OWASP Pentest Guide Knowledge Base
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| NEO4J_URI | No | Neo4j connection URI (optional, used when NEO4J_ENABLED=true) | |
| NEO4J_USER | No | Neo4j user (optional) | |
| DATABASE_URL | Yes | PostgreSQL connection string, e.g. postgresql+psycopg://pentest_guide:pentest_guide@localhost:5432/pentest_guide_kb | |
| NEO4J_ENABLED | No | Enable Neo4j graph projection (optional) | false |
| NEO4J_PASSWORD | No | Neo4j password (optional) |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| guide_searchB | Search across OWASP testing guides (exact id, full-text, semantic, or hybrid). |
| guide_get_testA | Fetch one test case by versioned id, canonical id, alias, or slug. |
| guide_list_testsB | List test cases in a guide/version, optionally filtered by category. Cursor is the offset as a string. |
| guide_browse_categoryC | List every test case in one guide/version/category. |
| guide_get_related_testsC | Traverse curated relationships from a test case. include_inferred defaults to false: LLM-inferred edges are excluded unless explicitly requested. |
| guide_compare_versionsC | Compare a test case's title/objectives/sections/source across two compiled guide versions. |
| guide_find_by_featureB | Find test cases matching ANY of one or more feature keywords (OR semantics; e.g. oauth, webview, agent-tools). Each result lists which terms matched in |
| guide_recommend_candidatesA | Produce CANDIDATE tests for a target system profile. This is not a verified pentest plan and nothing in the output has been executed -- see the |
| guide_get_source_excerptB | Fetch a single section's raw text (or all sections) for a test case, with full provenance. |
| guide_validate_referenceA | Check whether a test id/version exists and whether a given content hash still matches the compiled registry -- use before trusting a previously-cached citation. |
| guide_explain_relationshipC | Explain one relationship edge: source test, target test, type, and full provenance (source_type, rationale, confidence, review_status). |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| research_security_topic | Research a security topic across the compiled OWASP guides. |
| compare_guides | Compare how two or more guides treat the same topic or feature. |
| build_candidate_test_matrix | Build a candidate test matrix for a target system profile. |
| explain_test_case | Explain one test case in full, with provenance. |
| trace_cross_guide_relationships | Trace relationships for a test case across guides, to a bounded depth. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| get_catalog_resource | |
| get_ontology_resource | |
| get_versions_resource |
TDQS
Scored across 11 tools
Each tool has a clearly distinct purpose: browsing categories, comparing versions, explaining relationships, finding by features, traversing relationships, fetching source excerpts, retrieving tests, listing tests, recommending candidates, searching, and validating references. No two tools have ambiguous boundaries.
All tool names follow a consistent 'guide_' prefix followed by a verb_noun pattern (e.g., browse_category, compare_versions, get_test). The naming is uniform and predictable, making it easy for agents to infer functionality.
With 11 tools, the set is well-scoped for a knowledge base of OWASP pentesting guides. Each tool addresses a specific access or exploration need without redundancy or excess, earning its place in the surface.
The tool set covers browsing, searching, retrieval, comparison, relationship exploration, and reference validation. A minor gap is the lack of a tool to list available guides/versions themselves, but the core query and navigation workflows are well-represented.