ProjectDiscovery MCP Server

Server Quality Checklist

Profile completionA complete profile improves this server's visibility in search results.

Latest release: v1.0.0
Disambiguation5/5
Each tool has a clearly distinct purpose with no ambiguity: subfinder for subdomain discovery, dnsx for DNS resolution, naabu for port scanning, httpx for HTTP probing, katana for crawling, nuclei for vulnerability scanning, and bug_bounty_workflow as an orchestration tool. The tools complement rather than overlap, making misselection unlikely.
Naming Consistency5/5
Tool names follow a consistent pattern: all are lowercase, single-word names (or hyphenated for bug_bounty_workflow) that clearly identify their function (e.g., subfinder, dnsx, httpx). This uniformity makes the set predictable and easy to understand.
Tool Count5/5
With 7 tools, the count is well-scoped for a security reconnaissance server, covering key stages like discovery, scanning, and analysis. Each tool earns its place by addressing a specific aspect of the workflow without redundancy.
Completeness5/5
The tool set provides complete coverage for bug bounty and reconnaissance workflows, from initial subdomain discovery (subfinder) through DNS resolution (dnsx), port scanning (naabu), HTTP probing (httpx), crawling (katana), vulnerability scanning (nuclei), and an orchestration tool (bug_bounty_workflow). There are no obvious gaps, enabling agents to handle full lifecycles.
Average 3/5 across 7 of 7 tools scored.
See the Tool Scores section below for per-tool breakdowns.
- No community issues in the last 6 months
- 0 commits in the last 12 weeks
- No stable releases found
- No critical vulnerability alerts
- No high-severity vulnerability alerts
- No code scanning findings
- CI status not available
Add a LICENSE file by following GitHub's guide. Once GitHub recognizes the license, the system will automatically detect it within a few hours.
If the license does not appear after some time, you can manually trigger a new scan using the MCP server admin interface.
MCP servers without a LICENSE cannot be installed.
This repository includes a README.md file.
No tool usage detected in the last 30 days. Usage tracking helps demonstrate server value.
Tip: use the "Try in Browser" feature on the server page to seed initial usage.
Add a glama.json file to provide metadata about your server.
If you are the author, simply .
If the server belongs to an organization, first add glama.json to the root of your repository:
```
{
  "$schema": "https://glama.ai/mcp/schemas/server.json",
  "maintainers": [
    "your-github-username"
  ]
}
```
Then . Browse examples.
Add related servers to improve discoverability.

How to sync the server with GitHub?

Servers are automatically synced at least once per day, but you can also sync manually at any time to instantly update the server profile.

To manually sync the server, click the "Sync Server" button in the MCP server admin interface.

How is the quality score calculated?

The overall quality score combines two components: Tool Definition Quality (70%) and Server Coherence (30%).

Tool Definition Quality measures how well each tool describes itself to AI agents. Every tool is scored 1–5 across six dimensions: Purpose Clarity (25%), Usage Guidelines (20%), Behavioral Transparency (20%), Parameter Semantics (15%), Conciseness & Structure (10%), and Contextual Completeness (10%). The server-level definition quality score is calculated as 60% mean TDQS + 40% minimum TDQS, so a single poorly described tool pulls the score down.

Server Coherence evaluates how well the tools work together as a set, scoring four dimensions equally: Disambiguation (can agents tell tools apart?), Naming Consistency, Tool Count Appropriateness, and Completeness (are there gaps in the tool surface?).

Tiers are derived from the overall score: A (≥3.5), B (≥3.0), C (≥2.0), D (≥1.0), F (<1.0). B and above is considered passing.

