@cyanheads/pentest-mcp-server 0.1.6 → 0.1.7

package/dist/data/payloads/index.d.ts

@@ -10,5 +10,5 @@ export type PayloadCategory = 'xss' | 'sqli' | 'ssrf' | 'xxe' | 'path_traversal'
  * Retrieve payload templates for a given category and injection context.
  * Falls back to 'generic' if the specific context isn't found.
  */
-export declare function getPayloads(category: string, injectionContext: string): PayloadTemplate[] | undefined;
+export declare function getPayloads(category: PayloadCategory, injectionContext: string): PayloadTemplate[];
 //# sourceMappingURL=index.d.ts.map

package/dist/data/payloads/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/data/payloads/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgBH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlD,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,sDAAsD;AACtD,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,MAAM,GACN,MAAM,GACN,KAAK,GACL,gBAAgB,GAChB,MAAM,GACN,mBAAmB,GACnB,eAAe,GACf,MAAM,GACN,iBAAiB,GACjB,KAAK,GACL,gBAAgB,GAChB,iBAAiB,GACjB,aAAa,CAAC;AAoBlB;;;GAGG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,GACvB,eAAe,EAAE,GAAG,SAAS,CAI/B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/data/payloads/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgBH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlD,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,sDAAsD;AACtD,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,MAAM,GACN,MAAM,GACN,KAAK,GACL,gBAAgB,GAChB,MAAM,GACN,mBAAmB,GACnB,eAAe,GACf,MAAM,GACN,iBAAiB,GACjB,KAAK,GACL,gBAAgB,GAChB,iBAAiB,GACjB,aAAa,CAAC;AAoBlB;;;GAGG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,eAAe,EACzB,gBAAgB,EAAE,MAAM,GACvB,eAAe,EAAE,CAOnB"}

package/dist/data/payloads/index.js

@@ -33,8 +33,10 @@ const registry = {
  */
 export function getPayloads(category, injectionContext) {
     const cat = registry[category];
-    if (!cat)
-        return;
-    return cat[injectionContext] ?? cat['generic'];
+    const templates = cat[injectionContext] ?? cat['generic'];
+    if (!templates) {
+        throw new Error(`Payload registry has no generic fallback for category "${category}".`);
+    }
+    return templates;
 }
 //# sourceMappingURL=index.js.map

package/dist/data/payloads/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/data/payloads/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAqBvC,8DAA8D;AAC9D,MAAM,QAAQ,GAAsD;IAClE,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,cAAc,EAAE,qBAAqB;IACrC,IAAI,EAAE,YAAY;IAClB,iBAAiB,EAAE,wBAAwB;IAC3C,aAAa,EAAE,oBAAoB;IACnC,IAAI,EAAE,YAAY;IAClB,eAAe,EAAE,uBAAuB;IACxC,GAAG,EAAE,WAAW;IAChB,cAAc,EAAE,qBAAqB;IACrC,eAAe,EAAE,sBAAsB;IACvC,WAAW,EAAE,kBAAkB;CAChC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,QAAgB,EAChB,gBAAwB;IAExB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,OAAO,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;AACjD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/data/payloads/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAqBvC,8DAA8D;AAC9D,MAAM,QAAQ,GAA+D;IAC3E,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,cAAc,EAAE,qBAAqB;IACrC,IAAI,EAAE,YAAY;IAClB,iBAAiB,EAAE,wBAAwB;IAC3C,aAAa,EAAE,oBAAoB;IACnC,IAAI,EAAE,YAAY;IAClB,eAAe,EAAE,uBAAuB;IACxC,GAAG,EAAE,WAAW;IAChB,cAAc,EAAE,qBAAqB;IACrC,eAAe,EAAE,sBAAsB;IACvC,WAAW,EAAE,kBAAkB;CAChC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,QAAyB,EACzB,gBAAwB;IAExB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0DAA0D,QAAQ,IAAI,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/data/payloads/ssti.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssti.d.ts","sourceRoot":"","sources":["../../../src/data/payloads/ssti.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,CAoE1D,CAAC"}
+{"version":3,"file":"ssti.d.ts","sourceRoot":"","sources":["../../../src/data/payloads/ssti.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,CAuE1D,CAAC"}

package/dist/data/payloads/ssti.js

@@ -12,8 +12,10 @@ export const sstiPayloads = {
             mitigation: 'Never pass user input directly to template render calls. Use template sandboxing or data-binding instead of string interpolation.',
         },
         {
+            // biome-ignore lint/suspicious/noTemplateCurlyInString: literal security payload, not interpolation
             template: '${7*7}',
             description: 'FreeMarker/EL (Java) SSTI probe. If response reflects "49", expression language evaluation is active.',
+            // biome-ignore lint/suspicious/noTemplateCurlyInString: literal detection pattern, not interpolation
             detection_signature: 'Pattern: ${...} EL expression evaluated in response',
             mitigation: 'Disable EL evaluation for user-controlled input; use whitelisted template functions only.',
         },
@@ -50,6 +52,7 @@ export const sstiPayloads = {
             mitigation: 'Never pass user input directly to template engines.',
         },
         {
+            // biome-ignore lint/suspicious/noTemplateCurlyInString: literal security payload, not interpolation
             template: '${7*7}',
             description: 'EL/FreeMarker SSTI probe for Java stacks.',
             detection_signature: 'Pattern: EL expression evaluated in response',

package/dist/data/payloads/ssti.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssti.js","sourceRoot":"","sources":["../../../src/data/payloads/ssti.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,yDAAyD;AACzD,MAAM,CAAC,MAAM,YAAY,GAAsC;IAC7D,aAAa,EAAE;QACb;YACE,QAAQ,EAAE,SAAS;YACnB,WAAW,EACT,yLAAyL;YAC3L,mBAAmB,EAAE,kEAAkE;YACvF,UAAU,EACR,mIAAmI;SACtI;QACD;YACE,QAAQ,EAAE,QAAQ;YAClB,WAAW,EACT,uGAAuG;YACzG,mBAAmB,EAAE,qDAAqD;YAC1E,UAAU,EACR,2FAA2F;SAC9F;QACD;YACE,QAAQ,EAAE,YAAY;YACtB,WAAW,EACT,+GAA+G;YACjH,mBAAmB,EAAE,2CAA2C;YAChE,UAAU,EACR,wFAAwF;SAC3F;QACD;YACE,QAAQ,EAAE,YAAY;YACtB,WAAW,EACT,qKAAqK;YACvK,mBAAmB,EACjB,uFAAuF;YACzF,UAAU,EACR,6GAA6G;SAChH;QACD;YACE,QAAQ,EAAE,8CAA8C;YACxD,WAAW,EACT,mKAAmK;YACrK,mBAAmB,EAAE,uEAAuE;YAC5F,UAAU,EACR,sFAAsF;SACzF;QACD;YACE,QAAQ,EACN,sFAAsF;YACxF,WAAW,EACT,+KAA+K;YACjL,mBAAmB,EACjB,kHAAkH;YACpH,UAAU,EACR,oJAAoJ;SACvJ;KACF;IACD,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,SAAS;YACnB,WAAW,EAAE,2CAA2C;YACxD,mBAAmB,EAAE,oDAAoD;YACzE,UAAU,EAAE,qDAAqD;SAClE;QACD;YACE,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,2CAA2C;YACxD,mBAAmB,EAAE,8CAA8C;YACnE,UAAU,EAAE,wCAAwC;SACrD;KACF;CACF,CAAC"}
+{"version":3,"file":"ssti.js","sourceRoot":"","sources":["../../../src/data/payloads/ssti.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,yDAAyD;AACzD,MAAM,CAAC,MAAM,YAAY,GAAsC;IAC7D,aAAa,EAAE;QACb;YACE,QAAQ,EAAE,SAAS;YACnB,WAAW,EACT,yLAAyL;YAC3L,mBAAmB,EAAE,kEAAkE;YACvF,UAAU,EACR,mIAAmI;SACtI;QACD;YACE,oGAAoG;YACpG,QAAQ,EAAE,QAAQ;YAClB,WAAW,EACT,uGAAuG;YACzG,qGAAqG;YACrG,mBAAmB,EAAE,qDAAqD;YAC1E,UAAU,EACR,2FAA2F;SAC9F;QACD;YACE,QAAQ,EAAE,YAAY;YACtB,WAAW,EACT,+GAA+G;YACjH,mBAAmB,EAAE,2CAA2C;YAChE,UAAU,EACR,wFAAwF;SAC3F;QACD;YACE,QAAQ,EAAE,YAAY;YACtB,WAAW,EACT,qKAAqK;YACvK,mBAAmB,EACjB,uFAAuF;YACzF,UAAU,EACR,6GAA6G;SAChH;QACD;YACE,QAAQ,EAAE,8CAA8C;YACxD,WAAW,EACT,mKAAmK;YACrK,mBAAmB,EAAE,uEAAuE;YAC5F,UAAU,EACR,sFAAsF;SACzF;QACD;YACE,QAAQ,EACN,sFAAsF;YACxF,WAAW,EACT,+KAA+K;YACjL,mBAAmB,EACjB,kHAAkH;YACpH,UAAU,EACR,oJAAoJ;SACvJ;KACF;IACD,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,SAAS;YACnB,WAAW,EAAE,2CAA2C;YACxD,mBAAmB,EAAE,oDAAoD;YACzE,UAAU,EAAE,qDAAqD;SAClE;QACD;YACE,oGAAoG;YACpG,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,2CAA2C;YACxD,mBAAmB,EAAE,8CAA8C;YACnE,UAAU,EAAE,wCAAwC;SACrD;KACF;CACF,CAAC"}

