@cyanheads/pentest-mcp-server 0.1.3 → 0.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (42) hide show
  1. package/AGENTS.md +2 -2
  2. package/CLAUDE.md +2 -2
  3. package/Dockerfile +5 -0
  4. package/README.md +16 -4
  5. package/changelog/0.1.x/0.1.4.md +17 -0
  6. package/changelog/0.1.x/0.1.5.md +32 -0
  7. package/dist/data/waf-bypass/index.d.ts.map +1 -1
  8. package/dist/data/waf-bypass/index.js +146 -5
  9. package/dist/data/waf-bypass/index.js.map +1 -1
  10. package/dist/index.js +2 -0
  11. package/dist/index.js.map +1 -1
  12. package/dist/mcp-server/tools/definitions/pentest-analyze-response.tool.d.ts +1 -1
  13. package/dist/mcp-server/tools/definitions/pentest-analyze-response.tool.js +1 -1
  14. package/dist/mcp-server/tools/definitions/pentest-analyze-response.tool.js.map +1 -1
  15. package/dist/mcp-server/tools/definitions/pentest-encode.tool.d.ts +1 -1
  16. package/dist/mcp-server/tools/definitions/pentest-encode.tool.js +1 -1
  17. package/dist/mcp-server/tools/definitions/pentest-encode.tool.js.map +1 -1
  18. package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.d.ts +3 -0
  19. package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.d.ts.map +1 -1
  20. package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.js +12 -1
  21. package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.js.map +1 -1
  22. package/dist/mcp-server/tools/definitions/pentest-guide.tool.d.ts +1 -1
  23. package/dist/mcp-server/tools/definitions/pentest-guide.tool.js +1 -1
  24. package/dist/mcp-server/tools/definitions/pentest-guide.tool.js.map +1 -1
  25. package/dist/mcp-server/tools/definitions/pentest-lookup-group.tool.d.ts +31 -0
  26. package/dist/mcp-server/tools/definitions/pentest-lookup-group.tool.d.ts.map +1 -0
  27. package/dist/mcp-server/tools/definitions/pentest-lookup-group.tool.js +109 -0
  28. package/dist/mcp-server/tools/definitions/pentest-lookup-group.tool.js.map +1 -0
  29. package/dist/mcp-server/tools/definitions/pentest-map-techniques.tool.d.ts +1 -1
  30. package/dist/mcp-server/tools/definitions/pentest-map-techniques.tool.d.ts.map +1 -1
  31. package/dist/mcp-server/tools/definitions/pentest-map-techniques.tool.js +5 -1
  32. package/dist/mcp-server/tools/definitions/pentest-map-techniques.tool.js.map +1 -1
  33. package/dist/mcp-server/tools/index.d.ts +32 -5
  34. package/dist/mcp-server/tools/index.d.ts.map +1 -1
  35. package/dist/mcp-server/tools/index.js +3 -1
  36. package/dist/mcp-server/tools/index.js.map +1 -1
  37. package/dist/services/attack/attack-service.d.ts +29 -0
  38. package/dist/services/attack/attack-service.d.ts.map +1 -1
  39. package/dist/services/attack/attack-service.js +99 -0
  40. package/dist/services/attack/attack-service.js.map +1 -1
  41. package/package.json +6 -6
  42. package/server.json +3 -3
package/AGENTS.md CHANGED
@@ -1,8 +1,8 @@
1
1
  # Developer Protocol
2
2
 
3
3
  **Server:** pentest-mcp-server
4
- **Version:** 0.1.3
5
- **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.9.21`
4
+ **Version:** 0.1.5
5
+ **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.10.6`
6
6
  **Engines:** Bun ≥1.3.0, Node ≥24.0.0
7
7
  **MCP SDK:** `@modelcontextprotocol/sdk` ^1.29.0
8
8
  **Zod:** ^4.4.3
package/CLAUDE.md CHANGED
@@ -1,8 +1,8 @@
1
1
  # Developer Protocol
2
2
 
3
3
  **Server:** pentest-mcp-server
4
- **Version:** 0.1.3
5
- **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.9.21`
4
+ **Version:** 0.1.5
5
+ **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.10.6`
6
6
  **Engines:** Bun ≥1.3.0, Node ≥24.0.0
7
7
  **MCP SDK:** `@modelcontextprotocol/sdk` ^1.29.0
8
8
  **Zod:** ^4.4.3
package/Dockerfile CHANGED
@@ -40,10 +40,12 @@ WORKDIR /usr/src/app
40
40
  ENV NODE_ENV=production
41
41
 
42
42
  # OCI image metadata (https://github.com/opencontainers/image-spec/blob/main/annotations.md)
43
+ ARG APP_VERSION
43
44
  LABEL org.opencontainers.image.title="pentest-mcp-server"
44
45
  LABEL org.opencontainers.image.description="Offline methodology engine and payload workshop for authorized penetration testing, CTF, security research, and education."
45
46
  LABEL org.opencontainers.image.source="https://github.com/cyanheads/pentest-mcp-server"
46
47
  LABEL org.opencontainers.image.licenses="Apache-2.0"
48
+ LABEL org.opencontainers.image.version="${APP_VERSION}"
47
49
 
48
50
  # Copy dependency manifests
49
51
  COPY package.json bun.lock ./
@@ -98,5 +100,8 @@ ENV MCP_FORCE_CONSOLE_LOGGING="true"
98
100
  # Expose the port the server listens on
99
101
  EXPOSE ${MCP_HTTP_PORT}
100
102
 
103
+ # Health check using a bun-native fetch (slim image ships no curl/wget)
104
+ HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD bun -e "fetch('http://localhost:'+(process.env.MCP_HTTP_PORT??'3010')+'/healthz').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
105
+
101
106
  # The command to start the server
102
107
  CMD ["bun", "run", "dist/index.js"]
package/README.md CHANGED
@@ -1,13 +1,13 @@
1
1
  <div align="center">
2
2
  <h1>@cyanheads/pentest-mcp-server</h1>
3
3
  <p><b>Offline methodology engine and payload workshop for authorized penetration testing, CTF, security research, and education via MCP. STDIO or Streamable HTTP.</b>
4
- <div>6 Tools</div>
4
+ <div>7 Tools</div>
5
5
  </p>
6
6
  </div>
7
7
 
8
8
  <div align="center">
9
9
 
10
- [![Version](https://img.shields.io/badge/Version-0.1.3-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![Docker](https://img.shields.io/badge/Docker-ghcr.io-2496ED?style=flat-square&logo=docker&logoColor=white)](https://github.com/users/cyanheads/packages/container/package/pentest-mcp-server) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^1.29.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![npm](https://img.shields.io/npm/v/@cyanheads/pentest-mcp-server?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/@cyanheads/pentest-mcp-server) [![TypeScript](https://img.shields.io/badge/TypeScript-^5.9.3-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.3.0-blueviolet.svg?style=flat-square)](https://bun.sh/)
10
+ [![Version](https://img.shields.io/badge/Version-0.1.5-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![Docker](https://img.shields.io/badge/Docker-ghcr.io-2496ED?style=flat-square&logo=docker&logoColor=white)](https://github.com/users/cyanheads/packages/container/package/pentest-mcp-server) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^1.29.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![npm](https://img.shields.io/npm/v/@cyanheads/pentest-mcp-server?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/@cyanheads/pentest-mcp-server) [![TypeScript](https://img.shields.io/badge/TypeScript-^6.0.3-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.3.0-blueviolet.svg?style=flat-square)](https://bun.sh/)
11
11
 
12
12
  </div>
13
13
 
@@ -35,13 +35,14 @@
35
35
 
36
36
  ## Tools
37
37
 
38
- Six tools spanning the full authorized-testing workflow — from initial scoping through response analysis and payload generation:
38
+ Seven tools spanning the full authorized-testing workflow — from initial scoping through response analysis and payload generation:
39
39
 
40
40
  | Tool | Description |
41
41
  |:-----|:------------|
42
42
  | `pentest_guide` | Returns a step-by-step methodology playbook for the given attack vector, scoped to authorized testing. Each phase covers what to look for, tools, detection indicators for defenders, and mitigations. |
43
43
  | `pentest_analyze_response` | Analyzes a raw server response (headers + body) from authorized probing for information leakage, fingerprinting signals, and exploitation opportunities — each finding paired with remediation. |
44
44
  | `pentest_lookup_technique` | Looks up a MITRE ATT&CK technique by ID or keyword. Returns description, tactics, detection data sources, behavioral indicators, mitigations, and real-world procedure examples. |
45
+ | `pentest_lookup_group` | Looks up a MITRE ATT&CK threat group or software entry by ID or name. Returns aliases, type (group vs. software), description, and the techniques it uses with procedure context. |
45
46
  | `pentest_map_techniques` | Given a target profile (stack, services, auth type, OS), returns ranked ATT&CK techniques and OWASP test cases most relevant to that authorized engagement. |
46
47
  | `pentest_generate_payloads` | Generates annotated payload templates for authorized testing. Each template includes why it works in the injection context, detection signatures, and mitigations. |
47
48
  | `pentest_encode` | Applies an encoding chain to a payload string (URL, double-URL, HTML entity, Unicode, hex, Base64, and more). Returns step-by-step decode explanation and bypass rationale. |
@@ -85,6 +86,17 @@ Single-record ATT&CK lookup. Accepts exact IDs (`T1190`, `T1059.001`) or keyword
85
86
 
86
87
  ---
87
88
 
89
+ ### `pentest_lookup_group`
90
+
91
+ ATT&CK threat group and software lookup. Accepts exact IDs (`G0007`, `S0002`) or name/keyword search (`APT28`, `Mimikatz`).
92
+
93
+ - Covers both intrusion sets (threat groups, G-prefix) and software entries (malware and tools, S-prefix)
94
+ - Returns: name, type (`group` or `software`), aliases, description, and up to 20 techniques used with procedure-level context
95
+ - Technique entries link directly to `pentest_lookup_technique` for full detection and mitigation context
96
+ - Equally useful for defenders building detection coverage around specific adversary tradecraft
97
+
98
+ ---
99
+
88
100
  ### `pentest_map_techniques`
89
101
 
90
102
  Discovery and ranking tool. Takes a target profile, returns prioritized testing scope.
@@ -103,7 +115,7 @@ Context-aware payload template generator for authorized testing. Returns annotat
103
115
 
104
116
  - Fourteen payload categories: `xss`, `sqli`, `ssrf`, `xxe`, `path_traversal`, `ssti`, `command_injection`, `open_redirect`, `csrf`, `deserialization`, `jwt`, `ldap_injection`, `nosql_injection`, `http_header`
105
117
  - Sixteen injection contexts for precision targeting: `html_attribute`, `html_body`, `js_string`, `js_template`, `js_script_block`, `url_parameter`, `url_path`, `sql_where`, `sql_integer`, `xml_element`, `xml_attribute`, `http_header`, `json_value`, `cookie_value`, `file_name`, `generic`
106
- - WAF profile variants: `cloudflare`, `aws_waf`, `modsecurity_crs`, `imperva`, `akamai`, `none`, `unknown` — bypass variants reference public research per WAF product
118
+ - WAF profile variants: `cloudflare`, `aws_waf`, `modsecurity_crs`, `imperva`, `akamai`, `f5_bigip_asm`, `nginx_modsecurity`, `fortinet_fortiwaf`, `none`, `unknown` — bypass variants reference public research per WAF product
107
119
  - Optional encoding chain applied at generation time; up to 20 variants per request
108
120
  - Each template annotated with: vulnerability class, detection signature, mitigation, and WAF bypass notes
109
121
  - `authorized_use_reminder` rendered as the first line of every response
package/changelog/0.1.x/0.1.4.md ADDED
@@ -0,0 +1,17 @@
1
+ ---
2
+ summary: "pentest_lookup_group (ATT&CK threat group/software lookup) + expanded WAF bypass dataset (10 → 34 entries, 3 new WAF products)"
3
+ breaking: false
4
+ security: false
5
+ ---
6
+
7
+ # 0.1.4 — 2026-06-04
8
+
9
+ ## Added
10
+
11
+ - **`pentest_lookup_group`** — new tool for MITRE ATT&CK threat group and software lookup ([#3](https://github.com/cyanheads/pentest-mcp-server/issues/3)). Accepts exact G/S-prefix IDs or name/keyword search; returns name, type (`group` vs. `software`), aliases, description, and up to 20 technique-use entries with procedure context. `authorized_use_reminder` in every response; `no_match` error contract.
12
+ - **`AttackGroup` index** in `attack-service.ts` — parallel `groupById`/`groupKeywordIndex` maps built at startup from `intrusion-set`, `malware`, and `tool` STIX objects; `lookupGroupById()` and `searchGroups()` methods; alias fields read correctly per STIX type (`aliases` for intrusion-sets, `x_mitre_aliases` for malware/tool).
13
+
14
+ ## Changed
15
+
16
+ - **WAF bypass dataset** expanded from 10 to 34 entries ([#4](https://github.com/cyanheads/pentest-mcp-server/issues/4)). New coverage: Cloudflare (`path_traversal`, `cmd_injection`, `xxe`, `open_redirect`), AWS WAF (`ssrf`, `path_traversal`, `cmd_injection`), ModSecurity CRS (`ssrf`, `cmd_injection`, `xxe`), Imperva (`sqli`, `ssrf`, `path_traversal`), Akamai (`sqli`, `ssrf`, `path_traversal`), F5 BIG-IP ASM (`xss`, `sqli`, `ssrf`), Nginx ModSecurity (`xss`, `sqli`), Fortinet FortiWAF (`xss`, `sqli`). All entries cite publicly available references.
17
+ - **`pentest_generate_payloads` `waf_profile` enum** extended with `f5_bigip_asm`, `nginx_modsecurity`, `fortinet_fortiwaf` to surface the new bypass entries.
package/changelog/0.1.x/0.1.5.md ADDED
@@ -0,0 +1,32 @@
1
+ ---
2
+ summary: "Adopt @cyanheads/mcp-ts-core 0.10.6 — explicit createApp identity, ValidationError error codes, ctx.enrich.truncated overflow signal; MCPB bundle node_modules agent-doc strip; Docker HEALTHCHECK + version label"
3
+ breaking: false
4
+ security: false
5
+ ---
6
+
7
+ # 0.1.5 — 2026-06-12
8
+
9
+ ## Added
10
+
11
+ - **`createApp({ name, title })`** — both set to `pentest-mcp-server`, pinning the served identity to the machine name instead of falling back to the scoped npm package name.
12
+ - **`ctx.enrich.truncated({ shown, cap })`** in `pentest_map_techniques` — emits an overflow enrichment when the matched-technique count exceeds `limit`, so clients know the ranked list was capped.
13
+ - **`scripts/clean-mcpb.ts`** — post-`mcpb pack` cleaner wired into the `bundle` script. Runs `mcpb clean` (dev-dependency prune), then strips `node_modules/**` agent-doc entries (`skills/`, `.claude/`, `.agents/`, `SKILL.md`) that root-anchored `.mcpbignore` patterns cannot reach, and asserts zero remain.
14
+ - **`Dockerfile` `HEALTHCHECK`** — bun-native `fetch` against `/healthz` (slim image ships no curl/wget). Added `APP_VERSION` build arg and `org.opencontainers.image.version` OCI label.
15
+
16
+ ## Changed
17
+
18
+ - **`@cyanheads/mcp-ts-core`** `^0.9.21 → ^0.10.6`.
19
+ - **Error codes** — `pentest_analyze_response` (`no_input`), `pentest_encode` (`encoding_error`), `pentest_guide` (`unknown_vector`), and `pentest_map_techniques` (`no_profile`) now use `JsonRpcErrorCode.ValidationError` instead of the removed `InvalidParams`.
20
+ - **`.mcpbignore`** — anchored the dev-directory patterns (`/.claude/`, `/.agents/`, `/skills/`) so they only match at bundle root and no longer strip runtime paths nested under `node_modules`.
21
+ - **`scripts/lint-packaging.ts`** (vendored) — adds bundle-content guards (dev-dir exclusion, unanchored-pattern detection, critical-runtime-path protection, post-bundle `node_modules` agent-doc scan) and a `name`/`title`/`display_name` identity check against the unscoped package name.
22
+ - **`scripts/check-framework-antipatterns.ts`** (vendored) — adds a `z.coerce.boolean()` env-flag rule (`Boolean("false")` is `true`; use `z.stringbool()`) and skips comment lines so rule mentions in docs don't false-positive.
23
+ - **Vitest** `hookTimeout` raised to 30s for the unit project — ATT&CK enterprise JSON init (~6s) exceeds the default 10s.
24
+ - **Vendored skills** re-synced to mcp-ts-core 0.10.6; added the `techniques` skill (cross-cutting response/retrieval patterns, e.g. outline-on-overflow).
25
+
26
+ ### Dependency bumps
27
+
28
+ - `@biomejs/biome` `^2.4.16 → ^2.5.0`
29
+ - `@types/node` `^25.9.1 → ^25.9.3`
30
+ - `tsc-alias` `^1.8.16 → ^1.8.17`
31
+ - `typescript` `^5.9.3 → ^6.0.3`
32
+ - `vitest` `^4.1.0 → ^4.1.8`
package/dist/data/waf-bypass/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/data/waf-bypass/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wDAAwD;AACxD,eAAO,MAAM,cAAc,EAAE,aAAa,EA6EzC,CAAC;AAEF,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAIzF"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/data/waf-bypass/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wDAAwD;AACxD,eAAO,MAAM,cAAc,EAAE,aAAa,EA6PzC,CAAC;AAEF,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAIzF"}
package/dist/data/waf-bypass/index.js CHANGED
@@ -4,7 +4,7 @@
4
4
  */
5
5
  /** Known WAF bypass techniques from public research. */
6
6
  export const wafBypassNotes = [
7
- // Cloudflare
7
+ // ── Cloudflare ────────────────────────────────────────────────────────────────
8
8
  {
9
9
  waf: 'cloudflare',
10
10
  category: 'xss',
@@ -23,7 +23,31 @@ export const wafBypassNotes = [
23
23
  technique: 'IPv6 representation of loopback (::1, ::ffff:127.0.0.1), decimal IP notation (2130706433 = 127.0.0.1), octal notation (0177.0.0.1). DNS rebinding via services like singularity or similar.',
24
24
  reference: 'Public SSRF bypass research — hackerone disclosures, portswigger web security academy',
25
25
  },
26
- // AWS WAF
26
+ {
27
+ waf: 'cloudflare',
28
+ category: 'path_traversal',
29
+ technique: 'URL-encoded dot-dot-slash variants (%2e%2e%2f, %2e%2e/, ..%2f) can bypass path-normalization checks if the WAF decodes before matching. Double URL-encoding (%252e%252e%252f) exploits single-decode WAF rules. Null bytes (%00) may truncate path matching on some backends.',
30
+ reference: 'PortSwigger Web Security — path traversal labs; OWASP Testing Guide OTG-AUTHZ-001',
31
+ },
32
+ {
33
+ waf: 'cloudflare',
34
+ category: 'cmd_injection',
35
+ technique: "Bash brace expansion ({ls,/etc/passwd}), IFS substitution (${IFS}), and $() command substitution may evade keyword-based filters. Hex-encoded command strings passed through $'\\x6c\\x73' bypass literal pattern matching.",
36
+ reference: 'Public command injection bypass research — HackerOne disclosed reports',
37
+ },
38
+ {
39
+ waf: 'cloudflare',
40
+ category: 'xxe',
41
+ technique: 'External entity declarations split across CDATA or parameter entities can bypass inline rule matching. Encoding the DOCTYPE declaration via UTF-16 or BOM-prefixed UTF-8 may shift pattern offsets past WAF rules.',
42
+ reference: 'PortSwigger Web Security — XXE injection; OWASP XXE cheat sheet',
43
+ },
44
+ {
45
+ waf: 'cloudflare',
46
+ category: 'open_redirect',
47
+ technique: 'Protocol-relative URLs (//evil.com) and URL fragments (#redirect) may bypass destination allow-listing when the WAF only inspects the path component. Double-slash and backslash variants (\\\\evil.com) exploit browser normalization differences.',
48
+ reference: 'OWASP Unvalidated Redirects and Forwards cheat sheet; public HackerOne disclosures',
49
+ },
50
+ // ── AWS WAF ───────────────────────────────────────────────────────────────────
27
51
  {
28
52
  waf: 'aws_waf',
29
53
  category: 'xss',
@@ -36,7 +60,25 @@ export const wafBypassNotes = [
36
60
  technique: 'AWS WAF SQL injection rules focus on common SQL keywords. Encoding individual characters in SQL keywords, or using database-specific syntax variations, can reduce detection rate. Test with both URL-encoding and hex-encoding.',
37
61
  reference: 'AWS WAF SQL injection protection documentation',
38
62
  },
39
- // ModSecurity CRS
63
+ {
64
+ waf: 'aws_waf',
65
+ category: 'ssrf',
66
+ technique: 'AWS WAF does not natively block SSRF payloads — blocking relies on custom rules or application-layer controls. IPv6-mapped IPv4 addresses (::ffff:169.254.169.254) and decimal IP representation bypass simple string matching on the metadata endpoint address.',
67
+ reference: 'AWS Security Blog — protecting SSRF with WAF; HackerOne cloud SSRF disclosures',
68
+ },
69
+ {
70
+ waf: 'aws_waf',
71
+ category: 'path_traversal',
72
+ technique: 'AWS Managed Rules path traversal detection is limited; crafted paths using %c0%ae (overlong UTF-8 for ".") or Windows UNC-style paths (\\\\..\\\\) may not be normalized before matching. Custom rate-based rules are the primary defense layer.',
73
+ reference: 'AWS WAF managed rule group documentation; OWASP path traversal guide',
74
+ },
75
+ {
76
+ waf: 'aws_waf',
77
+ category: 'cmd_injection',
78
+ technique: 'AWS WAF regex-based rules for command injection check common shell metacharacters. Obfuscation via environment variable indirection ($SHELL), string concatenation (c"at"), and here-string constructs (<<<) may evade static pattern matching.',
79
+ reference: 'AWS WAF custom rule documentation; public AWS WAF bypass research',
80
+ },
81
+ // ── ModSecurity CRS ───────────────────────────────────────────────────────────
40
82
  {
41
83
  waf: 'modsecurity_crs',
42
84
  category: 'xss',
@@ -55,20 +97,119 @@ export const wafBypassNotes = [
55
97
  technique: 'CRS detects ../ patterns. URL normalization bypass: use path segments that normalize to traversal after server-side URL decode (e.g., %2e%2e%2f). Request path vs. query parameter parsing differences.',
56
98
  reference: 'CRS path traversal rules — coreruleset.org',
57
99
  },
58
- // Imperva
100
+ {
101
+ waf: 'modsecurity_crs',
102
+ category: 'ssrf',
103
+ technique: 'CRS does not include dedicated SSRF rules by default (SSRF is application-logic-dependent). When custom SSRF rules rely on block-list matching, IPv6 loopback variants (::1) and decimal IP notation bypass string-literal checks. Parameter pollution can distribute the URL across multiple values.',
104
+ reference: 'CRS GitHub — SSRF rule discussion; OWASP SSRF prevention cheat sheet',
105
+ },
106
+ {
107
+ waf: 'modsecurity_crs',
108
+ category: 'cmd_injection',
109
+ technique: 'CRS rule 932100–932180 covers OS command injection. Bypass techniques include using $() vs backtick substitution, inserting whitespace via $IFS, and splitting commands with shell arithmetic ((( ))). Anomaly threshold tuning (paranoia level < 3) may leave rule gaps.',
110
+ reference: 'CRS rule documentation — coreruleset.org/docs; GitHub rule source',
111
+ },
112
+ {
113
+ waf: 'modsecurity_crs',
114
+ category: 'xxe',
115
+ technique: 'CRS rules check for DOCTYPE and ENTITY declarations in XML bodies. Bypasses include placing declarations inside CDATA sections, using alternate XML serializations, or splitting the payload across chunked transfer encoding segments.',
116
+ reference: 'CRS XXE rules — coreruleset.org; PortSwigger XXE research',
117
+ },
118
+ // ── Imperva ───────────────────────────────────────────────────────────────────
59
119
  {
60
120
  waf: 'imperva',
61
121
  category: 'xss',
62
122
  technique: 'Imperva protects heavily against reflected XSS. DOM-based XSS sources that do not appear in server responses are often bypassed since WAF inspection is request/response-based. JSON response context XSS.',
63
123
  reference: 'Public Imperva bypass research — security researcher writeups',
64
124
  },
65
- // Akamai
125
+ {
126
+ waf: 'imperva',
127
+ category: 'sqli',
128
+ technique: 'Imperva applies behavioral analysis in addition to signature matching. Bypass attempts include using less-common SQL functions (ELT(), FIELD(), MAKE_SET()), chained comments to split keywords, and time-based blind injection via SLEEP() alternatives (BENCHMARK()). Rotating between different quoting styles may slow correlation.',
129
+ reference: 'Public Imperva SQLi bypass research; PortSwigger SQL injection cheat sheet',
130
+ },
131
+ {
132
+ waf: 'imperva',
133
+ category: 'ssrf',
134
+ technique: 'Imperva WAF SSRF rules depend on configuration. Bypasses leveraging DNS rebinding, redirect chains through open-redirect vulnerabilities, and cloud-metadata IP variants (169.254.169.254 via decimal, octal, or IPv6 forms) are commonly explored in disclosed reports.',
135
+ reference: 'HackerOne disclosed SSRF reports; Orange Tsai SSRF research',
136
+ },
137
+ {
138
+ waf: 'imperva',
139
+ category: 'path_traversal',
140
+ technique: 'Imperva normalizes many URL-encoded traversal patterns. Overlong UTF-8 encodings (%c0%ae for ".") and unicode normalization variants (U+FF0E fullwidth period) may shift pattern matching. Mixing forward and back slashes can exploit OS-level path normalization differences.',
141
+ reference: 'OWASP path traversal testing guide; public Imperva bypass research',
142
+ },
143
+ // ── Akamai ────────────────────────────────────────────────────────────────────
66
144
  {
67
145
  waf: 'akamai',
68
