This server lets you query BeVigil's mobile app OSINT data from an AI assistant to map a company's mobile attack surface.
Discover app infrastructure: Get hostnames/domains referenced in an Android app's code (bevigil_get_hosts).
Map subdomains: Find subdomains for a domain from mobile app analysis (bevigil_get_subdomains).
Find URLs: Retrieve full URLs, API endpoints, and paths referenced by apps (bevigil_get_urls).
Identify cloud storage: Get S3 bucket names embedded in an app (bevigil_get_s3_buckets).
Reverse lookup apps: Find which Android apps communicate with a given hostname/domain (bevigil_get_app_packages).
Build fuzzing wordlists: Get URL paths, API endpoints, and parameters extracted from an app (bevigil_get_wordlist).
Run comprehensive app investigations: Combine hosts, S3 buckets, params, and wordlist into one report (bevigil_investigate_app).
Paginate large result sets with limit and offset controls, including next-offset hints.
Use read-only, non-destructive tools suitable for recon, bug bounty, pentesting, and appsec work.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@bevigil-mcp-server Investigate com.whatsapp and summarize exposed infrastructure."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Map a company's mobile attack surface from your AI assistant.
BeVigil has scanned millions of Android apps and extracted the infrastructure hiding
inside them — backend hosts, staging subdomains, S3 buckets, API paths, and query
parameters that never appear in DNS or search engines. This server puts that data
behind seven MCP tools, so you can ask for it in plain language instead of
stitching together curl calls.
Built for bug bounty hunters, pentesters, red teamers, and appsec engineers doing recon.
Tested with Claude Code, Claude Desktop, Codex, Cursor, and VS Code.
Sign up at bevigil.com/osint-api. Free accounts get 25 credits, or 200 if you register with a work email. One lookup = one credit.
No clone, no build — npx fetches and runs it.
claude mcp add bevigil -e BEVIGIL_API_KEY=your_key_here -- npx -y bevigil-mcp-serverCheck it registered with claude mcp list.
Edit claude_desktop_config.json (Settings → Developer → Edit Config):
{
"mcpServers": {
"bevigil": {
"command": "npx",
"args": ["-y", "bevigil-mcp-server"],
"env": { "BEVIGIL_API_KEY": "your_key_here" }
}
}
}Restart Claude Desktop.
codex mcp add bevigil --env BEVIGIL_API_KEY=your_key_here -- npx -y bevigil-mcp-serverCheck it registered with codex mcp list.
Add to ~/.cursor/mcp.json (global) or .cursor/mcp.json (project):
{
"mcpServers": {
"bevigil": {
"command": "npx",
"args": ["-y", "bevigil-mcp-server"],
"env": { "BEVIGIL_API_KEY": "your_key_here" }
}
}
}Add to your VS Code MCP settings:
{
"mcp": {
"servers": {
"bevigil": {
"command": "npx",
"args": ["-y", "bevigil-mcp-server"],
"env": { "BEVIGIL_API_KEY": "your_key_here" }
}
}
}
}Investigate com.whatsapp with BeVigil and summarise the infrastructure it exposes.
You should get back something like this — real hostnames pulled out of the app's code:
# Investigation Report: com.whatsapp
Source: BeVigil OSINT API
## Hosts / Domains (155 found)
• osaka.nyc3.cdn.digitaloceanspaces.com
• s3.getstickerpack.com
• logger.instagram.com
• dev503.prn2.facebook.com
...That's it — you're doing OSINT from the chat window.
Related MCP server: OSINT Tools MCP Server
Recon a company's mobile footprint
Which Android apps talk to
api.acme.com? Then pull the hosts out of each one.
Find staging and internal endpoints
Get subdomains for
acme.comfrom BeVigil and flag anything that looks like dev, staging, or internal.
Hunt for exposed storage
What S3 buckets does
com.acme.mobilereference?
Build a target-specific fuzzing wordlist
Pull the BeVigil wordlist for
com.acme.mobileand save the API paths topaths.txt.
Pivot from a single domain
Find apps referencing
acme.com, then investigate the three most interesting ones and tell me which backends they share.
The last one is where an agent earns its keep — that's a dozen API calls and a correlation pass that you'd otherwise do by hand.
Tool | Input | Returns |
| package ID | Hostnames found in an app's code |
| domain | Subdomains seen across indexed apps |
| domain | Full URLs referenced by apps |
| package ID | S3 buckets referenced in an app |
| hostname | Reverse lookup — apps using that host |
| package ID | Paths, endpoints, and params for fuzzing |
| package ID | Hosts + S3 + params + wordlist in one report |
Every list-returning tool takes optional limit and offset (default 100, max
500). When results are truncated the response says so and gives the exact offset
to continue from:
Hosts for com.whatsapp (155 found)
Source: BeVigil OSINT (package: com.whatsapp)
Showing 1-100 of 155.
For the next page, call this tool again with offset=100.Responses are not cached. Every tool call — including each extra page — is one
API request and one credit. bevigil_investigate_app makes four calls per run, so
it costs four. When credits run out you get a clear message rather than a silent
empty result.
BeVigil only answers for apps it has already scanned. If a package isn't in the index, the tools tell you how to fix that:
"com.acme.mobile" is not in BeVigil's index, so there is no data to return.
To add it, upload the APK at https://bevigil.com/scanApp. BeVigil scans the app
and indexes the assets it finds, after which this tool will return them.This is deliberately distinguished from "app is indexed but has no S3 buckets" — only the first case is something you can act on.
Preferred: set it in your MCP client config (as shown in the quick start), which passes it to the server as an environment variable. For shell use:
export BEVIGIL_API_KEY=your_api_key_hereA .env file in the package root also works. Note that it's resolved relative
to the installed package rather than your working directory, since MCP clients
launch servers from arbitrary places. Real environment variables always win over
.env, and .env is gitignored — never commit it.
For local development, or to pin a specific commit:
git clone https://github.com/santhosh-005/bevigil-mcp-server.git
cd bevigil-mcp-server
npm install
npm run buildThen point your client at the built entry point instead of npx:
claude mcp add bevigil -e BEVIGIL_API_KEY=your_key_here -- node /absolute/path/to/bevigil-mcp-server/build/index.jsRequirements: Node.js 20.12+, a BeVigil API key, and an MCP-compatible client.
MCP Client → BeVigil MCP Server → osint.bevigil.com
· Zod input validation
· pagination + truncation
· error normalisationThe server is a thin, well-defended layer: it validates inputs, keeps responses inside a sensible context budget, and turns the API's several different ways of saying "nothing here" into one consistent, actionable message.
Design decisions worth knowing about:
Seven task-shaped tools, not raw endpoint wrappers — each maps to something a researcher actually wants.
Paginated results with next-offset hints, so large result sets stay reachable without flooding the context window.
Concurrent lookups in the investigation workflow.
Partial failure handling — a broken lookup doesn't sink the whole report.
Findings are labelled observed data, never asserted as vulnerabilities. A bucket name is a lead, not a finding.
Mobile app data only — this reflects what's embedded in Android app code, not DNS enumeration or internet-wide scanning. Use it alongside your usual tooling, not instead of it.
Index-only coverage — only apps BeVigil has scanned. Unindexed apps can be submitted at bevigil.com/scanApp.
No app search — you need a package ID or domain up front; there's no endpoint to discover apps by name.
Limited app metadata — reverse hostname lookups return app name and version; otherwise you get security-relevant assets only.
Data freshness — results reflect BeVigil's most recent scan of each app, which may not be current.
Credit-based — see Credits above.
API keys are read from the environment (or a package-root .env) — never
hardcoded, never logged
Error messages never expose credentials, and a test asserts this
The server only talks to known BeVigil endpoints — no arbitrary URL fetching
Path parameters are URL-encoded, so a crafted package ID can't escape the intended endpoint
All tool inputs are validated with Zod schemas
Request timeouts prevent hanging connections
Page sizes are bounded (max 500) to prevent context overflow
A pre-commit hook and a CI job both check that no credential reaches the repo
Every tool is annotated read-only and non-destructive — nothing this server exposes can modify data
No telemetry, no analytics, no stored queries — see PRIVACY.md
Use responsibly. This tool queries a public OSINT database. What you do with the results is your responsibility — only test systems you're authorised to test.
npm install
npm test # typecheck + full suite
npm run lint # typecheck only
npm run buildTests use Node's built-in runner with mocked API responses — no live calls, no credits spent. Coverage spans the API client (auth headers, every HTTP error path, timeouts, malformed and enveloped responses, and a check that errors never leak the key) and all seven tool handlers, including the investigation workflow's partial-failure behaviour. A registration contract test also asserts that every tool declares an input schema and all four MCP behaviour hints.
To enable the pre-commit hook that blocks committing credentials:
git config core.hooksPath .githooksIt refuses any commit that stages a .env file or puts a non-placeholder value in
.env.example, and runs gitleaks on staged
changes when installed.
├── src/
│ ├── index.ts # MCP server entry point
│ ├── bevigil-client.ts # API client (auth, errors, timeouts, envelopes)
│ ├── types.ts # Shared types, pagination, output helpers
│ └── tools/ # One file per MCP tool
├── tests/
│ ├── bevigil-client.test.ts
│ ├── tools.test.ts
│ └── fixtures/responses.ts
├── .github/workflows/ci.yml # Typecheck, build, test, secret scan
├── .githooks/pre-commit # Blocks committing credentials
└── server.json # MCP Registry metadataIssues and PRs welcome — bug reports, new BeVigil endpoints, and client configurations for MCP hosts not listed above are all useful.
MIT — see LICENSE. Privacy policy: PRIVACY.md.
Not affiliated with or endorsed by CloudSEK. BeVigil is a CloudSEK product; this is an independent open-source client for their public OSINT API.
Find Android application packages that reference a given hostname or domain. Use this for reverse lookups — given a server/domain, discover which mobile apps communicate with it. Useful for understanding the app ecosystem around a service. Returns package IDs and app names where available.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return (default 100, max 500). | |
| offset | No | Number of results to skip before returning a page (default 0). Use this to retrieve results beyond the first page. | |
| hostname | Yes | A hostname or domain to search for in mobile apps (e.g. "api.example.com"). Finds Android apps that communicate with this host. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already indicate readOnly, idempotent, and non-destructive, so the description does not need to repeat those. It adds a minor transparency detail by stating 'Returns package IDs and app names where available,' which hints at potential missing app names. However, it does not elaborate on rate limits, errors, or edge cases.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured, using only three sentences to convey the purpose, use case, and expected return. There is no redundant or extraneous information, making it efficient for an AI agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is no output schema, the description adequately states what is returned: 'package IDs and app names where available.' It covers the core functionality and use case. However, it does not mention potential limitations, error conditions, or how pagination parameters affect results, which could be considered a slight gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides descriptions for all three parameters, and the tool description does not add additional meaning beyond that. Since schema coverage is 100%, the baseline is 3. The description's generic mention of returning packages does not enrich the parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Find Android application packages that reference a given hostname or domain.' It specifies the verb (find), the resource (application packages), and the context (hostname/domain). This distinguishes it from sibling tools like get_hosts or get_urls, which focus on other aspects.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear use case: 'Use this for reverse lookups — given a server/domain, discover which mobile apps communicate with it.' This implies when to use the tool and differentiates it from alternatives, though it does not explicitly mention when not to use it or compare directly to siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get hostnames and domains found in an Android application's code. Use this to discover backend servers, APIs, and third-party services that a mobile app communicates with. Requires an Android package ID. Returns a list of unique hostnames/domains extracted from the app.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return (default 100, max 500). | |
| offset | No | Number of results to skip before returning a page (default 0). Use this to retrieve results beyond the first page. | |
| package_id | Yes | Android package ID (e.g. "com.whatsapp", "com.instagram.android"). This is the unique identifier for an Android application. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint false, so the safety profile is covered. The description adds behavioral context by stating it 'Returns a list of unique hostnames/domains extracted from the app,' which clarifies the output nature. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three succinct sentences: the first states the purpose, the second gives the use case, and the third covers requirements and output. No wasted words, and critical information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity, complete parameter schema, and rich annotations, the description is fairly complete. It covers purpose, use case, requirements, and return type. It does not mention pagination behavior explicitly, but the schema handles that, so the description is adequate for an agent to select and invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for all three parameters (package_id, limit, offset), so the schema already explains them thoroughly. The description adds minimal parameter-related value beyond reinforcing that package_id is required; it does not elaborate on limit/offset semantics beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get hostnames and domains') and the resource ('Android application's code'). It explicitly differentiates from sibling tools like bevigil_get_subdomains and bevigil_get_urls by focusing on hostnames/domains and their use case (discovering backend servers, APIs, third-party services).