MCP Recon
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| whois_infoB | Get comprehensive WHOIS information for a domain Example: whois_info("example.com") |
| domain_historyC | Check domain history and reputation indicators Example: domain_history("example.com") |
| dns_recordsA | Perform comprehensive DNS lookups for all record types Example: dns_records("example.com") |
| reverse_dnsA | Perform reverse DNS lookup on IP address Example: reverse_dns("8.8.8.8") |
| subdomain_enum_activeB | Enumerate subdomains using DNS brute force (active reconnaissance) Can use default wordlist from subdomains.txt file or custom wordlist provided Example: subdomain_enum_active("example.com") or subdomain_enum_active("example.com", ["www", "api", "admin"]) |
| subdomain_enum_passiveA | Passive subdomain enumeration using Certificate Transparency logs Non-intrusive reconnaissance that doesn't generate logs on target servers Example: subdomain_enum_passive("example.com") |
| ip_informationA | Get comprehensive IP information including geolocation Example: ip_information("example.com") or ip_information("1.1.1.1") |
| check_aliveA | Check if targets are alive using HTTP/HTTPS connectivity testing. Args: targets: List of target domains/URLs user_agent: Optional custom User-Agent string Example: check_alive(["example.com", "test.com"]) check_alive(["example.com"], "Mozilla/5.0... bug-bounty") |
| port_scanA | Advanced port scan using nmap Ports options: "common", "top100", "top1000", "80,443,8080", "1-1000" Example: port_scan("example.com", "top100") |
| tls_certificateC | Check TLS certificate details and security using Python SSL Example: tls_certificate("example.com") |
| http_headersB | Analyze HTTP headers for security and information disclosure. Args: url: Target URL to analyze user_agent: Optional custom User-Agent string Example: http_headers("https://example.com") http_headers("https://example.com", "Mozilla/5.0... bug-bounty") |
| detect_technologiesB | Detect technologies, frameworks, and libraries used by a website. Args: url: Target URL user_agent: Optional custom User-Agent string Example: detect_technologies("https://example.com") detect_technologies("https://example.com", "Mozilla/5.0... bug-bounty") |
| extract_urlsA | Extract all URLs from a website using Python web crawler. Args: url: Target URL depth: Crawl depth (default: 2) user_agent: Optional custom User-Agent string Example: extract_urls("https://example.com") extract_urls("https://example.com", 2, "Mozilla/5.0... bug-bounty") |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 13 tools
Each tool targets a distinct aspect of reconnaissance (WHOIS, DNS, subdomains, IP, ports, TLS, headers, tech detection, URL extraction), with clear descriptions preventing overlap. The active/passive subdomain tools are differentiated by method.
All tool names follow a consistent snake_case verb_noun pattern (e.g., whois_info, dns_records, port_scan, detect_technologies), with no mixing of conventions or vague verbs.
13 tools is well-scoped for a reconnaissance server, covering essential operations without being overwhelming. Each tool serves a clear purpose and earns its place.
The tool set covers all major reconnaissance areas (domain, DNS, subdomains, IP, network, TLS, HTTP, technology) with both active and passive methods. Minor gaps like email harvesting or web screenshot are not essential for a general-purpose recon server.