package/dist/data/payloads/xss.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"xss.d.ts","sourceRoot":"","sources":["../../../src/data/payloads/xss.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,wDAAwD;AACxD,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,CA6MzD,CAAC"}
+{"version":3,"file":"xss.d.ts","sourceRoot":"","sources":["../../../src/data/payloads/xss.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,wDAAwD;AACxD,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,CAgNzD,CAAC"}

package/dist/data/payloads/xss.js

@@ -96,12 +96,16 @@ export const xssPayloads = {
     ],
     js_template: [
         {
+            // biome-ignore lint/suspicious/noTemplateCurlyInString: literal security payload, not interpolation
             template: '${alert(document.domain)}',
             description: 'Template literal expression injection. Direct execution when input is placed inside a template literal without escaping.',
-            detection_signature: 'Pattern: ${...} expression in template literal; WAF signatures: "${alert"',
+            detection_signature: 
+            // biome-ignore lint/suspicious/noTemplateCurlyInString: literal detection pattern, not interpolation
+            'Pattern: ${...} expression in template literal; WAF signatures: "${alert"',
             mitigation: 'Never interpolate untrusted user input directly into template literals; sanitize and JS-encode first.',
         },
         {
+            // biome-ignore lint/suspicious/noTemplateCurlyInString: literal security payload, not interpolation
             template: '`-${alert(document.domain)}-`',
             description: 'Closes and re-opens a template literal to inject an expression. Useful when the injection point is inside a larger template literal string.',
             detection_signature: 'Pattern: backtick template literal injection',

package/dist/data/payloads/xss.js.map

@@ -1 +1 @@
-{"version":3,"file":"xss.js","sourceRoot":"","sources":["../../../src/data/payloads/xss.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,wDAAwD;AACxD,MAAM,CAAC,MAAM,WAAW,GAAsC;IAC5D,SAAS,EAAE;QACT;YACE,QAAQ,EAAE,yCAAyC;YACnD,WAAW,EACT,2JAA2J;YAC7J,mBAAmB,EACjB,4FAA4F;YAC9F,UAAU,EACR,mHAAmH;SACtH;QACD;YACE,QAAQ,EAAE,4CAA4C;YACtD,WAAW,EACT,0GAA0G;YAC5G,mBAAmB,EACjB,0EAA0E;YAC5E,UAAU,EACR,wFAAwF;SAC3F;QACD;YACE,QAAQ,EAAE,qCAAqC;YAC/C,WAAW,EACT,iKAAiK;YACnK,mBAAmB,EAAE,qEAAqE;YAC1F,UAAU,EACR,qGAAqG;SACxG;QACD;YACE,QAAQ,EAAE,gDAAgD;YAC1D,WAAW,EACT,oHAAoH;YACtH,mBAAmB,EACjB,qFAAqF;YACvF,UAAU,EACR,4FAA4F;SAC/F;QACD;YACE,QAAQ,EAAE,0CAA0C;YACpD,WAAW,EACT,8GAA8G;YAChH,mBAAmB,EAAE,uCAAuC;YAC5D,UAAU,EAAE,0DAA0D;SACvE;KACF;IACD,cAAc,EAAE;QACd;YACE,QAAQ,EAAE,gDAAgD;YAC1D,WAAW,EACT,+HAA+H;YACjI,mBAAmB,EACjB,8FAA8F;YAChG,UAAU,EACR,oFAAoF;SACvF;QACD;YACE,QAAQ,EAAE,gDAAgD;YAC1D,WAAW,EACT,sGAAsG;YACxG,mBAAmB,EAAE,6DAA6D;YAClF,UAAU,EACR,oFAAoF;SACvF;QACD;YACE,QAAQ,EAAE,wCAAwC;YAClD,WAAW,EACT,6FAA6F;YAC/F,mBAAmB,EAAE,2CAA2C;YAChE,UAAU,EAAE,6DAA6D;SAC1E;QACD;YACE,QAAQ,EAAE,mCAAmC;YAC7C,WAAW,EACT,qHAAqH;YACvH,mBAAmB,EACjB,4EAA4E;YAC9E,UAAU,EACR,iGAAiG;SACpG;QACD;YACE,QAAQ,EAAE,wDAAwD;YAClE,WAAW,EACT,mGAAmG;YACrG,mBAAmB,EAAE,kEAAkE;YACvF,UAAU,EAAE,+EAA+E;SAC5F;KACF;IACD,SAAS,EAAE;QACT;YACE,QAAQ,EAAE,4BAA4B;YACtC,WAAW,EACT,0IAA0I;YAC5I,mBAAmB,EACjB,2EAA2E;YAC7E,UAAU,EAAE,gFAAgF;SAC7F;QACD;YACE,QAAQ,EAAE,4BAA4B;YACtC,WAAW,EACT,oIAAoI;YACtI,mBAAmB,EAAE,qDAAqD;YAC1E,UAAU,EAAE,2EAA2E;SACxF;QACD;YACE,QAAQ,EAAE,8BAA8B;YACxC,WAAW,EACT,uIAAuI;YACzI,mBAAmB,EAAE,gDAAgD;YACrE,UAAU,EACR,qGAAqG;SACxG;QACD;YACE,QAAQ,EAAE,4BAA4B;YACtC,WAAW,EACT,kJAAkJ;YACpJ,mBAAmB,EAAE,mDAAmD;YACxE,UAAU,EAAE,8EAA8E;SAC3F;KACF;IACD,WAAW,EAAE;QACX;YACE,QAAQ,EAAE,2BAA2B;YACrC,WAAW,EACT,0HAA0H;YAC5H,mBAAmB,EACjB,2EAA2E;YAC7E,UAAU,EACR,uGAAuG;SAC1G;QACD;YACE,QAAQ,EAAE,+BAA+B;YACzC,WAAW,EACT,6IAA6I;YAC/I,mBAAmB,EAAE,8CAA8C;YACnE,UAAU,EACR,qFAAqF;SACxF;KACF;IACD,eAAe,EAAE;QACf;YACE,QAAQ,EAAE,kDAAkD;YAC5D,WAAW,EACT,8GAA8G;YAChH,mBAAmB,EACjB,gFAAgF;YAClF,UAAU,EACR,2GAA2G;SAC9G;QACD;YACE,QAAQ,EAAE,0BAA0B;YACpC,WAAW,EACT,uGAAuG;YACzG,mBAAmB,EAAE,6DAA6D;YAClF,UAAU,EAAE,wDAAwD;SACrE;KACF;IACD,aAAa,EAAE;QACb;YACE,QAAQ,EAAE,2CAA2C;YACrD,WAAW,EACT,mJAAmJ;YACrJ,mBAAmB,EACjB,8EAA8E;YAChF,UAAU,EACR,yFAAyF;SAC5F;QACD;YACE,QAAQ,EAAE,mCAAmC;YAC7C,WAAW,EAAE,+EAA+E;YAC5F,mBAAmB,EAAE,qEAAqE;YAC1F,UAAU,EACR,mFAAmF;SACtF;KACF;IACD,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,yCAAyC;YACnD,WAAW,EACT,kGAAkG;YACpG,mBAAmB,EAAE,qEAAqE;YAC1F,UAAU,EAAE,6DAA6D;SAC1E;QACD;YACE,QAAQ,EAAE,8CAA8C;YACxD,WAAW,EACT,2GAA2G;YAC7G,mBAAmB,EAAE,sDAAsD;YAC3E,UAAU,EAAE,8EAA8E;SAC3F;QACD;YACE,QAAQ,EAAE,mCAAmC;YAC7C,WAAW,EACT,+FAA+F;YACjG,mBAAmB,EAAE,0CAA0C;YAC/D,UAAU,EAAE,0DAA0D;SACvE;QACD;YACE,QAAQ,EAAE,qBAAqB;YAC/B,WAAW,EACT,iLAAiL;YACnL,mBAAmB,EAAE,kDAAkD;YACvE,UAAU,EACR,kFAAkF;SACrF;KACF;CACF,CAAC"}
+{"version":3,"file":"xss.js","sourceRoot":"","sources":["../../../src/data/payloads/xss.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,wDAAwD;AACxD,MAAM,CAAC,MAAM,WAAW,GAAsC;IAC5D,SAAS,EAAE;QACT;YACE,QAAQ,EAAE,yCAAyC;YACnD,WAAW,EACT,2JAA2J;YAC7J,mBAAmB,EACjB,4FAA4F;YAC9F,UAAU,EACR,mHAAmH;SACtH;QACD;YACE,QAAQ,EAAE,4CAA4C;YACtD,WAAW,EACT,0GAA0G;YAC5G,mBAAmB,EACjB,0EAA0E;YAC5E,UAAU,EACR,wFAAwF;SAC3F;QACD;YACE,QAAQ,EAAE,qCAAqC;YAC/C,WAAW,EACT,iKAAiK;YACnK,mBAAmB,EAAE,qEAAqE;YAC1F,UAAU,EACR,qGAAqG;SACxG;QACD;YACE,QAAQ,EAAE,gDAAgD;YAC1D,WAAW,EACT,oHAAoH;YACtH,mBAAmB,EACjB,qFAAqF;YACvF,UAAU,EACR,4FAA4F;SAC/F;QACD;YACE,QAAQ,EAAE,0CAA0C;YACpD,WAAW,EACT,8GAA8G;YAChH,mBAAmB,EAAE,uCAAuC;YAC5D,UAAU,EAAE,0DAA0D;SACvE;KACF;IACD,cAAc,EAAE;QACd;YACE,QAAQ,EAAE,gDAAgD;YAC1D,WAAW,EACT,+HAA+H;YACjI,mBAAmB,EACjB,8FAA8F;YAChG,UAAU,EACR,oFAAoF;SACvF;QACD;YACE,QAAQ,EAAE,gDAAgD;YAC1D,WAAW,EACT,sGAAsG;YACxG,mBAAmB,EAAE,6DAA6D;YAClF,UAAU,EACR,oFAAoF;SACvF;QACD;YACE,QAAQ,EAAE,wCAAwC;YAClD,WAAW,EACT,6FAA6F;YAC/F,mBAAmB,EAAE,2CAA2C;YAChE,UAAU,EAAE,6DAA6D;SAC1E;QACD;YACE,QAAQ,EAAE,mCAAmC;YAC7C,WAAW,EACT,qHAAqH;YACvH,mBAAmB,EACjB,4EAA4E;YAC9E,UAAU,EACR,iGAAiG;SACpG;QACD;YACE,QAAQ,EAAE,wDAAwD;YAClE,WAAW,EACT,mGAAmG;YACrG,mBAAmB,EAAE,kEAAkE;YACvF,UAAU,EAAE,+EAA+E;SAC5F;KACF;IACD,SAAS,EAAE;QACT;YACE,QAAQ,EAAE,4BAA4B;YACtC,WAAW,EACT,0IAA0I;YAC5I,mBAAmB,EACjB,2EAA2E;YAC7E,UAAU,EAAE,gFAAgF;SAC7F;QACD;YACE,QAAQ,EAAE,4BAA4B;YACtC,WAAW,EACT,oIAAoI;YACtI,mBAAmB,EAAE,qDAAqD;YAC1E,UAAU,EAAE,2EAA2E;SACxF;QACD;YACE,QAAQ,EAAE,8BAA8B;YACxC,WAAW,EACT,uIAAuI;YACzI,mBAAmB,EAAE,gDAAgD;YACrE,UAAU,EACR,qGAAqG;SACxG;QACD;YACE,QAAQ,EAAE,4BAA4B;YACtC,WAAW,EACT,kJAAkJ;YACpJ,mBAAmB,EAAE,mDAAmD;YACxE,UAAU,EAAE,8EAA8E;SAC3F;KACF;IACD,WAAW,EAAE;QACX;YACE,oGAAoG;YACpG,QAAQ,EAAE,2BAA2B;YACrC,WAAW,EACT,0HAA0H;YAC5H,mBAAmB;YACjB,qGAAqG;YACrG,2EAA2E;YAC7E,UAAU,EACR,uGAAuG;SAC1G;QACD;YACE,oGAAoG;YACpG,QAAQ,EAAE,+BAA+B;YACzC,WAAW,EACT,6IAA6I;YAC/I,mBAAmB,EAAE,8CAA8C;YACnE,UAAU,EACR,qFAAqF;SACxF;KACF;IACD,eAAe,EAAE;QACf;YACE,QAAQ,EAAE,kDAAkD;YAC5D,WAAW,EACT,8GAA8G;YAChH,mBAAmB,EACjB,gFAAgF;YAClF,UAAU,EACR,2GAA2G;SAC9G;QACD;YACE,QAAQ,EAAE,0BAA0B;YACpC,WAAW,EACT,uGAAuG;YACzG,mBAAmB,EAAE,6DAA6D;YAClF,UAAU,EAAE,wDAAwD;SACrE;KACF;IACD,aAAa,EAAE;QACb;YACE,QAAQ,EAAE,2CAA2C;YACrD,WAAW,EACT,mJAAmJ;YACrJ,mBAAmB,EACjB,8EAA8E;YAChF,UAAU,EACR,yFAAyF;SAC5F;QACD;YACE,QAAQ,EAAE,mCAAmC;YAC7C,WAAW,EAAE,+EAA+E;YAC5F,mBAAmB,EAAE,qEAAqE;YAC1F,UAAU,EACR,mFAAmF;SACtF;KACF;IACD,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,yCAAyC;YACnD,WAAW,EACT,kGAAkG;YACpG,mBAAmB,EAAE,qEAAqE;YAC1F,UAAU,EAAE,6DAA6D;SAC1E;QACD;YACE,QAAQ,EAAE,8CAA8C;YACxD,WAAW,EACT,2GAA2G;YAC7G,mBAAmB,EAAE,sDAAsD;YAC3E,UAAU,EAAE,8EAA8E;SAC3F;QACD;YACE,QAAQ,EAAE,mCAAmC;YAC7C,WAAW,EACT,+FAA+F;YACjG,mBAAmB,EAAE,0CAA0C;YAC/D,UAAU,EAAE,0DAA0D;SACvE;QACD;YACE,QAAQ,EAAE,qBAAqB;YAC/B,WAAW,EACT,iLAAiL;YACnL,mBAAmB,EAAE,kDAAkD;YACvE,UAAU,EACR,kFAAkF;SACrF;KACF;CACF,CAAC"}

package/dist/data/waf-bypass/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/data/waf-bypass/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wDAAwD;AACxD,eAAO,MAAM,cAAc,EAAE,aAAa,EA6PzC,CAAC;AAEF,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAIzF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/data/waf-bypass/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wDAAwD;AACxD,eAAO,MAAM,cAAc,EAAE,aAAa,EA8PzC,CAAC;AAEF,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAIzF"}

package/dist/data/waf-bypass/index.js

@@ -32,7 +32,9 @@ export const wafBypassNotes = [
     {
         waf: 'cloudflare',
         category: 'cmd_injection',
-        technique: "Bash brace expansion ({ls,/etc/passwd}), IFS substitution (${IFS}), and $() command substitution may evade keyword-based filters. Hex-encoded command strings passed through $'\\x6c\\x73' bypass literal pattern matching.",
+        technique: 
+        // biome-ignore lint/suspicious/noTemplateCurlyInString: literal shell syntax, not interpolation
+        "Bash brace expansion ({ls,/etc/passwd}), IFS substitution (${IFS}), and $() command substitution may evade keyword-based filters. Hex-encoded command strings passed through $'\\x6c\\x73' bypass literal pattern matching.",
         reference: 'Public command injection bypass research — HackerOne disclosed reports',
     },
     {

package/dist/data/waf-bypass/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/data/waf-bypass/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,wDAAwD;AACxD,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,iFAAiF;IACjF;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,8LAA8L;QAChM,SAAS,EAAE,mEAAmE;KAC/E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,iMAAiM;QACnM,SAAS,EAAE,gEAAgE;KAC5E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,6LAA6L;QAC/L,SAAS,EACP,uFAAuF;KAC1F;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,+QAA+Q;QACjR,SAAS,EAAE,mFAAmF;KAC/F;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,eAAe;QACzB,SAAS,EACP,6NAA6N;QAC/N,SAAS,EAAE,wEAAwE;KACpF;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,oNAAoN;QACtN,SAAS,EAAE,iEAAiE;KAC7E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,eAAe;QACzB,SAAS,EACP,qPAAqP;QACvP,SAAS,EAAE,oFAAoF;KAChG;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,6LAA6L;QAC/L,SAAS,EAAE,4EAA4E;KACxF;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,kOAAkO;QACpO,SAAS,EAAE,gDAAgD;KAC5D;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,kQAAkQ;QACpQ,SAAS,EAAE,gFAAgF;KAC5F;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,kPAAkP;QACpP,SAAS,EAAE,sEAAsE;KAClF;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,eAAe;QACzB,SAAS,EACP,iPAAiP;QACnP,SAAS,EAAE,mEAAmE;KAC/E;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,6OAA6O;QAC/O,SAAS,EAAE,gEAAgE;KAC5E;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,2MAA2M;QAC7M,SAAS,EAAE,2DAA2D;KACvE;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,yMAAyM;QAC3M,SAAS,EAAE,4CAA4C;KACxD;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,uSAAuS;QACzS,SAAS,EAAE,sEAAsE;KAClF;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,eAAe;QACzB,SAAS,EACP,2QAA2Q;QAC7Q,SAAS,EAAE,mEAAmE;KAC/E;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,yOAAyO;QAC3O,SAAS,EAAE,2DAA2D;KACvE;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,4MAA4M;QAC9M,SAAS,EAAE,+DAA+D;KAC3E;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,yUAAyU;QAC3U,SAAS,EAAE,4EAA4E;KACxF;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,0QAA0Q;QAC5Q,SAAS,EAAE,6DAA6D;KACzE;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,iRAAiR;QACnR,SAAS,EAAE,oEAAoE;KAChF;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,wMAAwM;QAC1M,SAAS,EAAE,mCAAmC;KAC/C;IACD;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,sQAAsQ;QACxQ,SAAS,EAAE,0EAA0E;KACtF;IACD;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,6OAA6O;QAC/O,SAAS,EAAE,0DAA0D;KACtE;IACD;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,yPAAyP;QAC3P,SAAS,EAAE,gEAAgE;KAC5E;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,uTAAuT;QACzT,SAAS,EACP,qGAAqG;KACxG;IACD;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,wUAAwU;QAC1U,SAAS,EAAE,oFAAoF;KAChG;IACD;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,qRAAqR;QACvR,SAAS,EAAE,kFAAkF;KAC9F;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,2QAA2Q;QAC7Q,SAAS,EACP,sGAAsG;KACzG;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,yUAAyU;QAC3U,SAAS,EACP,qFAAqF;KACxF;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,2RAA2R;QAC7R,SAAS,EACP,0GAA0G;KAC7G;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,8UAA8U;QAChV,SAAS,EACP,2GAA2G;KAC9G;CACF,CAAC;AAEF,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,QAAgB;IAC5D,OAAO,cAAc,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,WAAW,EAAE,CAC5E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/data/waf-bypass/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,wDAAwD;AACxD,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,iFAAiF;IACjF;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,8LAA8L;QAChM,SAAS,EAAE,mEAAmE;KAC/E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,iMAAiM;QACnM,SAAS,EAAE,gEAAgE;KAC5E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,6LAA6L;QAC/L,SAAS,EACP,uFAAuF;KAC1F;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,+QAA+Q;QACjR,SAAS,EAAE,mFAAmF;KAC/F;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,eAAe;QACzB,SAAS;QACP,gGAAgG;QAChG,6NAA6N;QAC/N,SAAS,EAAE,wEAAwE;KACpF;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,oNAAoN;QACtN,SAAS,EAAE,iEAAiE;KAC7E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,eAAe;QACzB,SAAS,EACP,qPAAqP;QACvP,SAAS,EAAE,oFAAoF;KAChG;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,6LAA6L;QAC/L,SAAS,EAAE,4EAA4E;KACxF;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,kOAAkO;QACpO,SAAS,EAAE,gDAAgD;KAC5D;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,kQAAkQ;QACpQ,SAAS,EAAE,gFAAgF;KAC5F;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,kPAAkP;QACpP,SAAS,EAAE,sEAAsE;KAClF;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,eAAe;QACzB,SAAS,EACP,iPAAiP;QACnP,SAAS,EAAE,mEAAmE;KAC/E;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,6OAA6O;QAC/O,SAAS,EAAE,gEAAgE;KAC5E;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,2MAA2M;QAC7M,SAAS,EAAE,2DAA2D;KACvE;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,yMAAyM;QAC3M,SAAS,EAAE,4CAA4C;KACxD;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,uSAAuS;QACzS,SAAS,EAAE,sEAAsE;KAClF;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,eAAe;QACzB,SAAS,EACP,2QAA2Q;QAC7Q,SAAS,EAAE,mEAAmE;KAC/E;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,yOAAyO;QAC3O,SAAS,EAAE,2DAA2D;KACvE;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,4MAA4M;QAC9M,SAAS,EAAE,+DAA+D;KAC3E;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,yUAAyU;QAC3U,SAAS,EAAE,4EAA4E;KACxF;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,0QAA0Q;QAC5Q,SAAS,EAAE,6DAA6D;KACzE;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,iRAAiR;QACnR,SAAS,EAAE,oEAAoE;KAChF;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,wMAAwM;QAC1M,SAAS,EAAE,mCAAmC;KAC/C;IACD;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,sQAAsQ;QACxQ,SAAS,EAAE,0EAA0E;KACtF;IACD;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,6OAA6O;QAC/O,SAAS,EAAE,0DAA0D;KACtE;IACD;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,yPAAyP;QAC3P,SAAS,EAAE,gEAAgE;KAC5E;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,uTAAuT;QACzT,SAAS,EACP,qGAAqG;KACxG;IACD;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,wUAAwU;QAC1U,SAAS,EAAE,oFAAoF;KAChG;IACD;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,qRAAqR;QACvR,SAAS,EAAE,kFAAkF;KAC9F;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,2QAA2Q;QAC7Q,SAAS,EACP,sGAAsG;KACzG;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,yUAAyU;QAC3U,SAAS,EACP,qFAAqF;KACxF;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,2RAA2R;QAC7R,SAAS,EACP,0GAA0G;KAC7G;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,8UAA8U;QAChV,SAAS,EACP,2GAA2G;KAC9G;CACF,CAAC;AAEF,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,QAAgB;IAC5D,OAAO,cAAc,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,WAAW,EAAE,CAC5E,CAAC;AACJ,CAAC"}

package/dist/mcp-server/tools/definitions/pentest-analyze-response.tool.d.ts

@@ -13,22 +13,22 @@ export declare const pentestAnalyzeResponseTool: import("@cyanheads/mcp-ts-core"
     authorized_use_reminder: z.ZodString;
     findings: z.ZodArray<z.ZodObject<{
         category: z.ZodEnum<{
-            version_disclosure: "version_disclosure";
-            stack_trace: "stack_trace";
-            internal_path: "internal_path";
-            debug_header: "debug_header";
-            technology_fingerprint: "technology_fingerprint";
             auth_pattern: "auth_pattern";
             cors_misconfiguration: "cors_misconfiguration";
-            security_header_missing: "security_header_missing";
-            interesting_field: "interesting_field";
+            debug_header: "debug_header";
             error_message: "error_message";
+            interesting_field: "interesting_field";
+            internal_path: "internal_path";
+            security_header_missing: "security_header_missing";
+            stack_trace: "stack_trace";
+            technology_fingerprint: "technology_fingerprint";
+            version_disclosure: "version_disclosure";
         }>;
         severity: z.ZodEnum<{
+            high: "high";
             info: "info";
             low: "low";
             medium: "medium";
-            high: "high";
         }>;
         finding: z.ZodString;
         significance: z.ZodString;

package/dist/mcp-server/tools/definitions/pentest-analyze-response.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pentest-analyze-response.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-analyze-response.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAMjE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAiOrC,CAAC"}
+{"version":3,"file":"pentest-analyze-response.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-analyze-response.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAMjE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAyNrC,CAAC"}

package/dist/mcp-server/tools/definitions/pentest-analyze-response.tool.js

@@ -8,19 +8,19 @@ import { getResponseAnalysisService } from '../../../services/response-analysis/
 const AUTHORIZED_USE_REMINDER = 'AUTHORIZED TESTING ONLY: Response analysis is for systems you own or are explicitly authorized to test. Findings from this tool support authorized penetration testing and security research only.';
 export const pentestAnalyzeResponseTool = tool('pentest_analyze_response', {
     title: 'Pentest Analyze Response',
-    description: 'Analyze a server response from authorized probing for information leakage, fingerprinting signals, and exploitation opportunities scoped to the authorized engagement. Accepts raw HTTP response headers and body (paste from Burp, curl, or any HTTP client) and returns structured findings grouped by category. Each finding includes: what was detected, why it matters for an authorized tester, how a defender detects misuse, and recommended remediation. Identifies version disclosures, stack traces, debug headers, internal paths, JWT/cookie patterns, CORS misconfigurations, and other common leakage patterns. Use as the bridge between recon/probing output and the methodology and payload tools.',
+    description: 'Analyze an HTTP response from authorized probing for information leakage, fingerprinting signals, and related exposure. Structured findings cover version disclosures, stack traces, debug headers, internal paths, authentication patterns, CORS configuration, detection signals, remediation, and associated methodology vectors.',
     annotations: { readOnlyHint: true, openWorldHint: false, idempotentHint: true },
     input: z.object({
         response_headers: z
             .string()
             .max(20000)
             .optional()
-            .describe('Raw HTTP response headers (paste from Burp, curl -v, or similar). Include the status line if available. Max 20,000 characters.'),
+            .describe('Raw HTTP response headers, optionally including the status line. Maximum 20,000 characters.'),
         response_body: z
             .string()
             .max(10000)
             .optional()
-            .describe('Response body text. Paste raw HTML, JSON, XML, or error text. Truncate to the first 10,000 characters for very large responses — the first portion carries most leakage signals.'),
+            .describe('Raw HTML, JSON, XML, or error response body text. Maximum 10,000 characters.'),
         status_code: z
             .number()
             .int()
@@ -66,7 +66,7 @@ export const pentestAnalyzeResponseTool = tool('pentest_analyze_response', {
                 .describe('Why this finding matters for an authorized penetration test.'),
             detection: z
                 .string()
-                .describe('How a defender or SIEM would detect exploitation of this finding.'),
+                .describe('Observable signals associated with exploitation of this finding.'),
             remediation: z.string().describe('Recommended fix for the target application.'),
             suggested_vector: z
                 .string()
@@ -95,23 +95,23 @@ export const pentestAnalyzeResponseTool = tool('pentest_analyze_response', {
                 .array(z.string().describe('A technology signal.'))
                 .describe('Other technology signals detected.'),
         })
-            .describe('Technology fingerprinting summary for use in target_context when calling pentest_guide or pentest_map_techniques.'),
+            .describe('Detected server, framework, language, database, cloud, and other technology signals.'),
         summary: z
             .string()
-            .describe('One-paragraph summary of findings and recommended next steps for the authorized tester.'),
+            .describe('One-paragraph summary of findings and associated follow-up actions.'),
         nextToolSuggestions: z
             .array(z
             .object({
-            toolName: z.string().describe('Tool name to call next (e.g., "pentest_guide").'),
+            toolName: z.string().describe('Suggested tool name (e.g., "pentest_guide").'),
             reason: z
                 .string()
-                .describe('Why this tool is the logical next step given the analysis findings.'),
+                .describe('Relationship between the analysis findings and the suggested tool.'),
             args: z
                 .record(z.string(), z.unknown())
-                .describe('Pre-filled arguments derived from detected fingerprints and findings. Pass directly to the suggested tool.'),
+                .describe('Arguments derived from detected fingerprints and findings.'),
         })
-            .describe('A suggested follow-up tool call with pre-filled arguments.'))
-            .describe('Suggested next tool calls — typically pentest_guide with fingerprint-populated stack, or pentest_generate_payloads for directly exploitable findings.'),
+            .describe('A suggested tool with arguments derived from the analysis.'))
+            .describe('Suggested tools derived from detected fingerprints and findings.'),
     }),
     errors: [
         {
@@ -123,7 +123,7 @@ export const pentestAnalyzeResponseTool = tool('pentest_analyze_response', {
     ],
     handler(input, ctx) {
         if (!input.response_headers && !input.response_body) {
-            throw ctx.fail('no_input', 'At least one of response_headers or response_body must be provided.', {});
+            throw ctx.fail('no_input', 'At least one of response_headers or response_body must be provided.', ctx.recoveryFor('no_input'));
         }
         const svc = getResponseAnalysisService();
         const result = svc.analyze(input.response_headers, input.response_body, input.status_code, input.context, ctx);

package/dist/mcp-server/tools/definitions/pentest-analyze-response.tool.js.map

@@ -1 +1 @@
-{"version":3,"file":"pentest-analyze-response.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-analyze-response.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAEvG,MAAM,uBAAuB,GAC3B,oMAAoM,CAAC;AAEvM,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC,0BAA0B,EAAE;IACzE,KAAK,EAAE,0BAA0B;IACjC,WAAW,EACT,srBAAsrB;IACxrB,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,gBAAgB,EAAE,CAAC;aAChB,MAAM,EAAE;aACR,GAAG,CAAC,KAAK,CAAC;aACV,QAAQ,EAAE;aACV,QAAQ,CACP,gIAAgI,CACjI;QACH,aAAa,EAAE,CAAC;aACb,MAAM,EAAE;aACR,GAAG,CAAC,KAAK,CAAC;aACV,QAAQ,EAAE;aACV,QAAQ,CACP,kLAAkL,CACnL;QACH,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,GAAG,CAAC;aACR,GAAG,CAAC,GAAG,CAAC;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,+DAA+D,CAAC;QAC5E,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,GAAG,CAAC,IAAI,CAAC;aACT,QAAQ,EAAE;aACV,QAAQ,CACP,8LAA8L,CAC/L;KACJ,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,CAAC,iFAAiF,CAAC;QAC9F,QAAQ,EAAE,CAAC;aACR,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC;gBACJ,oBAAoB;gBACpB,aAAa;gBACb,eAAe;gBACf,cAAc;gBACd,wBAAwB;gBACxB,cAAc;gBACd,uBAAuB;gBACvB,yBAAyB;gBACzB,mBAAmB;gBACnB,eAAe;aAChB,CAAC;iBACD,QAAQ,CACP,6fAA6f,CAC9f;YACH,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;iBACvC,QAAQ,CACP,mKAAmK,CACpK;YACH,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,QAAQ,CACP,kGAAkG,CACnG;YACH,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,QAAQ,CAAC,8DAA8D,CAAC;YAC3E,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,QAAQ,CAAC,mEAAmE,CAAC;YAChF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;YAC/E,gBAAgB,EAAE,CAAC;iBAChB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,kIAAkI,CACnI;SACJ,CAAC;aACD,QAAQ,CAAC,6CAA6C,CAAC,CAC3D;aACA,QAAQ,CAAC,kEAAkE,CAAC;QAC/E,YAAY,EAAE,CAAC;aACZ,MAAM,CAAC;YACN,eAAe,EAAE,CAAC;iBACf,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,6EAA6E,CAAC;YAC1F,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,qEAAqE,CAAC;YAClF,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,4DAA4D,CAAC;YACzE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;YACtF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YACjF,KAAK,EAAE,CAAC;iBACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;iBAClD,QAAQ,CAAC,oCAAoC,CAAC;SAClD,CAAC;aACD,QAAQ,CACP,mHAAmH,CACpH;QACH,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,QAAQ,CACP,yFAAyF,CAC1F;QACH,mBAAmB,EAAE,CAAC;aACnB,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;YAChF,MAAM,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,QAAQ,CAAC,qEAAqE,CAAC;YAClF,IAAI,EAAE,CAAC;iBACJ,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC/B,QAAQ,CACP,4GAA4G,CAC7G;SACJ,CAAC;aACD,QAAQ,CAAC,4DAA4D,CAAC,CAC1E;aACA,QAAQ,CACP,uJAAuJ,CACxJ;KACJ,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,gBAAgB,CAAC,eAAe;YACtC,IAAI,EAAE,0DAA0D;YAChE,QAAQ,EAAE,uEAAuE;SAClF;KACF;IAED,OAAO,CAAC,KAAK,EAAE,GAAG;QAChB,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YACpD,MAAM,GAAG,CAAC,IAAI,CACZ,UAAU,EACV,qEAAqE,EACrE,EAAE,CACH,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,0BAA0B,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CACxB,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,OAAO,EACb,GAAG,CACJ,CAAC;QAEF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE;YACjD,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;YACpC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;SACvE,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,MAAM,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa,CAAC,QAAQ,MAAM,CAAC,uBAAuB,EAAE,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAC9F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAChC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACf,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,eAAe,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACxF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;gBAClD,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBAChD,IAAI,CAAC,CAAC,gBAAgB;oBAAE,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;QAC/B,MAAM,SAAS,GAAG;YAChB,EAAE,CAAC,eAAe,IAAI,WAAW,EAAE,CAAC,eAAe,EAAE;YACrD,EAAE,CAAC,SAAS,IAAI,cAAc,EAAE,CAAC,SAAS,EAAE;YAC5C,EAAE,CAAC,QAAQ,IAAI,aAAa,EAAE,CAAC,QAAQ,EAAE;YACzC,EAAE,CAAC,QAAQ,IAAI,aAAa,EAAE,CAAC,QAAQ,EAAE;YACzC,EAAE,CAAC,cAAc,IAAI,UAAU,EAAE,CAAC,cAAc,EAAE;YAClD,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;SACtC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAElB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,MAAM,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBAC3C,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,KAAK,CAAC,IAAI,CACR,WAAW,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"pentest-analyze-response.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-analyze-response.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAEvG,MAAM,uBAAuB,GAC3B,oMAAoM,CAAC;AAEvM,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC,0BAA0B,EAAE;IACzE,KAAK,EAAE,0BAA0B;IACjC,WAAW,EACT,sUAAsU;IACxU,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,gBAAgB,EAAE,CAAC;aAChB,MAAM,EAAE;aACR,GAAG,CAAC,KAAK,CAAC;aACV,QAAQ,EAAE;aACV,QAAQ,CACP,6FAA6F,CAC9F;QACH,aAAa,EAAE,CAAC;aACb,MAAM,EAAE;aACR,GAAG,CAAC,KAAK,CAAC;aACV,QAAQ,EAAE;aACV,QAAQ,CAAC,8EAA8E,CAAC;QAC3F,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,GAAG,CAAC;aACR,GAAG,CAAC,GAAG,CAAC;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,+DAA+D,CAAC;QAC5E,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,GAAG,CAAC,IAAI,CAAC;aACT,QAAQ,EAAE;aACV,QAAQ,CACP,8LAA8L,CAC/L;KACJ,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,CAAC,iFAAiF,CAAC;QAC9F,QAAQ,EAAE,CAAC;aACR,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC;gBACJ,oBAAoB;gBACpB,aAAa;gBACb,eAAe;gBACf,cAAc;gBACd,wBAAwB;gBACxB,cAAc;gBACd,uBAAuB;gBACvB,yBAAyB;gBACzB,mBAAmB;gBACnB,eAAe;aAChB,CAAC;iBACD,QAAQ,CACP,6fAA6f,CAC9f;YACH,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;iBACvC,QAAQ,CACP,mKAAmK,CACpK;YACH,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,QAAQ,CACP,kGAAkG,CACnG;YACH,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,QAAQ,CAAC,8DAA8D,CAAC;YAC3E,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,QAAQ,CAAC,kEAAkE,CAAC;YAC/E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;YAC/E,gBAAgB,EAAE,CAAC;iBAChB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,kIAAkI,CACnI;SACJ,CAAC;aACD,QAAQ,CAAC,6CAA6C,CAAC,CAC3D;aACA,QAAQ,CAAC,kEAAkE,CAAC;QAC/E,YAAY,EAAE,CAAC;aACZ,MAAM,CAAC;YACN,eAAe,EAAE,CAAC;iBACf,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,6EAA6E,CAAC;YAC1F,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,qEAAqE,CAAC;YAClF,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,4DAA4D,CAAC;YACzE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;YACtF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YACjF,KAAK,EAAE,CAAC;iBACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;iBAClD,QAAQ,CAAC,oCAAoC,CAAC;SAClD,CAAC;aACD,QAAQ,CACP,sFAAsF,CACvF;QACH,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,QAAQ,CAAC,qEAAqE,CAAC;QAClF,mBAAmB,EAAE,CAAC;aACnB,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;YAC7E,MAAM,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,QAAQ,CAAC,oEAAoE,CAAC;YACjF,IAAI,EAAE,CAAC;iBACJ,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC/B,QAAQ,CAAC,4DAA4D,CAAC;SAC1E,CAAC;aACD,QAAQ,CAAC,4DAA4D,CAAC,CAC1E;aACA,QAAQ,CAAC,kEAAkE,CAAC;KAChF,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,gBAAgB,CAAC,eAAe;YACtC,IAAI,EAAE,0DAA0D;YAChE,QAAQ,EAAE,uEAAuE;SAClF;KACF;IAED,OAAO,CAAC,KAAK,EAAE,GAAG;QAChB,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YACpD,MAAM,GAAG,CAAC,IAAI,CACZ,UAAU,EACV,qEAAqE,EACrE,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,CAC5B,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,0BAA0B,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CACxB,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,OAAO,EACb,GAAG,CACJ,CAAC;QAEF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE;YACjD,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;YACpC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;SACvE,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,MAAM,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa,CAAC,QAAQ,MAAM,CAAC,uBAAuB,EAAE,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAC9F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAChC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACf,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,eAAe,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACxF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;gBAClD,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBAChD,IAAI,CAAC,CAAC,gBAAgB;oBAAE,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;QAC/B,MAAM,SAAS,GAAG;YAChB,EAAE,CAAC,eAAe,IAAI,WAAW,EAAE,CAAC,eAAe,EAAE;YACrD,EAAE,CAAC,SAAS,IAAI,cAAc,EAAE,CAAC,SAAS,EAAE;YAC5C,EAAE,CAAC,QAAQ,IAAI,aAAa,EAAE,CAAC,QAAQ,EAAE;YACzC,EAAE,CAAC,QAAQ,IAAI,aAAa,EAAE,CAAC,QAAQ,EAAE;YACzC,EAAE,CAAC,cAAc,IAAI,UAAU,EAAE,CAAC,cAAc,EAAE;YAClD,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;SACtC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAElB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,MAAM,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBAC3C,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,KAAK,CAAC,IAAI,CACR,WAAW,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}

package/dist/mcp-server/tools/definitions/pentest-encode.tool.d.ts

@@ -7,16 +7,16 @@ import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
 export declare const pentestEncodeTool: import("@cyanheads/mcp-ts-core").ToolDefinition<z.ZodObject<{
     payload: z.ZodString;
     chain: z.ZodArray<z.ZodEnum<{
-        url: "url";
         base64: "base64";
+        comment_break: "comment_break";
         double_url: "double_url";
-        html_entity: "html_entity";
-        unicode: "unicode";
         hex: "hex";
+        html_entity: "html_entity";
         js_escape: "js_escape";
-        null_byte: "null_byte";
         mixed_case: "mixed_case";
-        comment_break: "comment_break";
+        null_byte: "null_byte";
+        unicode: "unicode";
+        url: "url";
     }>>;
     explain: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>, z.ZodObject<{

package/dist/mcp-server/tools/definitions/pentest-encode.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pentest-encode.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-encode.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAyJ5B,CAAC"}
+{"version":3,"file":"pentest-encode.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-encode.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAYjE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAyJ5B,CAAC"}

package/dist/mcp-server/tools/definitions/pentest-encode.tool.js

@@ -6,9 +6,14 @@ import { tool, z } from '@cyanheads/mcp-ts-core';
 import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
 import { getEncodingService } from '../../../services/encoding/encoding-service.js';
 const AUTHORIZED_USE_REMINDER = 'AUTHORIZED TESTING ONLY: Encoding transforms are for bypass research against systems you own or are explicitly authorized to test.';
+function textPreview(value, limit) {
+    if (value.length <= limit)
+        return value;
+    return `${value.slice(0, limit)}… [truncated in text; full value is available in structuredContent]`;
+}
 export const pentestEncodeTool = tool('pentest_encode', {
     title: 'Pentest Encode',
-    description: 'Transform a payload string through one or more encoding layers for bypass research during authorized testing. Accepts a chain of encodings applied in order (e.g., ["unicode", "url", "base64"] applies Unicode → URL-encode → base64). Returns the transformed payload with a step-by-step decoding explanation: how a WAF or server would decode each layer, and why the combined encoding might bypass a specific filter. Use to understand filter bypass mechanics in an authorized engagement and to confirm that a target\'s decoding pipeline matches an expected bypass path. Payloads are transformed mathematically — no live probing occurs.',
+    description: 'Transform a payload string through an ordered encoding chain for authorized filter research. Results include the final value, intermediate values, optional decode path and rationale, and detection guidance. All transforms are local; no live probing occurs.',
     annotations: { readOnlyHint: true, openWorldHint: false, idempotentHint: true },
     input: z.object({
         payload: z
@@ -37,7 +42,7 @@ export const pentestEncodeTool = tool('pentest_encode', {
         explain: z
             .boolean()
             .default(true)
-            .describe('Include step-by-step decode explanation. Set to false for raw transform output only.'),
+            .describe('Whether to include the decode path and bypass rationale.'),
     }),
     output: z.object({
         authorized_use_reminder: z
@@ -63,7 +68,7 @@ export const pentestEncodeTool = tool('pentest_encode', {
             .describe('Why this encoding combination might bypass common filter patterns. Included when explain is true.'),
         detection_note: z
             .string()
-            .describe('How defenders detect encoded payload variants — decoding normalizers, entropy analysis, behavioral detection. Always included to maintain the dual offense/defense framing.'),
+            .describe('Detection methods for encoded variants, including normalization and behavior signals.'),
     }),
     errors: [
         {
@@ -80,7 +85,7 @@ export const pentestEncodeTool = tool('pentest_encode', {
             result = svc.applyChain(input.payload, input.chain, input.explain, ctx);
         }
         catch (err) {
-            throw ctx.fail('encoding_error', `Encoding chain failed: ${err instanceof Error ? err.message : String(err)}`);
+            throw ctx.fail('encoding_error', `Encoding chain failed: ${err instanceof Error ? err.message : String(err)}`, ctx.recoveryFor('encoding_error'), { cause: err });
         }
         ctx.log.info('pentest_encode completed', {
             chain: input.chain,
@@ -103,15 +108,15 @@ export const pentestEncodeTool = tool('pentest_encode', {
             '',
             '# Encoding Result',
             '',
-            `**Original:** \`${result.original.slice(0, 200)}\``,
+            `**Original:** \`${textPreview(result.original, 200)}\``,
             '',
-            `**Encoded:** \`${result.encoded.slice(0, 500)}\``,
+            `**Encoded:** \`${textPreview(result.encoded, 500)}\``,
             '',
         ];
         if (result.intermediate_steps.length > 0) {
             lines.push('## Encoding Steps');
             for (const step of result.intermediate_steps) {
-                lines.push(`- **${step.encoding}:** \`${step.result.slice(0, 200)}\``);
+                lines.push(`- **${step.encoding}:** \`${textPreview(step.result, 200)}\``);
             }
             lines.push('');
         }

package/dist/mcp-server/tools/definitions/pentest-encode.tool.js.map

@@ -1 +1 @@
-{"version":3,"file":"pentest-encode.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-encode.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAE7E,MAAM,uBAAuB,GAC3B,oIAAoI,CAAC;AAEvI,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,EAAE;IACtD,KAAK,EAAE,gBAAgB;IACvB,WAAW,EACT,ynBAAynB;IAC3nB,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,KAAK,CAAC;aACV,QAAQ,CAAC,wDAAwD,CAAC;QACrE,KAAK,EAAE,CAAC;aACL,KAAK,CACJ,CAAC;aACE,IAAI,CAAC;YACJ,KAAK;YACL,YAAY;YACZ,aAAa;YACb,SAAS;YACT,KAAK;YACL,QAAQ;YACR,WAAW;YACX,WAAW;YACX,YAAY;YACZ,eAAe;SAChB,CAAC;aACD,QAAQ,CAAC,mBAAmB,CAAC,CACjC;aACA,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CACP,4JAA4J,CAC7J;QACH,OAAO,EAAE,CAAC;aACP,OAAO,EAAE;aACT,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CACP,sFAAsF,CACvF;KACJ,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,CAAC,4EAA4E,CAAC;QACzF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;QACpF,kBAAkB,EAAE,CAAC;aAClB,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YACpE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;SACvE,CAAC;aACD,QAAQ,CAAC,iDAAiD,CAAC,CAC/D;aACA,QAAQ,CAAC,mEAAmE,CAAC;QAChF,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,mIAAmI,CACpI;QACH,gBAAgB,EAAE,CAAC;aAChB,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,mGAAmG,CACpG;QACH,cAAc,EAAE,CAAC;aACd,MAAM,EAAE;aACR,QAAQ,CACP,6KAA6K,CAC9K;KACJ,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,gBAAgB;YACxB,IAAI,EAAE,gBAAgB,CAAC,eAAe;YACtC,IAAI,EAAE,2EAA2E;YACjF,QAAQ,EACN,iGAAiG;SACpG;KACF;IAED,OAAO,CAAC,KAAK,EAAE,GAAG;QAChB,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;QAEjC,IAAI,MAAyC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAuB,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,CAAC,IAAI,CACZ,gBAAgB,EAChB,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7E,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE;YACvC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YACpC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;SACrC,CAAC,CAAC;QAEH,OAAO;YACL,uBAAuB,EAAE,uBAAuB;YAChD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa;YACtB,QAAQ,MAAM,CAAC,uBAAuB,EAAE;YACxC,EAAE;YACF,mBAAmB;YACnB,EAAE;YACF,mBAAmB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI;YACpD,EAAE;YACF,kBAAkB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI;YAClD,EAAE;SACH,CAAC;QAEF,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACzE,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC/D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAElC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"pentest-encode.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-encode.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAE7E,MAAM,uBAAuB,GAC3B,oIAAoI,CAAC;AAEvI,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa;IAC/C,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,qEAAqE,CAAC;AACvG,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,EAAE;IACtD,KAAK,EAAE,gBAAgB;IACvB,WAAW,EACT,kQAAkQ;IACpQ,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,KAAK,CAAC;aACV,QAAQ,CAAC,wDAAwD,CAAC;QACrE,KAAK,EAAE,CAAC;aACL,KAAK,CACJ,CAAC;aACE,IAAI,CAAC;YACJ,KAAK;YACL,YAAY;YACZ,aAAa;YACb,SAAS;YACT,KAAK;YACL,QAAQ;YACR,WAAW;YACX,WAAW;YACX,YAAY;YACZ,eAAe;SAChB,CAAC;aACD,QAAQ,CAAC,mBAAmB,CAAC,CACjC;aACA,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CACP,4JAA4J,CAC7J;QACH,OAAO,EAAE,CAAC;aACP,OAAO,EAAE;aACT,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CAAC,0DAA0D,CAAC;KACxE,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,CAAC,4EAA4E,CAAC;QACzF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;QACpF,kBAAkB,EAAE,CAAC;aAClB,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YACpE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;SACvE,CAAC;aACD,QAAQ,CAAC,iDAAiD,CAAC,CAC/D;aACA,QAAQ,CAAC,mEAAmE,CAAC;QAChF,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,mIAAmI,CACpI;QACH,gBAAgB,EAAE,CAAC;aAChB,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,mGAAmG,CACpG;QACH,cAAc,EAAE,CAAC;aACd,MAAM,EAAE;aACR,QAAQ,CACP,uFAAuF,CACxF;KACJ,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,gBAAgB;YACxB,IAAI,EAAE,gBAAgB,CAAC,eAAe;YACtC,IAAI,EAAE,2EAA2E;YACjF,QAAQ,EACN,iGAAiG;SACpG;KACF;IAED,OAAO,CAAC,KAAK,EAAE,GAAG;QAChB,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;QAEjC,IAAI,MAAyC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAuB,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,CAAC,IAAI,CACZ,gBAAgB,EAChB,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC5E,GAAG,CAAC,WAAW,CAAC,gBAAgB,CAAC,EACjC,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE;YACvC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YACpC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;SACrC,CAAC,CAAC;QAEH,OAAO;YACL,uBAAuB,EAAE,uBAAuB;YAChD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa;YACtB,QAAQ,MAAM,CAAC,uBAAuB,EAAE;YACxC,EAAE;YACF,mBAAmB;YACnB,EAAE;YACF,mBAAmB,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI;YACxD,EAAE;YACF,kBAAkB,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI;YACtD,EAAE;SACH,CAAC;QAEF,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,SAAS,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7E,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC/D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAElC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}

