VulneraMCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| REDIS_HOST | No | Redis host for caching (optional) | localhost |
| REDIS_PORT | No | Redis port for caching (optional) | 6379 |
| POSTGRES_DB | Yes | PostgreSQL database name | bugbounty |
| ZAP_API_URL | No | OWASP ZAP API URL | http://localhost:8081 |
| POSTGRES_HOST | Yes | PostgreSQL database host | localhost |
| POSTGRES_PORT | Yes | PostgreSQL database port | 5433 |
| POSTGRES_USER | Yes | PostgreSQL database user | postgres |
| CAIDO_API_TOKEN | No | Caido API token for traffic analysis integration | |
| POSTGRES_PASSWORD | Yes | PostgreSQL database password |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| recon.subfinderC | Run subfinder to discover subdomains for a domain |
| recon.httpxC | Run httpx to check which hosts are live and get status codes |
| recon.amassC | Run amass for passive/active subdomain enumeration |
| recon.dnsB | Resolve DNS records for a domain or subdomain |
| recon.fullC | Run full reconnaissance workflow: subfinder -> httpx -> amass |
| js.downloadC | Download JavaScript file from URL |
| js.beautifyC | Beautify and format JavaScript source code |
| js.find_endpointsC | Extract API endpoints, URLs, and paths from JavaScript code |
| js.extract_secretsC | Heuristically extract potential API keys, tokens, and secrets from JS |
| js.analyzeA | Download, beautify, and analyze a JavaScript file - extract endpoints and secrets |
| security.test_xssC | Test for XSS vulnerabilities (non-destructive payloads) |
| security.test_sqliC | Test for SQL injection vulnerabilities |
| security.test_idorC | Test for IDOR (Insecure Direct Object Reference) vulnerabilities |
| security.test_cspC | Test Content Security Policy configuration |
| security.test_auth_bypassC | Test for authentication bypass vulnerabilities |
| security.test_csrfC | Test for CSRF vulnerabilities using advanced techniques |
| render.screenshotC | Take a screenshot of a webpage |
| render.extract_domC | Extract and return the DOM structure of a webpage |
| render.extract_formsB | Extract all forms from a webpage |
| render.execute_jsC | Execute JavaScript in the context of a webpage |
| db.save_findingC | Save a bug finding to the database |
| db.get_findingsC | Retrieve bug findings from the database |
| db.get_test_resultsB | Retrieve test results with success/failure and scores |
| db.get_statisticsC | Get statistics about test results |
| db.initA | Initialize database tables (run once on first setup) |
| training.importC | Import training data from HTB or PortSwigger labs |
| training.getC | Retrieve training data for learning patterns |
| training.matchC | Match current test against learned patterns |
| training.statsB | Get statistics about test results and training data |
| training.import_portswiggerC | Import training data from PortSwigger Academy lab solution |
| training.import_htbB | Import training data from HackTheBox challenge |
| training.import_allC | Import all pre-loaded training data from Intigriti, PortSwigger, and other sources |
| training.extract_from_writeupC | Extract training patterns from bug bounty writeup text |
| training.get_csrf_patternsC | Get all CSRF exploitation patterns from training data |
| zap.health_checkB | Check if ZAP is running and accessible |
| zap.start_spiderB | Start a spider (crawler) scan on a target URL |
| zap.get_spider_statusC | Get the status of a spider scan |
| zap.start_active_scanC | Start an active vulnerability scan on a target URL |
| zap.get_active_scan_statusC | Get the status of an active scan |
| zap.get_alertsB | Get all security alerts from ZAP |
| zap.get_alerts_summaryC | Get summary of alerts by risk level |
| zap.send_requestC | Send a custom HTTP request through ZAP proxy |
| zap.proxy_processC | Process a request through the MCP proxy layer (enhances with AI intelligence) |
| zap.get_sitesB | Get list of discovered sites from ZAP |
| zap.get_urlsB | Get list of discovered URLs from ZAP |
| zap.create_contextC | Create a scanning context in ZAP |
| zap.include_in_contextC | Include a URL pattern in a context |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 47 tools
The tools are well-organized into clear functional categories (db, js, recon, render, security, training, zap), which helps disambiguation significantly. However, within categories like 'training' there are multiple import tools (import, import_all, import_htb, import_portswigger) that could cause confusion about which to use for specific scenarios. The overall structure prevents major misselection issues.
Excellent naming consistency throughout. All tools follow a consistent 'category.action' pattern (e.g., 'db.get_findings', 'js.analyze', 'security.test_xss'). The verb_noun structure is maintained within each category, and there's no mixing of naming conventions. This predictability makes the tool set easy to navigate.
With 47 tools, this server feels overloaded for a single MCP server. While the domain (vulnerability assessment) is broad, the tool count creates cognitive overhead and suggests the server might be trying to do too much. A more focused approach with 15-25 tools would likely be more appropriate for agent usability.
The tool surface provides comprehensive coverage of the vulnerability assessment domain. It includes database operations, JavaScript analysis, reconnaissance, rendering, security testing, training data management, and ZAP integration. The tools support complete workflows from reconnaissance through testing to result analysis, with no obvious gaps in the core functionality.