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear use context: 'Use this to discover backend servers, APIs, and third-party services that a mobile app communicates with.' It also specifies a prerequisite ('Requires an Android package ID'). However, it does not explicitly mention alternatives or when not to use it, though the sibling tool names imply differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Find Amazon S3 bucket names referenced in an Android application's code. Useful for discovering cloud storage assets associated with a mobile app. These buckets may contain publicly accessible data if misconfigured. Note: Finding a bucket name does NOT confirm it is vulnerable or misconfigured — further investigation is required.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return (default 100, max 500). | |
| offset | No | Number of results to skip before returning a page (default 0). Use this to retrieve results beyond the first page. | |
| package_id | Yes | Android package ID (e.g. "com.whatsapp"). The unique identifier for an Android application. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so safety profile is covered. The description adds that finding a bucket name does NOT confirm vulnerability, which is critical context for interpreting results. This goes beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with three sentences: purpose, value, and caveat. It is front-loaded with the primary action and resource, and every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description explains the tool's purpose and adds a security caveat. It does not describe return format or pagination behavior, but the schema covers parameters and annotations cover safety. For a read-only search tool, this is adequate but could mention pagination.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all three parameters. The description does not add any parameter-specific meaning beyond what the schema provides, such as package_id semantics or pagination details. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool finds Amazon S3 bucket names referenced in an Android application's code, and differentiates from siblings by focusing on S3 buckets specifically. It also notes the useful security context of discovering cloud storage assets.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for discovering cloud storage assets and includes a caution about not confirming vulnerability, which guides interpretation. However, it does not explicitly state when to use this over siblings, though the purpose is clear enough given the sibling tool names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Discover subdomains associated with a domain, as found across mobile applications indexed by BeVigil. Useful for attack surface mapping and asset discovery. Returns a list of unique subdomains. Note: Results come from mobile app analysis, not traditional DNS enumeration.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return (default 100, max 500). | |
| domain | Yes | A domain name to discover subdomains for (e.g. "example.com", "target.org"). Do not include protocol (http/https) or paths. | |
| offset | No | Number of results to skip before returning a page (default 0). Use this to retrieve results beyond the first page. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds meaningful behavioral context beyond these: results are drawn from BeVigil's mobile app index rather than DNS, are unique subdomains, and reflect only what appears in that indexed dataset. This helps set expectations about coverage and source without contradicting the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences, front-loaded with the main purpose, and every sentence adds value: what the tool does, why it is useful, what it returns, and a caveat about data provenance. There is no filler or redundant restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool is a simple read-only lookup with three well-documented parameters and informative annotations, the description is complete enough for an agent to select and invoke it correctly. It covers input domain, output type, data source, and practical use cases, and no output schema is needed to understand the list-of-subdomains return shape.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with domain, limit, and offset all already documented. The tool description adds no parameter-specific semantics beyond the schema; it only restates the domain concept and output shape. Since the schema carries the full parameter burden, the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Discover') with a clear resource ('subdomains associated with a domain') and identifies the unique data source ('mobile applications indexed by BeVigil'). It also states the output ('list of unique subdomains'), which clearly differentiates it from sibling tools focused on hosts, URLs, S3 buckets, app packages, and wordlists.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context by naming attack surface mapping and asset discovery as intended use cases. It also includes an important scoping note that results come from mobile app analysis, not traditional DNS enumeration, which helps users judge relevance. It does not explicitly name sibling alternatives or exclusions, but the context is sufficiently clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get URLs associated with a domain, as discovered from mobile application analysis. Useful for finding API endpoints, web paths, and resources referenced by apps. Returns a list of full URLs. Results may include internal/staging endpoints that are not publicly indexed by search engines.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return (default 100, max 500). | |
