pentest-suite
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| probeA | Sonde HTTP d'hôtes : statut, titre, bannière, technologies. Cible autorisée uniquement. |
| portsC | Scan TCP connect + bannières sur les ports courants. Cible autorisée uniquement. |
| dirsB | Découverte de chemins (wordlist + filtre soft-404). Cible autorisée uniquement. |
| tmplC | Détections par templates JSON façon nuclei. Cible autorisée uniquement. |
| kevB | Recherche dans CISA KEV et cve.now (vulns critiques / activement exploitées). Lecture seule. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 5 tools
Each tool targets a fairly distinct recon phase (HTTP probe, port scan, path discovery, template checks, vuln lookup). Minor overlap exists between probe and ports since both grab banners, and 'tmpl' is vague without reading its description.
All five names are single lowercase noun-like tokens following a consistent terse style. They deviate from a verb_noun convention, but the pattern itself is uniform and predictable.
Five tools is a lean but reasonable set for a recon/vuln-detection suite, and each earns its place. It's on the thin side for a 'pentest suite' but not mismatched.
Covers host probing, port scanning, dir discovery, template detections, and KEV lookup, but notable gaps remain: no subdomain/host enumeration, no exploitation/validation step, and no reporting or result aggregation.