package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.d.ts

@@ -3,63 +3,62 @@
  * @module mcp-server/tools/definitions/pentest-generate-payloads.tool
  */
 import { z } from '@cyanheads/mcp-ts-core';
-import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
 export declare const pentestGeneratePayloadsTool: import("@cyanheads/mcp-ts-core").ToolDefinition<z.ZodObject<{
     category: z.ZodEnum<{
-        path_traversal: "path_traversal";
-        xss: "xss";
-        csrf: "csrf";
-        sqli: "sqli";
-        jwt: "jwt";
-        http_header: "http_header";
-        ssrf: "ssrf";
-        xxe: "xxe";
-        ssti: "ssti";
         command_injection: "command_injection";
-        open_redirect: "open_redirect";
+        csrf: "csrf";
         deserialization: "deserialization";
+        http_header: "http_header";
+        jwt: "jwt";
         ldap_injection: "ldap_injection";
         nosql_injection: "nosql_injection";
+        open_redirect: "open_redirect";
+        path_traversal: "path_traversal";
+        sqli: "sqli";
+        ssrf: "ssrf";
+        ssti: "ssti";
+        xss: "xss";
+        xxe: "xxe";
     }>;
     injection_context: z.ZodEnum<{
-        sql_where: "sql_where";
-        url_parameter: "url_parameter";
+        cookie_value: "cookie_value";
         file_name: "file_name";
         generic: "generic";
-        http_header: "http_header";
-        json_value: "json_value";
-        url_path: "url_path";
-        sql_integer: "sql_integer";
-        html_body: "html_body";
         html_attribute: "html_attribute";
+        html_body: "html_body";
+        http_header: "http_header";
+        js_script_block: "js_script_block";
         js_string: "js_string";
         js_template: "js_template";
-        js_script_block: "js_script_block";
-        xml_element: "xml_element";
+        json_value: "json_value";
+        sql_integer: "sql_integer";
+        sql_where: "sql_where";
+        url_parameter: "url_parameter";
+        url_path: "url_path";
         xml_attribute: "xml_attribute";
-        cookie_value: "cookie_value";
+        xml_element: "xml_element";
     }>;
     waf_profile: z.ZodDefault<z.ZodEnum<{
-        cloudflare: "cloudflare";
-        unknown: "unknown";
-        aws_waf: "aws_waf";
-        modsecurity_crs: "modsecurity_crs";
-        imperva: "imperva";
         akamai: "akamai";
+        aws_waf: "aws_waf";
+        cloudflare: "cloudflare";
         f5_bigip_asm: "f5_bigip_asm";
-        nginx_modsecurity: "nginx_modsecurity";
         fortinet_fortiwaf: "fortinet_fortiwaf";
+        imperva: "imperva";
+        modsecurity_crs: "modsecurity_crs";
+        nginx_modsecurity: "nginx_modsecurity";
         none: "none";
+        unknown: "unknown";
     }>>;
     encoding: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        url: "url";
         base64: "base64";
         double_url: "double_url";
-        html_entity: "html_entity";
-        unicode: "unicode";
         hex: "hex";
+        html_entity: "html_entity";
         js_escape: "js_escape";
         none: "none";
+        unicode: "unicode";
+        url: "url";
     }>>>;
     count: z.ZodDefault<z.ZodNumber>;
 }, z.core.$strip>, z.ZodObject<{
@@ -74,10 +73,5 @@ export declare const pentestGeneratePayloadsTool: import("@cyanheads/mcp-ts-core
         waf_bypass_note: z.ZodOptional<z.ZodString>;
         encoded_variant: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
-}, z.core.$strip>, readonly [{
-    readonly reason: "no_payloads";
-    readonly code: JsonRpcErrorCode.NotFound;
-    readonly when: "No payload templates exist for the category + injection_context combination.";
-    readonly recovery: "Try injection_context: \"generic\" for broad templates, or a different category.";
-}], undefined>;
+}, z.core.$strip>, undefined, undefined>;
 //# sourceMappingURL=pentest-generate-payloads.tool.d.ts.map

package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pentest-generate-payloads.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-generate-payloads.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA4NtC,CAAC"}
+{"version":3,"file":"pentest-generate-payloads.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-generate-payloads.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAOjD,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wCAqMtC,CAAC"}

package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.js

@@ -3,12 +3,11 @@
  * @module mcp-server/tools/definitions/pentest-generate-payloads.tool
  */
 import { tool, z } from '@cyanheads/mcp-ts-core';
-import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
 import { getPayloadService } from '../../../services/payload/payload-service.js';
 const AUTHORIZED_USE_REMINDER = 'AUTHORIZED TESTING ONLY: These payload templates are for use against systems you own or are explicitly authorized to test. Adapt to your specific authorized target only.';
 export const pentestGeneratePayloadsTool = tool('pentest_generate_payloads', {
     title: 'Pentest Generate Payloads',
-    description: 'Generate payload templates for authorized testing against systems the tester owns or is permitted to test. Payloads are annotated templates — each includes why it works in the specified context, what vulnerability class it tests, detection signatures that WAF/IDS products might fire, and recommended mitigations. Context-awareness is core: an XSS payload for an HTML attribute differs entirely from one for a JS template literal, and both differ from a DOM-based sink. When a WAF profile is specified, bypass variants reference known public research for that WAF product. All payloads are illustrative templates for authorized testing only.',
+    description: 'Generate context-specific payload templates for authorized systems. Each template includes its vulnerability category, context rationale, WAF/IDS detection signature, mitigation, optional WAF research note, and optional encoded variant.',
     annotations: { readOnlyHint: true, openWorldHint: false, idempotentHint: true },
     input: z.object({
         category: z
@@ -78,7 +77,7 @@ export const pentestGeneratePayloadsTool = tool('pentest_generate_payloads', {
         ])
             .describe('An encoding step to apply.'))
             .optional()
-            .describe('Apply an encoding chain to payloads at generation time. Applied in order (left to right). Use pentest_encode for more control over per-payload encoding.'),
+            .describe('Optional encoding chain applied left to right to each returned template.'),
         count: z
             .number()
             .int()
@@ -104,10 +103,10 @@ export const pentestGeneratePayloadsTool = tool('pentest_generate_payloads', {
                 .describe('What this payload tests and why it works in the specified injection context.'),
             detection_signature: z
                 .string()
-                .describe('Signature a WAF or IDS might match (e.g., specific keywords, patterns). Useful for blue team rule-writing.'),
+                .describe('Signature a WAF or IDS might match, such as keywords or patterns.'),
             mitigation: z
                 .string()
-                .describe('How the target application should validate or encode input to prevent this class of payload.'),
+                .describe('Input validation or encoding control that prevents this payload class.'),
             waf_bypass_note: z
                 .string()
                 .optional()
@@ -120,22 +119,11 @@ export const pentestGeneratePayloadsTool = tool('pentest_generate_payloads', {
             .describe('A payload template annotated with offense context (what it tests, how it works) and defense context (detection signature, mitigation).'))
             .describe('Payload templates ordered by coverage breadth, each annotated with offense and defense context.'),
     }),
-    errors: [
-        {
-            reason: 'no_payloads',
-            code: JsonRpcErrorCode.NotFound,
-            when: 'No payload templates exist for the category + injection_context combination.',
-            recovery: 'Try injection_context: "generic" for broad templates, or a different category.',
-        },
-    ],
     handler(input, ctx) {
         const svc = getPayloadService();
         // Filter out 'none' from encoding chain
         const encodingChain = (input.encoding ?? []).filter((e) => e !== 'none');
         const payloads = svc.getPayloads(input.category, input.injection_context, input.waf_profile, encodingChain, input.count, ctx);
-        if (!payloads) {
-            throw ctx.fail('no_payloads', `No payload templates found for category "${input.category}" in context "${input.injection_context}".`);
-        }
         ctx.log.info('pentest_generate_payloads returned', {
             category: input.category,
             injectionContext: input.injection_context,
@@ -155,8 +143,7 @@ export const pentestGeneratePayloadsTool = tool('pentest_generate_payloads', {
             `# Payloads: ${result.category} / ${result.injection_context}`,
             '',
         ];
-        for (let i = 0; i < result.payloads.length; i++) {
-            const p = result.payloads[i];
+        for (const [i, p] of result.payloads.entries()) {
             lines.push(`## Payload ${i + 1}`);
             lines.push('```');
             lines.push(p.template);