Tool Scores

Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the action ('Resolve DNS records') but lacks details on behavior: e.g., whether it queries public DNS or internal servers, rate limits, error handling, or output format (though no output schema exists). For a network tool with zero annotation coverage, this is a significant gap in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with zero waste. It front-loads the core purpose ('Resolve DNS records') and specifies the target ('for domains and subdomains'). Every word earns its place, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (network operation with 2 parameters), lack of annotations, and no output schema, the description is incomplete. It doesn't explain what 'resolve' entails operationally, potential side effects (e.g., network traffic), or return values. For a tool in a security testing context (based on sibling names), more context on use cases and limitations is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters ('domains' and 'recordType') adequately. The description implies these parameters by mentioning 'domains and subdomains' and 'DNS records', but adds no additional meaning beyond what the schema provides (e.g., examples of record types, domain formatting). Baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('Resolve') and resource ('DNS records for domains and subdomains'). It distinguishes itself from sibling tools like httpx (HTTP probing) or subfinder (subdomain enumeration) by focusing on DNS resolution. However, it doesn't explicitly mention what 'resolve' entails (e.g., querying DNS servers, returning IP addresses).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention use cases (e.g., troubleshooting, reconnaissance), prerequisites (e.g., network access), or comparisons with sibling tools like httpx (which may also perform DNS lookups). Without this context, an agent must infer usage from the tool name and description alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. While 'probe' and 'gather information' imply a read-only reconnaissance operation, it doesn't specify whether this is passive or active, what information is gathered (e.g., headers, status codes, technologies), potential rate limits, authentication requirements, or any destructive effects. The description is too vague about the tool's actual behavior beyond the high-level purpose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at just 7 words, with zero wasted language. It's front-loaded with the core purpose ('probe HTTP/HTTPS servers') followed by the outcome ('gather information'). Every word earns its place in communicating the essential function without unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 3 parameters, no annotations, and no output schema, the description is insufficiently complete. It doesn't explain what 'information' is gathered, the format of results, potential side effects, or how it differs from sibling tools. The agent would need to guess about the tool's behavior, output format, and appropriate usage context given the security-focused sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, with clear parameter documentation. The description adds no additional parameter semantics beyond what's already in the schema. It doesn't explain how 'urls' should be formatted, what 'probe' entails for each URL, or how the boolean flags affect the probing behavior. The baseline score of 3 reflects adequate schema coverage without description enhancement.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('probe') and resource ('HTTP/HTTPS servers'), and specifies the action ('gather information'). It distinguishes itself from potential siblings by focusing on HTTP/HTTPS server probing rather than DNS enumeration, subdomain discovery, or vulnerability scanning. However, it doesn't explicitly differentiate from all siblings (like 'katana' which might also interact with web servers).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention any prerequisites, constraints, or typical use cases. Given the sibling tools include various reconnaissance and scanning tools (dnsx, naabu, nuclei, subfinder), the description fails to help an agent choose between them for specific scenarios like web server enumeration versus vulnerability assessment.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. While 'fast web crawler' implies performance characteristics and 'discovering endpoints and paths' suggests read-only reconnaissance, it lacks critical behavioral details: whether authentication is needed, rate limits, what happens with malformed URLs, output format, or error handling. The description doesn't adequately compensate for missing annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise (7 words) and front-loaded with all essential information. Every word earns its place: 'fast' sets expectations, 'web crawler' defines the category, and 'for discovering endpoints and paths' specifies the exact purpose without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a web crawling tool with 3 parameters and no annotations or output schema, the description is insufficiently complete. It doesn't explain what 'endpoints and paths' means in practice, how results are returned, error conditions, or security considerations. The high schema coverage helps, but the description should provide more operational context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all three parameters (urls, depth, scope) adequately. The description adds no additional parameter semantics beyond what's in the schema, maintaining the baseline score of 3 for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('crawler for discovering') and resource ('endpoints and paths'), and the qualifier 'fast' adds useful context. However, it doesn't explicitly differentiate from sibling tools like httpx or nuclei, which might have overlapping web reconnaissance functions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With siblings like httpx (HTTP probing) and nuclei (vulnerability scanning) available, there's no indication of katana's specific use cases, prerequisites, or limitations compared to these tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions 'fast port scanner' which implies performance characteristics, but lacks details on rate limits, network impact, authentication needs, output format, or error handling. For a scanning tool with zero annotation coverage, this is a significant gap in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the core functionality ('Fast port scanner') and purpose ('to discover open ports on hosts'). There is no wasted text, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of a port scanning tool (which involves network operations and potential side effects), the description is incomplete. With no annotations and no output schema, it fails to address critical aspects like what the tool returns, error conditions, performance constraints, or security implications, leaving significant gaps for agent understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, so the schema already documents all three parameters thoroughly. The description doesn't add any parameter-specific information beyond what's in the schema (e.g., it doesn't explain parameter interactions or provide examples beyond the schema's port format example). This meets the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('scan') and resource ('open ports on hosts'), and the adjective 'fast' adds useful context. However, it doesn't explicitly differentiate from potential sibling tools like 'nuclei' (which might scan for vulnerabilities rather than just ports) or 'httpx' (which might focus on HTTP services), leaving room for improvement in sibling distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention any specific scenarios, prerequisites, or exclusions, nor does it reference sibling tools like 'nuclei' for vulnerability scanning or 'httpx' for HTTP service detection, leaving the agent without usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions 'Fast vulnerability scanner' but lacks critical details like whether it's read-only or destructive, permission requirements, rate limits, or output format. This is a significant gap for a scanning tool with potential security implications.