| domain | Yes | A domain name to find associated URLs for (e.g. "example.com"). Do not include protocol (http/https) or paths. | |
| offset | No | Number of results to skip before returning a page (default 0). Use this to retrieve results beyond the first page. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the tool read-only, idempotent, and non-destructive, so the description only needs to add behavioral context beyond safety. It does so by noting results 'may include internal/staging endpoints that are not publicly indexed by search engines,' which is a meaningful data-quality caveat. It also states the return shape as a list of full URLs, adding value without contradicting annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four short sentences, each adding distinct value: what the tool retrieves, where the data comes from, the use case, the return type, and a caveat. It is front-loaded with the core purpose and contains no filler or redundant restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple paginated list tool with full schema coverage and strong annotations, the description is complete. It identifies the input domain, explains the result is a list of full URLs, and adds an important caveat about internal/staging endpoints. No output schema exists, but the description sufficiently covers return semantics without needing to repeat schema pagination fields.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with clear descriptions for domain, limit, and offset already embedded in the input schema. The tool description does not add parameter-level details, so it provides no additional semantic value beyond the schema. A baseline of 3 is appropriate given the schema carries the full burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb-resource pairing ('Get URLs associated with a domain') and clearly distinguishes this tool from siblings focused on hosts, subdomains, S3 buckets, app packages, and wordlists. It also adds provenance ('as discovered from mobile application analysis') and clarifies the output is full URLs, making the purpose immediately unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear use case: 'Useful for finding API endpoints, web paths, and resources referenced by apps.' This is explicit context for when to use the tool, though it does not name alternative tools or state when not to use it. That places it just below the top tier because exclusions and sibling comparisons are absent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get a wordlist generated from an Android application's code. The wordlist includes URL paths, API endpoints, file paths, and parameters extracted from the app. Useful for fuzzing, directory brute-forcing, and understanding the app's API surface. Returns a list of path/endpoint strings.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return (default 100, max 500). | |
| offset | No | Number of results to skip before returning a page (default 0). Use this to retrieve results beyond the first page. | |
| package_id | Yes | Android package ID (e.g. "com.whatsapp"). The unique identifier for an Android application. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, and non-destructive behavior. The description adds that it extracts data from the app's code and returns a list of path/endpoint strings, which clarifies the output structure. This goes beyond annotations without repeating them. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact (two sentences) and front-loaded with the primary purpose. Every phrase adds value, such as 'generated from the app's code' and 'returns a list of path/endpoint strings'—no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with three parameters fully described in the schema and comprehensive annotations, the description is sufficient. It covers what the tool does, what it returns, and typical use cases. No critical information is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the description adds no parameter-specific insights. All three parameters (package_id, limit, offset) are already well-described in the schema. The description focuses on output and use cases, which is acceptable given the schema's completeness.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'get a wordlist generated from an Android application's code' and explicitly lists contents (URL paths, API endpoints, file paths, parameters). This distinguishes it from siblings like get_urls or get_hosts by focusing on a consolidated wordlist for fuzzing and API mapping.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states it is 'useful for fuzzing, directory brute-forcing, and understanding the app's API surface,' which provides clear use cases. It does not explicitly say when not to use it or directly compare to alternative tools, but the intent is evident from the stated purposes.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Perform a comprehensive investigation of an Android application using BeVigil. This combines multiple lookups (hosts, S3 buckets, parameters, wordlist) into a single structured report. Use this when you need a broad overview of an app's exposed infrastructure rather than querying individual asset types. Returns a structured investigation summary with observed findings. Note: All findings are observed data — they do NOT indicate vulnerabilities without further analysis.
