Skip to main content
Glama
Sign In
wx-mp-mcp

wx-mp-mcp

by k98crypto
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Local

Brute-force sign parameters

mp_sign_crack

Brute-forces signature parameters and algorithms from captured requests or source to identify the exact signing formula, then generates reproducible code for authorized analysis.

Instructions

签名参数穷举破解：给定抓包样本(JSONL) + 密钥，自动枚举参数子集 × 算法(HMAC/MD5/SHA/AES/DES)，找到产生该 sign 的精确公式并生成复现代码。传 report 可直接吃 mp_analyze 的 report.json(自动载入候选密钥+算法+参数序，免手动 key/source)；也可传 source_dir 从源码提取密钥。

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "mp_sign_crack"
  }
}

Input Schema

NameRequiredDescriptionDefault
keyNoHMAC/AES 密钥 (逗号分隔多个)
inlineNo直接传 URL-encoded 参数代替 capture_file
reportNomp_analyze 的 report.json 路径，自动载入候选密钥+算法+参数序(analyze→crack 桥)
sign_fieldNo签名字段名 (默认 sign)
source_dirNo解包源码目录，自动提取候选密钥
url_filterNo只破解 URL 包含此字符串的请求
capture_fileNo抓包 JSONL 文件路径

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.3

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses the combinatorial brute-force nature, the algorithm families tried, and that reproduction code is generated, which is useful behavioral context. However, it says nothing about expected runtime or cost, whether results are written to a file, or what happens when no formula is found.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core action followed by the two input modes. The dense enumeration of algorithms and parameters is justified, but the long single sentence is difficult to scan, and the report/source_dir alternatives could be structured more clearly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema and no annotations for a seven-parameter tool whose output is the main deliverable. The description says a precise formula and reproduction code are produced, but it does not say whether they are returned inline, written to a file, or how to interpret a failed exhaustive search.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the schema's own parameter descriptions already explain report (the analyze-to-crack bridge), source_dir key extraction, and sign_field defaults. The description mostly restates those, adding the cross-tool workflow framing but no new syntax, format, or precedence rules for the seven optional parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action and resource combination: brute-force the sign field given a capture sample (JSONL) plus key. It goes further by stating the search space (parameter subsets × HMAC/MD5/SHA/AES/DES) and the result (the exact formula plus reproduction code). This clearly distinguishes it from siblings such as mp_analyze (analysis) and mp_decrypt (decryption).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives two explicit usage paths: pass report to reuse mp_analyze's report.json and skip manual key/source work, or pass source_dir to extract keys from source. However, it never states when this tool would be the wrong choice, such as when the algorithm is already known, so the guidance remains clear but lacks explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools