offsec-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| NVD_API_KEY | No | Optional NVD API key to raise rate limits. | |
| OFFSEC_SCOPE | No | Inline authorization scope: comma-separated domains, wildcards, and CIDRs. Example: example.com,*.staging.example.com,10.0.0.0/24 | |
| OFFSEC_ALLOW_ANY | No | Set to '1' to disable the authorization scope guard (use only for fully-owned lab). | |
| OFFSEC_SCOPE_FILE | No | Path to a file containing authorization scope entries, one per line (# comments allowed). |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| extensions | {
"io.modelcontextprotocol/ui": {}
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| recon_subdomainsA | Passively enumerate sub-domains of a domain from Certificate Transparency logs. |
| dns_lookupA | Resolve A/AAAA/MX/NS/TXT/CNAME records for a domain (via DNS-over-HTTPS). |
| whoisA | Look up domain registration data (registrar, dates, nameservers) via RDAP. |
| cve_searchB | Search the NVD for recent CVEs by keyword, filtered by minimum CVSS score. |
| cve_lookupA | Fetch full details and references for a specific CVE id (e.g. CVE-2024-3094). |
| analyze_jsA | Extract secrets, endpoints, and parameters from JavaScript (pasted content or a URL). |
| http_probeA | Fetch a URL and report status, key headers, and detected technologies. [active — needs scope] |
| security_headersB | Audit a site's HTTP security headers and grade them A–F. [active — needs scope] |
| port_scanA | TCP-connect scan a host for open ports (defaults to common ports). [active — needs scope] |
| scope_statusA | Report whether an authorization scope is configured for active tools. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 10 tools
Most tools target distinct actions (recon, DNS, WHOIS, CVE search/lookup, JS analysis, HTTP probing, header auditing, port scanning), but http_probe and security_headers both fetch a URL and could be confused without careful reading. cve_search and cve_lookup are also similar in name but serve different purposes.
Tool names mostly follow a snake_case pattern with a clear verb_noun structure (recon_subdomains, cve_search, analyze_js, port_scan). A few names like whois and scope_status deviate from this, but the overall convention is consistent and readable.
Ten tools is well-scoped for an offensive security server. Each tool represents a distinct phase of recon or assessment, and none feel redundant or superfluous.
The set covers passive recon (subdomains, DNS, WHOIS), vulnerability research (CVE), and active assessment (HTTP, headers, ports, JS). Minor gaps exist like no explicit tool for web technology fingerprinting beyond http_probe, but the core workflow is well covered.