146
  category: 'xss',
69
147
  technique: 'Akamai Kona WAF performs deep inspection. Polyglot payloads combining multiple contexts may evade single-vector detection. HTTP/2-specific headers and pseudo-headers may be inconsistently inspected.',
70
148
  reference: 'Public Akamai WAF bypass research',
71
149
  },
150
+ {
151
+ waf: 'akamai',
152
+ category: 'sqli',
153
+ technique: 'Akamai Kona rules cover standard SQL injection patterns. Bypass research focuses on Unicode whitespace characters (U+00A0, U+2009) as keyword separators, non-standard comment sequences (--+, #), and database-specific functions not covered by generic rule sets.',
154
+ reference: 'Public Akamai Kona bypass research; SQL injection filter evasion — OWASP',
155
+ },
156
+ {
157
+ waf: 'akamai',
158
+ category: 'ssrf',
159
+ technique: 'Akamai edge rules for SSRF are configuration-dependent. IPv6-encoded metadata addresses, URL-encoded host components, and redirect chains through trusted third-party domains are commonly tested bypass vectors in bug bounty disclosures.',
160
+ reference: 'HackerOne disclosed Akamai-protected target SSRF reports',
161
+ },
162
+ {
163
+ waf: 'akamai',
164
+ category: 'path_traversal',
165
+ technique: 'Akamai normalizes standard ../ sequences; bypass attempts use URL-encoded variants (%2e%2e%2f), double-encoded forms (%252e%252e%252f), and Unicode dot equivalents. Request smuggling techniques may shift path parsing between Akamai and the origin.',
166
+ reference: 'PortSwigger path traversal labs; public Akamai bypass writeups',
167
+ },
168
+ // ── F5 BIG-IP ASM ─────────────────────────────────────────────────────────────
169
+ {
170
+ waf: 'f5_bigip_asm',
171
+ category: 'xss',
172
+ technique: 'F5 BIG-IP ASM signature-based XSS detection can be bypassed by mutating event handler names with HTML entity encoding inside attribute values (on&#99;lick=), inserting tab characters between event handler name and "=", and leveraging SVG animate elements with href attributes that are less commonly inspected.',
173
+ reference: 'F5 BIG-IP ASM documentation; public ASM bypass research — security conferences (DEF CON, Black Hat)',
174
+ },
175
+ {
176
+ waf: 'f5_bigip_asm',
177
+ category: 'sqli',
178
+ technique: 'BIG-IP ASM SQL injection signatures cover standard patterns. Bypass research focuses on: using MySQL-specific syntax variations not in the signature set (GROUP_CONCAT, JSON_EXTRACT), using versioned comment syntax (/*!50000 SELECT*/), and exploiting the ASM learning mode where certain parameter types are initially unblocked.',
179
+ reference: 'F5 BIG-IP ASM policy configuration guide; public SQL injection WAF bypass research',
180
+ },
181
+ {
182
+ waf: 'f5_bigip_asm',
183
+ category: 'ssrf',
184
+ technique: 'F5 BIG-IP ASM does not include native SSRF blocking; protection depends on custom signatures or iRules. Attackers probe for gaps using localhost aliases, IPv6 loopback, and DNS rebinding. Internal IP ranges accessed via URL parameters are often not covered by default policy.',
185
+ reference: 'F5 BIG-IP ASM custom signatures documentation; OWASP SSRF prevention cheat sheet',
186
+ },
187
+ // ── Nginx ModSecurity ─────────────────────────────────────────────────────────
188
+ {
189
+ waf: 'nginx_modsecurity',
190
+ category: 'xss',
191
+ technique: 'Nginx ModSecurity typically runs the OWASP CRS. Bypass techniques mirror CRS gaps: anomaly score manipulation, using non-standard HTML event handlers (onpointerrawupdate, onformdata) not yet in the CRS rule set, and multipart body encoding to alter parsing context.',
192
+ reference: 'OWASP CRS — coreruleset.org; Nginx ModSecurity integration documentation; public CRS bypass research',
193
+ },
194
+ {
195
+ waf: 'nginx_modsecurity',
196
+ category: 'sqli',
197
+ technique: 'Running atop CRS, Nginx ModSecurity SQL injection coverage depends on paranoia level. At PL1-2, less-common SQL constructs go undetected. Character encoding tricks (URL-encoding single quotes, hex literals), MySQL-specific CONCAT(0x3a,0x3a) patterns, and chained comment splitting can reduce detection at lower paranoia levels.',
198
+ reference: 'CRS paranoia level documentation — coreruleset.org; OWASP SQL injection cheat sheet',
199
+ },
200
+ // ── Fortinet FortiWAF ─────────────────────────────────────────────────────────
201
+ {
202
+ waf: 'fortinet_fortiwaf',
203
+ category: 'xss',
204
+ technique: 'FortiWAF signature-based XSS detection is evadable via tag variations not in the active signature set (<details open ontoggle=>, <marquee onstart=>), Punycode-encoded domain names in href attributes, and payloads embedded inside JSON or XML response contexts processed client-side.',
205
+ reference: 'FortiWAF documentation; public WAF bypass research — bug bounty disclosures and conference presentations',
206
+ },
207
+ {
208
+ waf: 'fortinet_fortiwaf',
209
+ category: 'sqli',
210
+ technique: 'FortiWAF SQL injection rules cover common patterns. Bypass research focuses on database-specific syntax that diverges from generic rule sets: PostgreSQL dollar-quoting ($$payload$$), MSSQL stacked queries separated by semicolons, and using CHAR() or NCHAR() string construction to reconstruct blocked keywords at the database layer.',
211
+ reference: 'FortiWAF technical documentation; public SQL injection WAF evasion research — OWASP and conference papers',
212
+ },
72
213
  ];
73
214
  /** Get WAF bypass notes for a specific WAF and category. */
74
215
  export function getWafBypassNote(waf, category) {
package/dist/data/waf-bypass/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/data/waf-bypass/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,wDAAwD;AACxD,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,aAAa;IACb;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,8LAA8L;QAChM,SAAS,EAAE,mEAAmE;KAC/E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,iMAAiM;QACnM,SAAS,EAAE,gEAAgE;KAC5E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,6LAA6L;QAC/L,SAAS,EACP,uFAAuF;KAC1F;IACD,UAAU;IACV;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,6LAA6L;QAC/L,SAAS,EAAE,4EAA4E;KACxF;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,kOAAkO;QACpO,SAAS,EAAE,gDAAgD;KAC5D;IACD,kBAAkB;IAClB;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,6OAA6O;QAC/O,SAAS,EAAE,gEAAgE;KAC5E;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,2MAA2M;QAC7M,SAAS,EAAE,2DAA2D;KACvE;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,yMAAyM;QAC3M,SAAS,EAAE,4CAA4C;KACxD;IACD,UAAU;IACV;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,4MAA4M;QAC9M,SAAS,EAAE,+DAA+D;KAC3E;IACD,SAAS;IACT;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,wMAAwM;QAC1M,SAAS,EAAE,mCAAmC;KAC/C;CACF,CAAC;AAEF,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,QAAgB;IAC5D,OAAO,cAAc,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,WAAW,EAAE,CAC5E,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/data/waf-bypass/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,wDAAwD;AACxD,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,iFAAiF;IACjF;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,8LAA8L;QAChM,SAAS,EAAE,mEAAmE;KAC/E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,iMAAiM;QACnM,SAAS,EAAE,gEAAgE;KAC5E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,6LAA6L;QAC/L,SAAS,EACP,uFAAuF;KAC1F;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,+QAA+Q;QACjR,SAAS,EAAE,mFAAmF;KAC/F;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,eAAe;QACzB,SAAS,EACP,6NAA6N;QAC/N,SAAS,EAAE,wEAAwE;KACpF;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,oNAAoN;QACtN,SAAS,EAAE,iEAAiE;KAC7E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,eAAe;QACzB,SAAS,EACP,qPAAqP;QACvP,SAAS,EAAE,oFAAoF;KAChG;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,6LAA6L;QAC/L,SAAS,EAAE,4EAA4E;KACxF;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,kOAAkO;QACpO,SAAS,EAAE,gDAAgD;KAC5D;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,kQAAkQ;QACpQ,SAAS,EAAE,gFAAgF;KAC5F;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,kPAAkP;QACpP,SAAS,EAAE,sEAAsE;KAClF;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,eAAe;QACzB,SAAS,EACP,iPAAiP;QACnP,SAAS,EAAE,mEAAmE;KAC/E;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,6OAA6O;QAC/O,SAAS,EAAE,gEAAgE;KAC5E;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,2MAA2M;QAC7M,SAAS,EAAE,2DAA2D;KACvE;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,yMAAyM;QAC3M,SAAS,EAAE,4CAA4C;KACxD;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,uSAAuS;QACzS,SAAS,EAAE,sEAAsE;KAClF;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,eAAe;QACzB,SAAS,EACP,2QAA2Q;QAC7Q,SAAS,EAAE,mEAAmE;KAC/E;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,yOAAyO;QAC3O,SAAS,EAAE,2DAA2D;KACvE;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,4MAA4M;QAC9M,SAAS,EAAE,+DAA+D;KAC3E;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,yUAAyU;QAC3U,SAAS,EAAE,4EAA4E;KACxF;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,0QAA0Q;QAC5Q,SAAS,EAAE,6DAA6D;KACzE;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,iRAAiR;QACnR,SAAS,EAAE,oEAAoE;KAChF;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,wMAAwM;QAC1M,SAAS,EAAE,mCAAmC;KAC/C;IACD;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,sQAAsQ;QACxQ,SAAS,EAAE,0EAA0E;KACtF;IACD;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,6OAA6O;QAC/O,SAAS,EAAE,0DAA0D;KACtE;IACD;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,yPAAyP;QAC3P,SAAS,EAAE,gEAAgE;KAC5E;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,uTAAuT;QACzT,SAAS,EACP,qGAAqG;KACxG;IACD;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,wUAAwU;QAC1U,SAAS,EAAE,oFAAoF;KAChG;IACD;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,qRAAqR;QACvR,SAAS,EAAE,kFAAkF;KAC9F;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,2QAA2Q;QAC7Q,SAAS,EACP,sGAAsG;KACzG;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,yUAAyU;QAC3U,SAAS,EACP,qFAAqF;KACxF;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,2RAA2R;QAC7R,SAAS,EACP,0GAA0G;KAC7G;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,8UAA8U;QAChV,SAAS,EACP,2GAA2G;KAC9G;CACF,CAAC;AAEF,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,QAAgB;IAC5D,OAAO,cAAc,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,WAAW,EAAE,CAC5E,CAAC;AACJ,CAAC"}
package/dist/index.js CHANGED
@@ -11,6 +11,8 @@ import { initMethodologyService } from './services/methodology/methodology-servi
11
11
  import { initPayloadService } from './services/payload/payload-service.js';
12
12
  import { initResponseAnalysisService } from './services/response-analysis/response-analysis-service.js';
13
13
  await createApp({
14
+ name: 'pentest-mcp-server',
15
+ title: 'pentest-mcp-server',
14
16
  tools: allToolDefinitions,
15
17
  resources: [],
16
18
  prompts: [],
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,2BAA2B,EAAE,MAAM,2DAA2D,CAAC;AAExG,MAAM,SAAS,CAAC;IACd,KAAK,EAAE,kBAAkB;IACzB,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,EAAE;IACX,YAAY,EACV,uGAAuG;QACvG,kGAAkG;QAClG,+EAA+E;QAC/E,qHAAqH;IACvH,KAAK;QACH,iBAAiB,EAAE,CAAC;QACpB,sBAAsB,EAAE,CAAC;QACzB,kBAAkB,EAAE,CAAC;QACrB,mBAAmB,EAAE,CAAC;QACtB,2BAA2B,EAAE,CAAC;IAChC,CAAC;CACF,CAAC,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,2BAA2B,EAAE,MAAM,2DAA2D,CAAC;AAExG,MAAM,SAAS,CAAC;IACd,IAAI,EAAE,oBAAoB;IAC1B,KAAK,EAAE,oBAAoB;IAC3B,KAAK,EAAE,kBAAkB;IACzB,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,EAAE;IACX,YAAY,EACV,uGAAuG;QACvG,kGAAkG;QAClG,+EAA+E;QAC/E,qHAAqH;IACvH,KAAK;QACH,iBAAiB,EAAE,CAAC;QACpB,sBAAsB,EAAE,CAAC;QACzB,kBAAkB,EAAE,CAAC;QACrB,mBAAmB,EAAE,CAAC;QACtB,2BAA2B,EAAE,CAAC;IAChC,CAAC;CACF,CAAC,CAAC"}
package/dist/mcp-server/tools/definitions/pentest-analyze-response.tool.d.ts CHANGED
@@ -52,7 +52,7 @@ export declare const pentestAnalyzeResponseTool: import("@cyanheads/mcp-ts-core"
52
52
  }, z.core.$strip>>;
53
53
  }, z.core.$strip>, readonly [{
54
54
  readonly reason: "no_input";
55
- readonly code: JsonRpcErrorCode.InvalidParams;
55
+ readonly code: JsonRpcErrorCode.ValidationError;
56
56
  readonly when: "Neither response_headers nor response_body was provided.";
57
57
  readonly recovery: "Provide at least one of response_headers or response_body to analyze.";
58
58
  }], undefined>;
package/dist/mcp-server/tools/definitions/pentest-analyze-response.tool.js CHANGED
@@ -116,7 +116,7 @@ export const pentestAnalyzeResponseTool = tool('pentest_analyze_response', {
116
116
  errors: [
117
117
  {
118
118
  reason: 'no_input',
119
- code: JsonRpcErrorCode.InvalidParams,
119
+ code: JsonRpcErrorCode.ValidationError,
120
120
  when: 'Neither response_headers nor response_body was provided.',
121
121
  recovery: 'Provide at least one of response_headers or response_body to analyze.',
122
122
  },
package/dist/mcp-server/tools/definitions/pentest-analyze-response.tool.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"pentest-analyze-response.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-analyze-response.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAEvG,MAAM,uBAAuB,GAC3B,oMAAoM,CAAC;AAEvM,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC,0BAA0B,EAAE;IACzE,KAAK,EAAE,0BAA0B;IACjC,WAAW,EACT,srBAAsrB;IACxrB,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,gBAAgB,EAAE,CAAC;aAChB,MAAM,EAAE;aACR,GAAG,CAAC,KAAK,CAAC;aACV,QAAQ,EAAE;aACV,QAAQ,CACP,gIAAgI,CACjI;QACH,aAAa,EAAE,CAAC;aACb,MAAM,EAAE;aACR,GAAG,CAAC,KAAK,CAAC;aACV,QAAQ,EAAE;aACV,QAAQ,CACP,kLAAkL,CACnL;QACH,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,GAAG,CAAC;aACR,GAAG,CAAC,GAAG,CAAC;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,+DAA+D,CAAC;QAC5E,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,GAAG,CAAC,IAAI,CAAC;aACT,QAAQ,EAAE;aACV,QAAQ,CACP,8LAA8L,CAC/L;KACJ,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,CAAC,iFAAiF,CAAC;QAC9F,QAAQ,EAAE,CAAC;aACR,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC;gBACJ,oBAAoB;gBACpB,aAAa;gBACb,eAAe;gBACf,cAAc;gBACd,wBAAwB;gBACxB,cAAc;gBACd,uBAAuB;gBACvB,yBAAyB;gBACzB,mBAAmB;gBACnB,eAAe;aAChB,CAAC;iBACD,QAAQ,CACP,6fAA6f,CAC9f;YACH,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;iBACvC,QAAQ,CACP,mKAAmK,CACpK;YACH,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,QAAQ,CACP,kGAAkG,CACnG;YACH,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,QAAQ,CAAC,8DAA8D,CAAC;YAC3E,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,QAAQ,CAAC,mEAAmE,CAAC;YAChF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;YAC/E,gBAAgB,EAAE,CAAC;iBAChB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,kIAAkI,CACnI;SACJ,CAAC;aACD,QAAQ,CAAC,6CAA6C,CAAC,CAC3D;aACA,QAAQ,CAAC,kEAAkE,CAAC;QAC/E,YAAY,EAAE,CAAC;aACZ,MAAM,CAAC;YACN,eAAe,EAAE,CAAC;iBACf,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,6EAA6E,CAAC;YAC1F,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,qEAAqE,CAAC;YAClF,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,4DAA4D,CAAC;YACzE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;YACtF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YACjF,KAAK,EAAE,CAAC;iBACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;iBAClD,QAAQ,CAAC,oCAAoC,CAAC;SAClD,CAAC;aACD,QAAQ,CACP,mHAAmH,CACpH;QACH,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,QAAQ,CACP,yFAAyF,CAC1F;QACH,mBAAmB,EAAE,CAAC;aACnB,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;YAChF,MAAM,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,QAAQ,CAAC,qEAAqE,CAAC;YAClF,IAAI,EAAE,CAAC;iBACJ,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC/B,QAAQ,CACP,4GAA4G,CAC7G;SACJ,CAAC;aACD,QAAQ,CAAC,4DAA4D,CAAC,CAC1E;aACA,QAAQ,CACP,uJAAuJ,CACxJ;KACJ,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,gBAAgB,CAAC,aAAa;YACpC,IAAI,EAAE,0DAA0D;YAChE,QAAQ,EAAE,uEAAuE;SAClF;KACF;IAED,OAAO,CAAC,KAAK,EAAE,GAAG;QAChB,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YACpD,MAAM,GAAG,CAAC,IAAI,CACZ,UAAU,EACV,qEAAqE,EACrE,EAAE,CACH,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,0BAA0B,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CACxB,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,OAAO,EACb,GAAG,CACJ,CAAC;QAEF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE;YACjD,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;YACpC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;SACvE,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,MAAM,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa,CAAC,QAAQ,MAAM,CAAC,uBAAuB,EAAE,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAC9F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAChC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACf,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,eAAe,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACxF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;gBAClD,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBAChD,IAAI,CAAC,CAAC,gBAAgB;oBAAE,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;QAC/B,MAAM,SAAS,GAAG;YAChB,EAAE,CAAC,eAAe,IAAI,WAAW,EAAE,CAAC,eAAe,EAAE;YACrD,EAAE,CAAC,SAAS,IAAI,cAAc,EAAE,CAAC,SAAS,EAAE;YAC5C,EAAE,CAAC,QAAQ,IAAI,aAAa,EAAE,CAAC,QAAQ,EAAE;YACzC,EAAE,CAAC,QAAQ,IAAI,aAAa,EAAE,CAAC,QAAQ,EAAE;YACzC,EAAE,CAAC,cAAc,IAAI,UAAU,EAAE,CAAC,cAAc,EAAE;YAClD,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;SACtC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAElB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,MAAM,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBAC3C,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,KAAK,CAAC,IAAI,CACR,WAAW,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}
1
+ {"version":3,"file":"pentest-analyze-response.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-analyze-response.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAEvG,MAAM,uBAAuB,GAC3B,oMAAoM,CAAC;AAEvM,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC,0BAA0B,EAAE;IACzE,KAAK,EAAE,0BAA0B;IACjC,WAAW,EACT,srBAAsrB;IACxrB,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,gBAAgB,EAAE,CAAC;aAChB,MAAM,EAAE;aACR,GAAG,CAAC,KAAK,CAAC;aACV,QAAQ,EAAE;aACV,QAAQ,CACP,gIAAgI,CACjI;QACH,aAAa,EAAE,CAAC;aACb,MAAM,EAAE;aACR,GAAG,CAAC,KAAK,CAAC;aACV,QAAQ,EAAE;aACV,QAAQ,CACP,kLAAkL,CACnL;QACH,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,GAAG,CAAC;aACR,GAAG,CAAC,GAAG,CAAC;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,+DAA+D,CAAC;QAC5E,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,GAAG,CAAC,IAAI,CAAC;aACT,QAAQ,EAAE;aACV,QAAQ,CACP,8LAA8L,CAC/L;KACJ,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,CAAC,iFAAiF,CAAC;QAC9F,QAAQ,EAAE,CAAC;aACR,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC;gBACJ,oBAAoB;gBACpB,aAAa;gBACb,eAAe;gBACf,cAAc;gBACd,wBAAwB;gBACxB,cAAc;gBACd,uBAAuB;gBACvB,yBAAyB;gBACzB,mBAAmB;gBACnB,eAAe;aAChB,CAAC;iBACD,QAAQ,CACP,6fAA6f,CAC9f;YACH,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;iBACvC,QAAQ,CACP,mKAAmK,CACpK;YACH,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,QAAQ,CACP,kGAAkG,CACnG;YACH,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,QAAQ,CAAC,8DAA8D,CAAC;YAC3E,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,QAAQ,CAAC,mEAAmE,CAAC;YAChF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;YAC/E,gBAAgB,EAAE,CAAC;iBAChB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,kIAAkI,CACnI;SACJ,CAAC;aACD,QAAQ,CAAC,6CAA6C,CAAC,CAC3D;aACA,QAAQ,CAAC,kEAAkE,CAAC;QAC/E,YAAY,EAAE,CAAC;aACZ,MAAM,CAAC;YACN,eAAe,EAAE,CAAC;iBACf,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,6EAA6E,CAAC;YAC1F,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,qEAAqE,CAAC;YAClF,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,4DAA4D,CAAC;YACzE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;YACtF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YACjF,KAAK,EAAE,CAAC;iBACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;iBAClD,QAAQ,CAAC,oCAAoC,CAAC;SAClD,CAAC;aACD,QAAQ,CACP,mHAAmH,CACpH;QACH,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,QAAQ,CACP,yFAAyF,CAC1F;QACH,mBAAmB,EAAE,CAAC;aACnB,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;YAChF,MAAM,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,QAAQ,CAAC,qEAAqE,CAAC;YAClF,IAAI,EAAE,CAAC;iBACJ,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC/B,QAAQ,CACP,4GAA4G,CAC7G;SACJ,CAAC;aACD,QAAQ,CAAC,4DAA4D,CAAC,CAC1E;aACA,QAAQ,CACP,uJAAuJ,CACxJ;KACJ,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,gBAAgB,CAAC,eAAe;YACtC,IAAI,EAAE,0DAA0D;YAChE,QAAQ,EAAE,uEAAuE;SAClF;KACF;IAED,OAAO,CAAC,KAAK,EAAE,GAAG;QAChB,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YACpD,MAAM,GAAG,CAAC,IAAI,CACZ,UAAU,EACV,qEAAqE,EACrE,EAAE,CACH,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,0BAA0B,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CACxB,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,OAAO,EACb,GAAG,CACJ,CAAC;QAEF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE;YACjD,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;YACpC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;SACvE,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,MAAM,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa,CAAC,QAAQ,MAAM,CAAC,uBAAuB,EAAE,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAC9F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAChC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACf,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,eAAe,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACxF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;gBAClD,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBAChD,IAAI,CAAC,CAAC,gBAAgB;oBAAE,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;QAC/B,MAAM,SAAS,GAAG;YAChB,EAAE,CAAC,eAAe,IAAI,WAAW,EAAE,CAAC,eAAe,EAAE;YACrD,EAAE,CAAC,SAAS,IAAI,cAAc,EAAE,CAAC,SAAS,EAAE;YAC5C,EAAE,CAAC,QAAQ,IAAI,aAAa,EAAE,CAAC,QAAQ,EAAE;YACzC,EAAE,CAAC,QAAQ,IAAI,aAAa,EAAE,CAAC,QAAQ,EAAE;YACzC,EAAE,CAAC,cAAc,IAAI,UAAU,EAAE,CAAC,cAAc,EAAE;YAClD,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;SACtC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAElB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,MAAM,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBAC3C,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,KAAK,CAAC,IAAI,CACR,WAAW,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}
package/dist/mcp-server/tools/definitions/pentest-encode.tool.d.ts CHANGED
@@ -32,7 +32,7 @@ export declare const pentestEncodeTool: import("@cyanheads/mcp-ts-core").ToolDef
32
32
  detection_note: z.ZodString;
33
33
  }, z.core.$strip>, readonly [{
34
34
  readonly reason: "encoding_error";
35
- readonly code: JsonRpcErrorCode.InvalidParams;
35
+ readonly code: JsonRpcErrorCode.ValidationError;
36
36
  readonly when: "An encoding step produced invalid output (e.g., base64 on invalid input).";
37
37
  readonly recovery: "Check the payload contents; ensure upstream steps produce valid input for subsequent encodings.";
38
38
  }], undefined>;
package/dist/mcp-server/tools/definitions/pentest-encode.tool.js CHANGED
@@ -68,7 +68,7 @@ export const pentestEncodeTool = tool('pentest_encode', {
68
68
  errors: [
69
69
  {
70
70
  reason: 'encoding_error',
71
- code: JsonRpcErrorCode.InvalidParams,
71
+ code: JsonRpcErrorCode.ValidationError,
72
72
  when: 'An encoding step produced invalid output (e.g., base64 on invalid input).',
73
73
  recovery: 'Check the payload contents; ensure upstream steps produce valid input for subsequent encodings.',
74
74
  },
package/dist/mcp-server/tools/definitions/pentest-encode.tool.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"pentest-encode.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-encode.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAE7E,MAAM,uBAAuB,GAC3B,oIAAoI,CAAC;AAEvI,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,EAAE;IACtD,KAAK,EAAE,gBAAgB;IACvB,WAAW,EACT,ynBAAynB;IAC3nB,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,KAAK,CAAC;aACV,QAAQ,CAAC,wDAAwD,CAAC;QACrE,KAAK,EAAE,CAAC;aACL,KAAK,CACJ,CAAC;aACE,IAAI,CAAC;YACJ,KAAK;YACL,YAAY;YACZ,aAAa;YACb,SAAS;YACT,KAAK;YACL,QAAQ;YACR,WAAW;YACX,WAAW;YACX,YAAY;YACZ,eAAe;SAChB,CAAC;aACD,QAAQ,CAAC,mBAAmB,CAAC,CACjC;aACA,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CACP,4JAA4J,CAC7J;QACH,OAAO,EAAE,CAAC;aACP,OAAO,EAAE;aACT,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CACP,sFAAsF,CACvF;KACJ,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,CAAC,4EAA4E,CAAC;QACzF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;QACpF,kBAAkB,EAAE,CAAC;aAClB,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YACpE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;SACvE,CAAC;aACD,QAAQ,CAAC,iDAAiD,CAAC,CAC/D;aACA,QAAQ,CAAC,mEAAmE,CAAC;QAChF,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,mIAAmI,CACpI;QACH,gBAAgB,EAAE,CAAC;aAChB,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,mGAAmG,CACpG;QACH,cAAc,EAAE,CAAC;aACd,MAAM,EAAE;aACR,QAAQ,CACP,6KAA6K,CAC9K;KACJ,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,gBAAgB;YACxB,IAAI,EAAE,gBAAgB,CAAC,aAAa;YACpC,IAAI,EAAE,2EAA2E;YACjF,QAAQ,EACN,iGAAiG;SACpG;KACF;IAED,OAAO,CAAC,KAAK,EAAE,GAAG;QAChB,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;QAEjC,IAAI,MAAyC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAuB,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,CAAC,IAAI,CACZ,gBAAgB,EAChB,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7E,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE;YACvC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YACpC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;SACrC,CAAC,CAAC;QAEH,OAAO;YACL,uBAAuB,EAAE,uBAAuB;YAChD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa;YACtB,QAAQ,MAAM,CAAC,uBAAuB,EAAE;YACxC,EAAE;YACF,mBAAmB;YACnB,EAAE;YACF,mBAAmB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI;YACpD,EAAE;YACF,kBAAkB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI;YAClD,EAAE;SACH,CAAC;QAEF,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACzE,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC/D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAElC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}
1
+ {"version":3,"file":"pentest-encode.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-encode.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAE7E,MAAM,uBAAuB,GAC3B,oIAAoI,CAAC;AAEvI,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,EAAE;IACtD,KAAK,EAAE,gBAAgB;IACvB,WAAW,EACT,ynBAAynB;IAC3nB,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,KAAK,CAAC;aACV,QAAQ,CAAC,wDAAwD,CAAC;QACrE,KAAK,EAAE,CAAC;aACL,KAAK,CACJ,CAAC;aACE,IAAI,CAAC;YACJ,KAAK;YACL,YAAY;YACZ,aAAa;YACb,SAAS;YACT,KAAK;YACL,QAAQ;YACR,WAAW;YACX,WAAW;YACX,YAAY;YACZ,eAAe;SAChB,CAAC;aACD,QAAQ,CAAC,mBAAmB,CAAC,CACjC;aACA,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CACP,4JAA4J,CAC7J;QACH,OAAO,EAAE,CAAC;aACP,OAAO,EAAE;aACT,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CACP,sFAAsF,CACvF;KACJ,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,CAAC,4EAA4E,CAAC;QACzF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;QACpF,kBAAkB,EAAE,CAAC;aAClB,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YACpE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;SACvE,CAAC;aACD,QAAQ,CAAC,iDAAiD,CAAC,CAC/D;aACA,QAAQ,CAAC,mEAAmE,CAAC;QAChF,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,mIAAmI,CACpI;QACH,gBAAgB,EAAE,CAAC;aAChB,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,mGAAmG,CACpG;QACH,cAAc,EAAE,CAAC;aACd,MAAM,EAAE;aACR,QAAQ,CACP,6KAA6K,CAC9K;KACJ,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,gBAAgB;YACxB,IAAI,EAAE,gBAAgB,CAAC,eAAe;YACtC,IAAI,EAAE,2EAA2E;YACjF,QAAQ,EACN,iGAAiG;SACpG;KACF;IAED,OAAO,CAAC,KAAK,EAAE,GAAG;QAChB,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;QAEjC,IAAI,MAAyC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAuB,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,CAAC,IAAI,CACZ,gBAAgB,EAChB,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7E,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE;YACvC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YACpC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;SACrC,CAAC,CAAC;QAEH,OAAO;YACL,uBAAuB,EAAE,uBAAuB;YAChD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa;YACtB,QAAQ,MAAM,CAAC,uBAAuB,EAAE;YACxC,EAAE;YACF,mBAAmB;YACnB,EAAE;YACF,mBAAmB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI;YACpD,EAAE;YACF,kBAAkB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI;YAClD,EAAE;SACH,CAAC;QAEF,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACzE,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC/D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAElC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}
package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.d.ts CHANGED
@@ -46,6 +46,9 @@ export declare const pentestGeneratePayloadsTool: import("@cyanheads/mcp-ts-core
46
46
  modsecurity_crs: "modsecurity_crs";
47
47
  imperva: "imperva";
48
48
  akamai: "akamai";
49
+ f5_bigip_asm: "f5_bigip_asm";
50
+ nginx_modsecurity: "nginx_modsecurity";
51
+ fortinet_fortiwaf: "fortinet_fortiwaf";
49
52
  none: "none";
50
53
  }>>;
51
54
  encoding: z.ZodOptional<z.ZodArray<z.ZodEnum<{
package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"pentest-generate-payloads.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-generate-payloads.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAiNtC,CAAC"}
1
+ {"version":3,"file":"pentest-generate-payloads.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-generate-payloads.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA4NtC,CAAC"}
package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.js CHANGED
@@ -50,7 +50,18 @@ export const pentestGeneratePayloadsTool = tool('pentest_generate_payloads', {
50
50
  ])
51
51
  .describe('Precise injection context. Critical for XSS: an HTML attribute payload differs from a JS string payload. Provide the most specific context for the best results.'),
52
52
  waf_profile: z
53
- .enum(['cloudflare', 'aws_waf', 'modsecurity_crs', 'imperva', 'akamai', 'none', 'unknown'])
53
+ .enum([
54
+ 'cloudflare',
55
+ 'aws_waf',
56
+ 'modsecurity_crs',
57
+ 'imperva',
58
+ 'akamai',
59
+ 'f5_bigip_asm',
60
+ 'nginx_modsecurity',
61
+ 'fortinet_fortiwaf',
62
+ 'none',
63
+ 'unknown',
64
+ ])
54
65
  .default('none')
55
66
  .describe('WAF or filter in front of the authorized test target. When a specific WAF is named, bypass variants referencing known public research are included.'),
56
67
  encoding: z
package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"pentest-generate-payloads.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-generate-payloads.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAE1E,MAAM,uBAAuB,GAC3B,2KAA2K,CAAC;AAE9K,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC,2BAA2B,EAAE;IAC3E,KAAK,EAAE,2BAA2B;IAClC,WAAW,EACT,moBAAmoB;IACroB,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,QAAQ,EAAE,CAAC;aACR,IAAI,CAAC;YACJ,KAAK;YACL,MAAM;YACN,MAAM;YACN,KAAK;YACL,gBAAgB;YAChB,MAAM;YACN,mBAAmB;YACnB,eAAe;YACf,MAAM;YACN,iBAAiB;YACjB,KAAK;YACL,gBAAgB;YAChB,iBAAiB;YACjB,aAAa;SACd,CAAC;aACD,QAAQ,CAAC,gDAAgD,CAAC;QAC7D,iBAAiB,EAAE,CAAC;aACjB,IAAI,CAAC;YACJ,gBAAgB;YAChB,WAAW;YACX,WAAW;YACX,aAAa;YACb,iBAAiB;YACjB,eAAe;YACf,UAAU;YACV,WAAW;YACX,aAAa;YACb,aAAa;YACb,eAAe;YACf,aAAa;YACb,YAAY;YACZ,cAAc;YACd,WAAW;YACX,SAAS;SACV,CAAC;aACD,QAAQ,CACP,kKAAkK,CACnK;QACH,WAAW,EAAE,CAAC;aACX,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;aAC1F,OAAO,CAAC,MAAM,CAAC;aACf,QAAQ,CACP,qJAAqJ,CACtJ;QACH,QAAQ,EAAE,CAAC;aACR,KAAK,CACJ,CAAC;aACE,IAAI,CAAC;YACJ,MAAM;YACN,KAAK;YACL,YAAY;YACZ,aAAa;YACb,SAAS;YACT,KAAK;YACL,QAAQ;YACR,WAAW;SACZ,CAAC;aACD,QAAQ,CAAC,4BAA4B,CAAC,CAC1C;aACA,QAAQ,EAAE;aACV,QAAQ,CACP,0JAA0J,CAC3J;QACH,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,CAAC;aACP,OAAO,CAAC,CAAC,CAAC;aACV,QAAQ,CACP,+HAA+H,CAChI;KACJ,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAC5D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QACtE,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,CAAC,gEAAgE,CAAC;QAC7E,QAAQ,EAAE,CAAC;aACR,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,QAAQ,CACP,iHAAiH,CAClH;YACH,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,CACP,8EAA8E,CAC/E;YACH,mBAAmB,EAAE,CAAC;iBACnB,MAAM,EAAE;iBACR,QAAQ,CACP,4GAA4G,CAC7G;YACH,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,CACP,8FAA8F,CAC/F;YACH,eAAe,EAAE,CAAC;iBACf,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,2GAA2G,CAC5G;YACH,eAAe,EAAE,CAAC;iBACf,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,uGAAuG,CACxG;SACJ,CAAC;aACD,QAAQ,CACP,wIAAwI,CACzI,CACJ;aACA,QAAQ,CACP,iGAAiG,CAClG;KACJ,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,gBAAgB,CAAC,QAAQ;YAC/B,IAAI,EAAE,8EAA8E;YACpF,QAAQ,EAAE,gFAAgF;SAC3F;KACF;IAED,OAAO,CAAC,KAAK,EAAE,GAAG;QAChB,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;QAEhC,wCAAwC;QACxC,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAmB,CAAC;QAE3F,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAC9B,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,WAAW,EACjB,aAAa,EACb,KAAK,CAAC,KAAK,EACX,GAAG,CACJ,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,GAAG,CAAC,IAAI,CACZ,aAAa,EACb,4CAA4C,KAAK,CAAC,QAAQ,iBAAiB,KAAK,CAAC,iBAAiB,IAAI,CACvG,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE;YACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,KAAK,CAAC,iBAAiB;YACzC,KAAK,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,uBAAuB,EAAE,uBAAuB;YAChD,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa;YACtB,QAAQ,MAAM,CAAC,uBAAuB,EAAE;YACxC,EAAE;YACF,eAAe,MAAM,CAAC,QAAQ,MAAM,MAAM,CAAC,iBAAiB,EAAE;YAC9D,EAAE;SACH,CAAC;QAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC;YAChE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC,CAAC,eAAe;gBAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBACnC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;gBAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}
1
+ {"version":3,"file":"pentest-generate-payloads.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-generate-payloads.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAE1E,MAAM,uBAAuB,GAC3B,2KAA2K,CAAC;AAE9K,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC,2BAA2B,EAAE;IAC3E,KAAK,EAAE,2BAA2B;IAClC,WAAW,EACT,moBAAmoB;IACroB,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,QAAQ,EAAE,CAAC;aACR,IAAI,CAAC;YACJ,KAAK;YACL,MAAM;YACN,MAAM;YACN,KAAK;YACL,gBAAgB;YAChB,MAAM;YACN,mBAAmB;YACnB,eAAe;YACf,MAAM;YACN,iBAAiB;YACjB,KAAK;YACL,gBAAgB;YAChB,iBAAiB;YACjB,aAAa;SACd,CAAC;aACD,QAAQ,CAAC,gDAAgD,CAAC;QAC7D,iBAAiB,EAAE,CAAC;aACjB,IAAI,CAAC;YACJ,gBAAgB;YAChB,WAAW;YACX,WAAW;YACX,aAAa;YACb,iBAAiB;YACjB,eAAe;YACf,UAAU;YACV,WAAW;YACX,aAAa;YACb,aAAa;YACb,eAAe;YACf,aAAa;YACb,YAAY;YACZ,cAAc;YACd,WAAW;YACX,SAAS;SACV,CAAC;aACD,QAAQ,CACP,kKAAkK,CACnK;QACH,WAAW,EAAE,CAAC;aACX,IAAI,CAAC;YACJ,YAAY;YACZ,SAAS;YACT,iBAAiB;YACjB,SAAS;YACT,QAAQ;YACR,cAAc;YACd,mBAAmB;YACnB,mBAAmB;YACnB,MAAM;YACN,SAAS;SACV,CAAC;aACD,OAAO,CAAC,MAAM,CAAC;aACf,QAAQ,CACP,qJAAqJ,CACtJ;QACH,QAAQ,EAAE,CAAC;aACR,KAAK,CACJ,CAAC;aACE,IAAI,CAAC;YACJ,MAAM;YACN,KAAK;YACL,YAAY;YACZ,aAAa;YACb,SAAS;YACT,KAAK;YACL,QAAQ;YACR,WAAW;SACZ,CAAC;aACD,QAAQ,CAAC,4BAA4B,CAAC,CAC1C;aACA,QAAQ,EAAE;aACV,QAAQ,CACP,0JAA0J,CAC3J;QACH,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,CAAC;aACP,OAAO,CAAC,CAAC,CAAC;aACV,QAAQ,CACP,+HAA+H,CAChI;KACJ,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAC5D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QACtE,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,CAAC,gEAAgE,CAAC;QAC7E,QAAQ,EAAE,CAAC;aACR,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,QAAQ,CACP,iHAAiH,CAClH;YACH,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,CACP,8EAA8E,CAC/E;YACH,mBAAmB,EAAE,CAAC;iBACnB,MAAM,EAAE;iBACR,QAAQ,CACP,4GAA4G,CAC7G;YACH,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,CACP,8FAA8F,CAC/F;YACH,eAAe,EAAE,CAAC;iBACf,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,2GAA2G,CAC5G;YACH,eAAe,EAAE,CAAC;iBACf,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,uGAAuG,CACxG;SACJ,CAAC;aACD,QAAQ,CACP,wIAAwI,CACzI,CACJ;aACA,QAAQ,CACP,iGAAiG,CAClG;KACJ,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,gBAAgB,CAAC,QAAQ;YAC/B,IAAI,EAAE,8EAA8E;YACpF,QAAQ,EAAE,gFAAgF;SAC3F;KACF;IAED,OAAO,CAAC,KAAK,EAAE,GAAG;QAChB,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;QAEhC,wCAAwC;QACxC,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAmB,CAAC;QAE3F,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAC9B,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,WAAW,EACjB,aAAa,EACb,KAAK,CAAC,KAAK,EACX,GAAG,CACJ,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,GAAG,CAAC,IAAI,CACZ,aAAa,EACb,4CAA4C,KAAK,CAAC,QAAQ,iBAAiB,KAAK,CAAC,iBAAiB,IAAI,CACvG,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE;YACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,KAAK,CAAC,iBAAiB;YACzC,KAAK,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,uBAAuB,EAAE,uBAAuB;YAChD,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa;YACtB,QAAQ,MAAM,CAAC,uBAAuB,EAAE;YACxC,EAAE;YACF,eAAe,MAAM,CAAC,QAAQ,MAAM,MAAM,CAAC,iBAAiB,EAAE;YAC9D,EAAE;SACH,CAAC;QAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC;YAChE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC,CAAC,eAAe;gBAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBACnC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;gBAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}
package/dist/mcp-server/tools/definitions/pentest-guide.tool.d.ts CHANGED
@@ -59,7 +59,7 @@ export declare const pentestGuideTool: import("@cyanheads/mcp-ts-core").ToolDefi
59
59
  }, z.core.$strip>>;
60
60
  }, z.core.$strip>, readonly [{
61
61
  readonly reason: "unknown_vector";
62
- readonly code: JsonRpcErrorCode.InvalidParams;
62
+ readonly code: JsonRpcErrorCode.ValidationError;
63
63
  readonly when: "Vector value is not in the supported enum.";
64
64
  readonly recovery: "Use one of the listed enum values for the vector parameter.";
65
65
  }], undefined>;
package/dist/mcp-server/tools/definitions/pentest-guide.tool.js CHANGED
@@ -116,7 +116,7 @@ export const pentestGuideTool = tool('pentest_guide', {
116
116
  errors: [
117
117
  {
118
118
  reason: 'unknown_vector',
119
- code: JsonRpcErrorCode.InvalidParams,
119
+ code: JsonRpcErrorCode.ValidationError,
120
120
  when: 'Vector value is not in the supported enum.',
121
121
  recovery: 'Use one of the listed enum values for the vector parameter.',
122
122
  },