Ligolo-ng MCP Server
Manages Ligolo-ng operations on a remote Kali Linux machine via SSH, enabling proxy management, agent control, tunnel setup, route management, and port forwarding for network pivoting during security assessments.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Ligolo-ng MCP ServerStart the ligolo proxy with self-cert enabled"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Ligolo-ng MCP Server
A Model Context Protocol (MCP) server for managing Ligolo-ng - a lightweight and fast tunneling tool for establishing reverse TCP/TLS tunnels during penetration testing and red team engagements.
Overview
This MCP server enables AI assistants to control Ligolo-ng operations on a remote Kali Linux machine via SSH. It provides tools for managing the proxy server, agents, tunnels, routes, and listeners - all the core functionality needed for network pivoting during security assessments.
Related MCP server: CrackMapExec MCP Server
Features
Proxy Management: Start, stop, and monitor the Ligolo-ng proxy server
Agent Control: List connected agents and manage sessions
Network Interface: Create and manage TUN interfaces for tunneling
Tunnel Operations: Start/stop tunnels through agent sessions
Route Management: Add and remove routes to target networks
Listener Configuration: Set up port forwarding through agents
Agent Command Generation: Generate agent connection commands for targets
Prerequisites
Node.js 18+
SSH access to a Kali Linux machine with Ligolo-ng installed
SSH key-based authentication configured (passwordless SSH)
Installation
# Clone the repository
git clone https://github.com/schwarztim/sec-ligolo-ng-mcp.git
cd sec-ligolo-ng-mcp
# Install dependencies
npm install
# Build the project
npm run buildConfiguration
Environment Variables
Variable | Default | Description |
|
| SSH hostname or alias for your Kali machine |
|
| Port for agent connections |
|
| Port for the Ligolo-ng web API |
|
| Default TUN interface name |
SSH Configuration
Ensure your SSH config (~/.ssh/config) has an entry for your Kali machine:
Host kali
HostName 192.168.1.100
User root
IdentityFile ~/.ssh/id_rsaClaude Desktop Integration
Add to your claude_desktop_config.json:
{
"mcpServers": {
"ligolo-ng": {
"command": "node",
"args": ["/path/to/sec-ligolo-ng-mcp/dist/index.js"],
"env": {
"KALI_HOST": "kali",
"LIGOLO_PROXY_PORT": "11601"
}
}
}
}Available Tools
Proxy Management
Tool | Description |
| Start the Ligolo-ng proxy server with optional self-signed certs and API |
| Stop the running proxy server |
| Check proxy status and view recent logs |
Session Management
Tool | Description |
| List all connected agents |
| Select an agent session to work with |
| Get network information from the selected agent |
Network Configuration
Tool | Description |
| Create a TUN interface for tunneling |
| List all TUN interfaces |
| Start a tunnel through the selected session |
| Stop the active tunnel |
Routing
Tool | Description |
| Add a route to access target networks |
| Remove a route |
| List all Ligolo routes |
Port Forwarding
Tool | Description |
| Add a listener for reverse connections |
| List active listeners |
| Remove a listener |
Utilities
Tool | Description |
| Generate agent command for target deployment |
| Get certificate fingerprint for secure connections |
| Send raw commands to the proxy console |
Usage Example
Basic Pivoting Workflow
Start the proxy on Kali:
Use ligolo_proxy_start with selfcert enabledGenerate agent command:
Use ligolo_agent_command with your Kali IPCreate TUN interface:
Use ligolo_interface_createAfter agent connects, add routes:
Use ligolo_route_add with network 10.10.10.0/24Start the tunnel:
Use ligolo_tunnel_start
Now you can access the 10.10.10.0/24 network through your Kali machine.
Setting Up Reverse Shell Callback
Use listeners to receive reverse shells through the pivot:
Use ligolo_listener_add with:
localAddress: 0.0.0.0:4444
remoteAddress: 127.0.0.1:4444This forwards connections from port 4444 on the agent back to your Kali's port 4444.
Security Considerations
This tool is designed for authorized security testing only
Always use certificate verification in production environments
The proxy runs with elevated privileges to manage network interfaces
SSH keys should be properly secured and not shared
Development
# Watch mode for development
npm run dev
# Build
npm run build
# Start the server
npm startLicense
MIT License - See LICENSE for details.
Acknowledgments
Ligolo-ng by Nicolas Chatelain
Model Context Protocol by Anthropic
Disclaimer
This tool is intended for authorized security testing and educational purposes only. Users are responsible for ensuring they have proper authorization before using this tool against any systems. The authors are not responsible for any misuse or damage caused by this tool.
Available Tools
19 toolsligolo_agent_commandC
Generate the agent command to run on target machines
| Name | Required | Description | Default |
|---|---|---|---|
| proxyIp | Yes | IP address of the proxy server (Kali) | |
| port | No | Port the proxy is listening on | 11601 |
| ignoreCert | No | Ignore certificate verification (for self-signed) | |
| fingerprint | No | Certificate fingerprint for verification (optional) | |
| useWs | No | Use WebSocket transport | |
| retry | No | Auto-retry on connection error |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description should disclose behavior. It only says 'generate' without mentioning what the output is (e.g., a string command), side effects, or any other behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence. It is front-loaded and efficient, though slightly more detail would not hurt.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool and full schema, the description is mostly adequate but lacks information about the output format or any constraints, which could be useful.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% parameter description coverage, so the description does not need to add much. It provides no additional meaning beyond the schema, which is sufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool generates the agent command for target machines. However, it does not distinguish from siblings like ligolo_agent_info or clarify that the output is a command string.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives or any prerequisites. The description lacks context for when this command should be generated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ligolo_agent_infoA
Get network information from the selected agent (ifconfig)
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It explains the tool retrieves network information (like ifconfig) from a selected agent. It implies read-only behavior, but could be more explicit about lack of side effects or prerequisites.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of 9 words, conveying the essential purpose without any filler. It is appropriately front-loaded and concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity (no parameters, no output schema), the description is largely complete. The only gap is that it does not mention that an agent must be selected first, but this is implied by the phrasing 'from the selected agent.'
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, and schema coverage is 100%. The baseline for zero parameters is 4. The description adds no parameter details, but none are needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it gets network information from the selected agent, using 'ifconfig' as a reference. It distinguishes from sibling tools like ligolo_agent_command (command execution) and ligolo_agents_list (listing agents).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly indicates it operates on a selected agent, but does not explicitly state when to use it or exclude alternatives. The context from sibling names provides some differentiation, but explicit guidance is missing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ligolo_agents_listA
List all connected agents to the ligolo-ng proxy
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description uses the word 'List', which implies a read-only operation, but it does not explicitly state whether there are side effects or permissions required. With no annotations, the description carries the burden and is adequate but not elaborate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear, and front-loaded sentence with no extraneous information, effectively conveying the tool's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple parameterless tool with no output schema, the description provides complete context: it lists all connected agents. No further details are needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, and the schema description coverage is 100%. The description adds value by explaining the tool's action, which is sufficient given no parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'List all connected agents to the ligolo-ng proxy' clearly specifies the verb (List) and the resource (connected agents), and it distinguishes from sibling tools like ligolo_agent_command or ligolo_agent_info by focusing on listing all agents.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit usage guidance is provided; the tool's purpose is implied by its name and description, but there is no mention of when to use it versus alternatives like ligolo_agent_info for specific agent details.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ligolo_certificate_fingerprintA
Get the certificate fingerprint for agent verification
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description is minimal. It implies a read-only operation (get) but does not confirm safety, idempotency, or any side effects. It does not add behavioral context beyond the basic purpose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no wasted words. It is front-loaded with the verb and resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description could explain the return format (e.g., a hash string), but it does not. It is adequate for a simple getter but lacks completeness for an agent to fully understand the output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so the schema coverage is 100%. The description adds no extra meaning about parameters, but the baseline for zero parameters is 4, as per guidelines.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get', the resource 'certificate fingerprint', and the purpose 'for agent verification'. It distinguishes itself from sibling tools like ligolo_agent_info or ligolo_proxy_status, which do not mention fingerprints.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. There is no mention of prerequisites, context, or exclusions, leaving the agent to infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ligolo_interface_createB
Create a TUN interface for ligolo-ng tunneling
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Name of the TUN interface to create | ligolo |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. Description only states 'Create' which implies mutation, but no details on side effects (e.g., what if interface already exists), authorization needs (likely root), or state changes. Lacks behavioral disclosure beyond basic action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no fluff, front-loaded with action and context. However, it could be slightly expanded to include outcome or usage note without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, no annotations, and description does not mention return values or success indicators. For a creation tool, more context (e.g., what happens after creation, how to verify) would be expected.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with parameter 'name' described. Description adds no additional semantics beyond what schema already provides. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states verb 'Create', resource 'TUN interface', and context 'for ligolo-ng tunneling'. It distinguishes from sibling tools that deal with agents, listeners, proxy, routes, sessions, tunnels.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives. No mention of prerequisites, such as needing proxy to be running or root privileges. Sibling tools like ligolo_interface_list exist but no differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ligolo_interface_listA
List all TUN interfaces on Kali
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states the action but does not disclose behavioral traits like read-only nature, required permissions, or error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no wasted words, front-loading the essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While the tool is simple, the description does not mention return values (no output schema) or provide context about what 'TUN interfaces' refers to, leaving some ambiguity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, and schema coverage is 100%. The description adds no parameter info beyond the schema, but baseline for 0 parameters is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List') and the resource ('all TUN interfaces on Kali'), making it distinct from sibling tools like 'ligolo_interface_create' or 'ligolo_agent_list'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the tool name and sibling differentiation, but no explicit context is given about when to use this tool versus alternatives or any prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ligolo_listener_addA
Add a listener on the agent to forward ports back to the attacker
| Name | Required | Description | Default |
|---|---|---|---|
| localAddress | Yes | Local address to listen on (e.g., 0.0.0.0:4444) | |
| remoteAddress | Yes | Remote address to forward to (e.g., 127.0.0.1:4444 on Kali) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It describes the basic action but does not disclose side effects (e.g., opening ports), prerequisites (e.g., active agent session), or reversibility. The behavioral transparency is minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that immediately conveys the tool's purpose. No extraneous information, front-loaded verb 'Add'. Efficient and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the core function but omits important context such as the need for an active agent connection, what happens if a listener already exists, or that this is a reverse port forward. Given the complexity of network tunneling, more context would help.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for both parameters. The tool description adds extra context by specifying that remoteAddress is on the attacker's machine (e.g., Kali), which adds meaning beyond the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (Add a listener), the resource (on the agent), and the purpose (forward ports back to the attacker). It effectively distinguishes from siblings like ligolo_listener_delete and ligolo_listener_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The purpose is stated, but there is no explicit guidance on when to use this tool versus alternatives like ligolo_tunnel_start or ligolo_route_add. The context is implied but not spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ligolo_listener_deleteC
Delete a listener
| Name | Required | Description | Default |
|---|---|---|---|
| listenerId | Yes | ID of the listener to delete |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, and the description only says 'Delete a listener'. It does not disclose any behavioral traits such as irreversibility, required permissions, or side effects beyond the obvious deletion.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise and front-loaded. For a simple delete operation, this brevity is acceptable, though slightly more context would be beneficial.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple nature of the tool (single required param, no output schema), the description is minimally adequate. However, it lacks behavioral context that would help an agent understand the operation fully.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with a clear description for the single parameter 'listenerId'. The description adds no extra meaning beyond the schema, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Delete a listener' clearly states the action (delete) and the resource (listener). It is unambiguous, though it essentially restates the tool name, which is a minor limitation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like ligolo_listener_add or ligolo_listener_list. There is no mention of prerequisites or context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ligolo_listener_listA
List all active listeners
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It only states the action without mentioning authentication, read-only nature, or output format, leaving gaps for an AI agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded, no redundant words—ideal conciseness for a tool with no parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters and no output schema, the description covers the tool's core function. It could implicitly describe the return type (e.g., 'list of active listeners with details') but remains adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so the description adds no param info. Baseline for zero-param tools is 4, and the description does not need to compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'List all active listeners' specifies a clear verb and resource, and distinguishes it from siblings like ligolo_listener_add and ligolo_listener_delete.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool or alternatives. Sibling tools include other listener operations, but the description provides no context on prerequisites or trade-offs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ligolo_proxy_startB
Start the ligolo-ng proxy server on Kali. The proxy accepts agent connections and manages tunnels.
| Name | Required | Description | Default |
|---|---|---|---|
| selfcert | No | Use self-signed certificates (default: true) | |
| port | No | Port for agents to connect (default: 11601) | 11601 |
| enableApi | No | Enable the web API for remote control | |
| apiPort | No | Port for the web API (default: 8080) | 8080 |
| daemonMode | No | Run proxy in daemon/background mode |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and the description does not disclose important behaviors like idempotency, blocking nature, or permission requirements. It only states generic functionality.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two succinct sentences that immediately state the tool's purpose and key behavior. No wasted words, front-loaded with essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite 5 optional parameters and no output schema, the description fails to explain return values, error handling, or how to verify successful start. More context is needed for a server-starting tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All 5 parameters are documented in the schema with clear descriptions and defaults. The tool description adds no new information beyond the schema, meeting the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool starts the ligolo-ng proxy server on Kali and explains its function of accepting agent connections and managing tunnels, effectively distinguishing it from sibling tools like ligolo_proxy_stop.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, such as prerequisites or contextual triggers (e.g., starting proxy before agents). The description lacks usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ligolo_proxy_statusA
Check the status of the ligolo-ng proxy server
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose what 'status' entails (e.g., what fields are returned, whether it's just running/stopped or more details). The description carries the full burden but fails to provide behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no extraneous information, perfectly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no parameters, the description is minimal. It adequately conveys purpose but lacks details on return format or expected behavior, which would be helpful for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so the description adds no additional meaning beyond the empty schema. Baseline for zero parameters is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (check status) and the resource (ligolo-ng proxy server), distinguishing it from sibling tools like ligolo_proxy_start and ligolo_proxy_stop.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for checking proxy status but provides no explicit guidance on when to use this tool versus alternatives, nor any when-not conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ligolo_proxy_stopA
Stop the running ligolo-ng proxy server on Kali
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description implies a destructive action (stopping a server) but does not elaborate on side effects, such as termination of active tunnels or connections.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, perfectly concise with no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple stop action with no parameters and no output schema, the description is complete and sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so the description naturally adds no parameter info; baseline 4 applies for zero-parameter tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states verb 'Stop' and resource 'ligolo-ng proxy server', distinguishing it from sibling tools like start and status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, nor any prerequisites like checking if proxy is running.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ligolo_route_addB
Add a route to access the agent's network through the tunnel
| Name | Required | Description | Default |
|---|---|---|---|
| network | Yes | Network CIDR to route (e.g., 10.10.10.0/24) | |
| interface | No | TUN interface name | ligolo |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must carry the full burden of behavioral disclosure. It does not mention side effects, permissions, or constraints, which is insufficient for a tool that modifies network routing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence. It is concise and front-loaded, though slightly too brief for the complexity of the action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema and modifies network state. The description does not explain what happens after adding a route (e.g., confirmation, errors, when it takes effect), leaving the agent with incomplete context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with both parameters described. The description adds no extra meaning beyond what the schema provides, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Add', the resource 'route', and the purpose 'access the agent's network through the tunnel'. This distinguishes it from sibling tools like ligolo_route_delete and ligolo_route_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives is provided. An agent would benefit from knowing when adding a route is appropriate, but the description offers no context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ligolo_route_deleteB
Delete a route from the routing table
| Name | Required | Description | Default |
|---|---|---|---|
| network | Yes | Network CIDR to remove from routes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must fully convey behavior. It only states the deletion action without mentioning side effects, reversibility, permission requirements, or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise: a single sentence with no unnecessary words. It is front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple destructive tool with one parameter and no output schema, the description is minimally adequate but lacks context about safety, usage flow with sibling tools, or error conditions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes the 'network' parameter as 'Network CIDR to remove from routes' (100% coverage). The tool description adds no additional meaning beyond what is in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Delete') and the resource ('a route from the routing table'). It is specific and distinguishes itself from sibling tools like ligolo_route_add and ligolo_route_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus its alternatives. There is no mention of prerequisites, conditions, or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ligolo_route_listA
List all routes configured for ligolo interfaces
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full responsibility for behavioral disclosure. It only states 'list all routes' without detailing whether the operation is instantaneous, requires a running proxy, or returns any specific data structure. No side effects or prerequisites are mentioned, leaving significant gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no superfluous words. Every part contributes to the purpose, making it highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters and no output schema or annotations, the description is minimal but adequate for a simple list tool. It does not specify the return format or any connectivity requirements, which could be helpful for an agent. Overall, it meets the minimum viable standard.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters, and schema coverage is 100%. The description adds context by specifying 'for ligolo interfaces', which clarifies the scope. Since there are no parameters to document, a baseline of 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'list' and the resource 'all routes configured for ligolo interfaces', making the tool's purpose immediately obvious. The name and description align well, and it is distinct from sibling tools like ligolo_route_add and ligolo_route_delete.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No usage guidelines are provided. The description does not indicate when to use this tool versus alternatives (e.g., before adding or deleting routes). The context is implied by the name alone, which is insufficient for an agent to understand the appropriate scenario.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ligolo_send_commandB
Send a raw command to the ligolo-ng proxy console (advanced)
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | Raw command to send to ligolo-ng console |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description must disclose behavioral traits. It only says 'raw command' and 'advanced' without mentioning potential risks, side effects, or required permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, 10 words, front-loaded with key information. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool is simple with one param and no output schema. Description covers the core action but lacks details on return values, error conditions, or behavior on invalid commands.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the parameter description already explains the param. The tool description adds the word 'advanced' but no additional semantic value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (send) and resource (ligolo-ng proxy console), and uses 'advanced' to hint at caution. However, it does not explicitly differentiate from similar sibling tools like ligolo_agent_command.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like ligolo_agent_command. The word 'advanced' implies limited use but does not provide concrete criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ligolo_session_selectB
Select an agent session to work with
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | Session ID number to select (from agents list) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description does not disclose behavioral traits such as whether selection is read-only or changes state, or what happens if session ID is invalid.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence conveys purpose efficiently, but could include additional contextual details without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and no output schema, the description is adequate but lacks mention of success/failure indicators or post-selection behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and schema already describes the parameter well; description adds no extra meaning beyond 'Session ID number to select (from agents list)'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses specific verb 'Select' and resource 'agent session', clearly distinguishing it from sibling tools like 'ligolo_agents_list' which lists agents.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is used before other operations but lacks explicit guidance on when to use it vs. alternatives like 'ligolo_agent_info' or 'ligolo_agents_list'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ligolo_tunnel_startB
Start a tunnel through a selected agent session
| Name | Required | Description | Default |
|---|---|---|---|