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with no wasted words. It's appropriately sized and front-loaded, clearly stating the core functionality without unnecessary elaboration, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of a vulnerability scanner with no annotations and no output schema, the description is incomplete. It doesn't cover behavioral traits, error handling, or result interpretation, which are crucial for effective tool invocation in a security context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, so the schema already documents all parameters (targets, templates, severity). The description adds no additional meaning beyond what the schema provides, such as explaining template sources or severity implications, resulting in a baseline score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose as a 'Fast vulnerability scanner using YAML-based templates,' which specifies the verb (scan), resource (vulnerabilities), and method (YAML templates). However, it doesn't differentiate from sibling tools like httpx or naabu, which might also perform scanning-related functions, keeping it from a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention specific contexts, prerequisites, or exclusions, such as comparing to bug_bounty_workflow or subfinder for different scanning phases, leaving the agent without usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the tool uses 'passive sources,' which implies non-intrusive discovery, but does not detail what this entails (e.g., rate limits, data sources, permissions required, or output format). For a tool with no annotations, this leaves significant gaps in understanding its behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence: 'Discover subdomains for a given domain using passive sources.' It is front-loaded with the core purpose, has zero wasted words, and is appropriately sized for the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations and output schema, the description is incomplete. It does not explain what the tool returns (e.g., list of subdomains, errors) or behavioral aspects like rate limits or data sources. For a tool with no structured support, the description should provide more context to be fully helpful.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, with clear documentation for both parameters ('domain' and 'silent'). The description does not add any additional meaning beyond what the schema provides, such as explaining the implications of 'passive sources' on parameter usage. Since the schema does the heavy lifting, the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Discover subdomains for a given domain using passive sources.' It specifies the verb ('discover'), resource ('subdomains'), and method ('passive sources'), making the intent unambiguous. However, it does not explicitly differentiate from sibling tools like dnsx or nuclei, which may also involve domain-related operations, so it doesn't reach the highest score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It mentions 'passive sources' but does not specify contexts where this is preferred over active methods or other sibling tools. Without any when-to-use, when-not-to-use, or alternative recommendations, the agent lacks usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. While it lists the workflow components, it doesn't describe critical behavioral traits like execution time, resource requirements, rate limits, permission needs, or what happens when the tool fails. For a complex 11-parameter tool with no annotation coverage, this is a significant gap in transparency about how the tool actually behaves.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that lists all workflow components without unnecessary words. It's appropriately sized for the tool's complexity and front-loads the comprehensive nature of the workflow. Every component mentioned earns its place by clarifying the tool's scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's high complexity (11 parameters, no output schema, no annotations), the description is insufficiently complete. It doesn't explain what the tool returns, how results are structured, error handling, or performance characteristics. For a workflow tool that orchestrates multiple security scanning components, users need more context about outputs and operational behavior to use it effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 11 parameters thoroughly. The description doesn't add any parameter-specific information beyond what's in the schema - it doesn't explain parameter interactions, dependencies, or provide examples. With complete schema coverage, the baseline of 3 is appropriate as the description doesn't compensate but doesn't need to since the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool executes a 'complete bug bounty reconnaissance workflow' and lists specific components: subdomain discovery, DNS resolution, port scanning, HTTP probing, crawling, and vulnerability scanning. This provides a clear verb+resource+scope combination that distinguishes it from sibling tools like dnsx, httpx, katana, naabu, nuclei, and subfinder, which appear to be individual components of this comprehensive workflow.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool should be used for comprehensive bug bounty reconnaissance rather than individual tasks, but it doesn't explicitly state when to use it versus the sibling tools. There's no guidance on prerequisites, exclusions, or specific scenarios where this workflow is preferred over running individual tools separately. The context is clear but lacks explicit alternatives or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

GitHub Badge

Glama performs regular codebase and documentation scans to:

Confirm that the MCP server is working as expected.
Confirm that there are no obvious security issues.
Evaluate tool definition quality.

Our badge communicates server capabilities, safety, and installation instructions.

Card Badge

Copy to your README.md:

[![pd-tools-mcp MCP server](https://glama.ai/mcp/servers/intelligent-ears/pd-tools-mcp/badges/card.svg)](https://glama.ai/mcp/servers/intelligent-ears/pd-tools-mcp)

Score Badge

Copy to your README.md:

[![pd-tools-mcp MCP server](https://glama.ai/mcp/servers/intelligent-ears/pd-tools-mcp/badges/score.svg)](https://glama.ai/mcp/servers/intelligent-ears/pd-tools-mcp)

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/intelligent-ears/pd-tools-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server