Skip to main content
Glama
Sign In
Tengu

Tengu

by rfunix
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

zap_spider

Crawl a web application to discover all links and URLs, building a complete site map as the essential first step before security scanning.

Instructions

Spider/crawl a web application using OWASP ZAP.

Discovers all links and application URLs by crawling the target application. This is typically the first step before an active scan.

Args: url: Target URL to start spidering from. max_depth: Maximum crawl depth. Default: 5. wait_for_completion: Wait for the spider to finish before returning. timeout: Override scan timeout in seconds.

Returns: Spider results with discovered URLs and status.

Note: - Requires OWASP ZAP to be running with API enabled. - Set ZAP_BASE_URL and ZAP_API_KEY environment variables.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "url": "<url>"
    },
    "name": "zap_spider"
  }
}

Input Schema

NameRequiredDescriptionDefault
urlYes
timeoutNo
max_depthNo
wait_for_completionNo

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.3.1

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It mentions that OWASP ZAP must be running and requires environment variables, but it does not state whether the crawl is a read-only operation, potential side effects (e.g., sending requests to target), time expectations, or what happens on failure. This is a significant gap for a tool that actively interacts with a target.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a summary, args, returns, and note sections. It is appropriately sized and front-loaded with the main purpose. Minor redundancy exists between the first two sentences ('Spider/crawl...' and 'Discovers all links...'), preventing a perfect score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is a crawler with four parameters and an output schema, and the description covers its basic purpose, prerequisites, and parameter defaults. However, it lacks information about error handling, failure modes (e.g., if ZAP is unreachable), and any caveats about crawl behavior. While the output schema likely covers return values, the description doesn't provide enough context for an agent to fully understand the tool's operational bounds.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It provides explanations for max_depth (default 5), wait_for_completion (wait for spider to finish), and timeout (override scan timeout in seconds). However, it does not explain the URL format or behaviors when timeout is null or when wait_for_completion is false. The parameter semantics are adequate but not comprehensive.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: spider/crawl a web application using OWASP ZAP, discovering links and URLs. It identifies the specific resource (OWASP ZAP) and the action, and notes it's typically the first step before an active scan. However, it doesn't explicitly differentiate from other spider/crawl tools like katana_crawl or feroxbuster_scan, so it's not a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage context: 'This is typically the first step before an active scan,' which implies using it before zap_active_scan. It also lists prerequisites (ZAP running, environment variables). It doesn't explicitly mention when to use alternatives or when not to use this tool, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools