a vulnerability scanner with no annotations and no output schema, the description is incomplete. It doesn't cover behavioral traits, error handling, or result interpretation, which are crucial for effective tool invocation in a security context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, so the schema already documents all parameters (targets, templates, severity). The description adds no additional meaning beyond what the schema provides, such as explaining template sources or severity implications, resulting in a baseline score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose as a 'Fast vulnerability scanner using YAML-based templates,' which specifies the verb (scan), resource (vulnerabilities), and method (YAML templates). However, it doesn't differentiate from sibling tools like httpx or naabu, which might also perform scanning-related functions, keeping it from a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention specific contexts, prerequisites, or exclusions, such as comparing to bug_bounty_workflow or subfinder for different scanning phases, leaving the agent without usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Discover subdomains for a given domain using passive sources
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Target domain (e.g., example.com) | |
| silent | No | Show only subdomains in output |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the tool uses 'passive sources,' which implies non-intrusive discovery, but does not detail what this entails (e.g., rate limits, data sources, permissions required, or output format). For a tool with no annotations, this leaves significant gaps in understanding its behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence: 'Discover subdomains for a given domain using passive sources.' It is front-loaded with the core purpose, has zero wasted words, and is appropriately sized for the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations and output schema, the description is incomplete. It does not explain what the tool returns (e.g., list of subdomains, errors) or behavioral aspects like rate limits or data sources. For a tool with no structured support, the description should provide more context to be fully helpful.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, with clear documentation for both parameters ('domain' and 'silent'). The description does not add any additional meaning beyond what the schema provides, such as explaining the implications of 'passive sources' on parameter usage. Since the schema does the heavy lifting, the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Discover subdomains for a given domain using passive sources.' It specifies the verb ('discover'), resource ('subdomains'), and method ('passive sources'), making the intent unambiguous. However, it does not explicitly differentiate from sibling tools like dnsx or nuclei, which may also involve domain-related operations, so it doesn't reach the highest score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It mentions 'passive sources' but does not specify contexts where this is preferred over active methods or other sibling tools. Without any when-to-use, when-not-to-use, or alternative recommendations, the agent lacks usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v1.0.0bug_bounty_workflowdnsxhttpxkatananaabunucleisubfinderEach tool has a clearly distinct purpose with no ambiguity: subfinder for subdomain discovery, dnsx for DNS resolution, naabu for port scanning, httpx for HTTP probing, katana for crawling, nuclei for vulnerability scanning, and bug_bounty_workflow as an orchestration tool. The tools complement rather than overlap, making misselection unlikely.
Tool names follow a consistent pattern: all are lowercase, single-word names (or hyphenated for bug_bounty_workflow) that clearly identify their function (e.g., subfinder, dnsx, httpx). This uniformity makes the set predictable and easy to understand.
With 7 tools, the count is well-scoped for a security reconnaissance server, covering key stages like discovery, scanning, and analysis. Each tool earns its place by addressing a specific aspect of the workflow without redundancy.
The tool set provides complete coverage for bug bounty and reconnaissance workflows, from initial subdomain discovery (subfinder) through DNS resolution (dnsx), port scanning (naabu), HTTP probing (httpx), crawling (katana), vulnerability scanning (nuclei), and an orchestration tool (bug_bounty_workflow). There are no obvious gaps, enabling agents to handle full lifecycles.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Offline methodology engine for authorized penetration testing, CTF, and security research.
AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets.
Hunt zero-days by talking to binaries. 40+ tools. Hosted, OAuth + SSO, invite: hi@byteray.ai
Passive domain-perimeter checks — cert expiry, subdomain takeover, lookalikes — as agent tools
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/intelligent-ears/pd-tools-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