| Name | Required | Description | Default |
|---|---|---|---|
| package_id | Yes | Android package ID to investigate (e.g. "com.whatsapp"). This will perform a comprehensive lookup across multiple data sources. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false不言而喻，说明是安全只读操作。Description adds the crucial caveat that findings are observed data and do not indicate vulnerabilities without further analysis, which is valuable context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is two sentences plus a note, all front-loaded with purpose and usage distinction. No fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is complex (combines multiple lookups) but has only one parameter and strong annotations. The description mentions the combined nature, the alternative, and the 'observed data' caveat. Without an output schema, it gives enough context for the agent to understand its scope and limitations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description covers the single parameter fully (100% coverage). The tool description repeats the schema's definition but adds no new semantics. Baseline 3 is appropriate since the schema already provides complete parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool performs a comprehensive investigation of an Android app, combining multiple lookups (hosts, S3 buckets, parameters, wordlist) into a single report. It explicitly contrasts with querying individual asset types, distinguishing it from sibling tools like bevigil_get_hosts and bevigil_get_subdomains.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance on when to use this tool: 'Use this when you need a broad overview of an app's exposed infrastructure rather than querying individual asset types.' This directly addresses alternatives and sets up a clear decision rule.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.1.0bevigil_get_app_packages2 fields changedInput schema / properties / limitAdded value: +{
+ "description": "Maximum number of results to return (default 100, max 500).",
+ "maximum": 500,
+ "minimum": 1,
+ "type": "integer"
+}Input schema / properties / offsetAdded value: +{
+ "description": "Number of results to skip before returning a page (default 0). Use this to retrieve results beyond the first page.",
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+}bevigil_get_hosts2 fields changedInput schema / properties / limitAdded value: +{
+ "description": "Maximum number of results to return (default 100, max 500).",
+ "maximum": 500,
+ "minimum": 1,
+ "type": "integer"
+}Input schema / properties / offsetAdded value: +{
+ "description": "Number of results to skip before returning a page (default 0). Use this to retrieve results beyond the first page.",
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+}bevigil_get_s3_buckets2 fields changedInput schema / properties / limitAdded value: +{
+ "description": "Maximum number of results to return (default 100, max 500).",
+ "maximum": 500,
+ "minimum": 1,
+ "type": "integer"
+}Input schema / properties / offsetAdded value: +{
+ "description": "Number of results to skip before returning a page (default 0). Use this to retrieve results beyond the first page.",
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+}bevigil_get_subdomains2 fields changedInput schema / properties / limitAdded value: +{
+ "description": "Maximum number of results to return (default 100, max 500).",
+ "maximum": 500,
+ "minimum": 1,
+ "type": "integer"
+}Input schema / properties / offsetAdded value: +{
+ "description": "Number of results to skip before returning a page (default 0). Use this to retrieve results beyond the first page.",
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+}bevigil_get_urls2 fields changedInput schema / properties / limitAdded value: +{
+ "description": "Maximum number of results to return (default 100, max 500).",
+ "maximum": 500,
+ "minimum": 1,
+ "type": "integer"
+}Input schema / properties / offsetAdded value: +{
+ "description": "Number of results to skip before returning a page (default 0). Use this to retrieve results beyond the first page.",
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+}bevigil_get_wordlist2 fields changedInput schema / properties / limitAdded value: +{
+ "description": "Maximum number of results to return (default 100, max 500).",
+ "maximum": 500,
+ "minimum": 1,
+ "type": "integer"
+}Input schema / properties / offsetAdded value: +{
+ "description": "Number of results to skip before returning a page (default 0). Use this to retrieve results beyond the first page.",
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+}v1.0.0bevigil_get_app_packagesbevigil_get_hostsbevigil_get_s3_bucketsbevigil_get_subdomainsbevigil_get_urlsbevigil_get_wordlistbevigil_investigate_appScored across 7 tools
Each tool targets a distinct resource type (hosts, subdomains, URLs, S3 buckets, app packages, wordlists) with clear input requirements (package ID vs domain), making misselection unlikely. The composite investigate_app is explicitly higher-level and differentiated from individual lookups.
All tools share the bevigil_ prefix and follow a consistent verb_noun pattern (get_X for direct lookups, investigate_app for the composite). Names are snake_case throughout with no mixed conventions or ambiguous verbs.
Seven tools is well within the ideal 3-15 range. Each tool represents a distinct asset-discovery query or one composite overview, so every tool earns its place without redundancy.
The set covers both app-centric queries (hosts, S3 buckets, wordlist, investigate) and domain-centric queries (subdomains, URLs, reverse package lookup), providing comprehensive coverage of mobile app attack-surface assessment with no obvious dead ends.
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
Free MCP server: 36 security & dev API tools -- WHOIS, DNS, CVE, IP reputation, Cosmos SDK.
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
