list_payloads

Instructions

Implementation Reference

• src/sqli_mcp/server.py:353-397 (handler)

  The `list_payloads` tool handler registered as an MCP tool via @mcp.tool(). It accepts optional `category`, `database`, and `limit` parameters. It filters payloads by injection type, database type, or returns all payloads, then returns them with descriptions and category mappings.

  @mcp.tool()
  def list_payloads(
      category: Optional[str] = None,
      database: Optional[str] = None,
      limit: int = 20
  ) -> dict:
      """
      List available SQL injection payloads.
      
      Args:
          category: Filter by category (error_based, time_based, boolean_based, union_based, blind)
          database: Filter by database type (mysql, mssql, postgresql, oracle, sqlite, generic)
          limit: Maximum number of payloads to return
      
      Returns:
          List of available payloads with descriptions
      """
      if category:
          inj_type = InjectionType(category)
          payloads = get_payloads_by_type(inj_type)
      elif database:
          db_type = DatabaseType(database)
          payloads = get_payloads_by_database(db_type)
      else:
          payloads = get_all_payloads()
      
      # Apply database filter if both category and database specified
      if category and database:
          db_type = DatabaseType(database)
          payloads = [p for p in payloads if p.database_type == db_type or p.database_type == DatabaseType.GENERIC]
      
      return {
          "total_count": len(payloads),
          "showing": min(limit, len(payloads)),
          "categories": PAYLOAD_CATEGORIES,
          "payloads": [
              {
                  "value": p.value,
                  "type": p.injection_type.value,
                  "database": p.database_type.value,
                  "description": p.description
              }
              for p in payloads[:limit]
          ]
      }

• src/sqli_mcp/models.py:80-86 (schema)

  The `Payload` Pydantic model defines the schema for payload data: `value` (the SQL injection string), `injection_type` (InjectionType enum), `database_type` (DatabaseType enum), and `description` (optional). This is the data shape returned by list_payloads.

  class Payload(BaseModel):
      """SQL injection payload."""
      value: str = Field(..., description="The payload string")
      injection_type: InjectionType = Field(..., description="Type of injection")
      database_type: DatabaseType = Field(..., description="Target database type")
      description: Optional[str] = Field(default=None, description="Payload description")

• src/sqli_mcp/payloads/loader.py:25-33 (helper)

  The `get_all_payloads()` function aggregates all payloads from the five submodules (error_based, time_based, boolean_based, union_based, blind) into a single list. This is the main data source for `list_payloads`.

  def get_all_payloads() -> list[Payload]:
      """Get all built-in payloads."""
      return (
          ERROR_BASED_PAYLOADS +
          TIME_BASED_PAYLOADS +
          BOOLEAN_BASED_PAYLOADS +
          UNION_BASED_PAYLOADS +
          BLIND_PAYLOADS
      )

• src/sqli_mcp/payloads/loader.py:36-38 (helper)

  The `get_payloads_by_type()` helper filters payloads by injection type (e.g., error_based, time_based). Used by `list_payloads` when the `category` parameter is provided.

  def get_payloads_by_type(injection_type: InjectionType) -> list[Payload]:
      """Get payloads filtered by injection type."""
      return [p for p in get_all_payloads() if p.injection_type == injection_type]

• src/sqli_mcp/payloads/loader.py:41-47 (helper)

  The `get_payloads_by_database()` helper filters payloads by database type (e.g., mysql, mssql). Used by `list_payloads` when the `database` parameter is provided.

  def get_payloads_by_database(database_type: DatabaseType) -> list[Payload]:
      """Get payloads filtered by database type."""
      all_payloads = get_all_payloads()
      return [
          p for p in all_payloads 
          if p.database_type == database_type or p.database_type == DatabaseType.GENERIC
      ]