| tun | No | TUN interface name to use | ligolo |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, placing the full disclosure burden on the description. The description only states the basic action ('start a tunnel') without revealing behavioral traits such as required permissions (e.g., root), side effects (interface binding), or state changes. This is insufficient for safe invocation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence of 6 words, well-suited for quick reading. However, it sacrifices some completeness for brevity, which is acceptable for a simple tool but could be slightly improved.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool likely depends on a previously selected agent session (as hinted) and may require other setup steps (e.g., ligolo_session_select, ligolo_proxy_start). The description does not explain these dependencies, the lifecycle of the tunnel, or what constitutes a successful start. Given the lack of output schema and annotations, the description is incomplete for a user unfamiliar with the toolset.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'tun' is described in the schema as 'TUN interface name to use'. The description does not add any additional meaning beyond the schema. With 100% schema coverage, the baseline is 3, and no extra value is provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Start a tunnel through a selected agent session' clearly specifies the action (start) and resource (tunnel), and includes contextual detail ('through a selected agent session') that distinguishes it from siblings like ligolo_tunnel_stop (stop) or ligolo_session_select (select).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies a dependency on a selected agent session but does not explicitly state prerequisites, when to use this versus other tunneling or session tools, or alternatives like ligolo_interface_create. Usage context is implied but not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ligolo_tunnel_stopA
Stop the active tunnel
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears full burden but only says 'Stop the active tunnel', lacking details on side effects, reversibility, or what happens if no tunnel is active.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no wasted words, front-loading the action and resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with no parameters and no output schema, the description covers the basic purpose but lacks behavioral context that could help the agent understand side effects or failure modes.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so baseline is 4 per guidelines. The description adds no extra param details but is consistent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'Stop' and the resource 'active tunnel', distinguishing it from sibling tools like 'ligolo_tunnel_start'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, such as prerequisites or conditions for stopping the tunnel.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
19 tool updates
v1.0.0- First observed
ligolo_agent_command - First observed
ligolo_agent_info - First observed
ligolo_agents_list - First observed
ligolo_certificate_fingerprint - First observed
ligolo_interface_create - First observed
ligolo_interface_list - First observed
ligolo_listener_add - First observed
ligolo_listener_delete - First observed
ligolo_listener_list - First observed
ligolo_proxy_start - First observed
ligolo_proxy_status - First observed
ligolo_proxy_stop - First observed
ligolo_route_add - First observed
ligolo_route_delete - First observed
ligolo_route_list - First observed
ligolo_send_command - First observed
ligolo_session_select - First observed
ligolo_tunnel_start - First observed
ligolo_tunnel_stop
TDQS
Scored across 19 tools
Tools cover distinct functional areas: agent management, proxy control, routing, tunneling, interface, and listeners. While there is slight overlap between session selection and agent info, descriptions likely clarify. Overall, each tool has a clear purpose.
All tools share the 'ligolo_' prefix and snake_case, but the pattern varies: most are noun_verb (e.g., ligolo_agents_list, ligolo_route_add), while some are noun_noun (e.g., ligolo_certificate_fingerprint) and one is verb_noun (ligolo_send_command). This inconsistency could confuse an agent.
19 tools cover the primary operations of ligolo-ng (agent, proxy, routing, tunneling, listeners, interface). This is a reasonable count; not too sparse or overwhelming for the intended domain.
The set includes CRUD-like operations for key elements (routes, listeners, interfaces) and essential proxy/agent controls. Minor gaps like agent disconnection or route modification are addressable via the send_command tool, so coverage is solid.
Maintenance
Related MCP Connectors
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
Remote MCP server for supportsheep: run AI interviews and manage support content for your blog.
Remote MCP server to read and manage your Atako AI agents, messages, files, and integrations.
31
Related MCP Servers
- AlicenseAqualityBmaintenanceMCP server for managing multiple SSH servers via AI assistants, offering tools for remote command execution, file operations, and system monitoring.111MIT
- AlicenseAqualityFmaintenanceAn MCP server that provides AI assistants with access to CrackMapExec/NetExec network penetration testing capabilities via SSH to a Kali Linux host, supporting multiple protocols for enumeration, credential dumping, and command execution.11MIT
- AlicenseAqualityCmaintenanceAn MCP server that gives AI agents SSH access to remote machines through your local OpenSSH client, enabling remote command execution, file transfer, persistent shell sessions, and port forwarding.1719MIT
- AlicenseAqualityBmaintenanceAn MCP server that enables AI assistants to execute NetExec network penetration testing commands via SSH to a Kali Linux machine, supporting protocols like SMB, WinRM, SSH, LDAP, and more.123MIT