@cyanheads/pentest-mcp-server 0.1.6 → 0.1.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AGENTS.md +40 -27
- package/CLAUDE.md +40 -27
- package/Dockerfile +14 -6
- package/LICENSE +1 -1
- package/README.md +5 -4
- package/changelog/0.1.x/0.1.7.md +37 -0
- package/changelog/0.1.x/0.1.8.md +11 -0
- package/changelog/template.md +60 -19
- package/dist/data/encodings/index.d.ts.map +1 -1
- package/dist/data/encodings/index.js +9 -6
- package/dist/data/encodings/index.js.map +1 -1
- package/dist/data/payloads/index.d.ts +1 -1
- package/dist/data/payloads/index.d.ts.map +1 -1
- package/dist/data/payloads/index.js +5 -3
- package/dist/data/payloads/index.js.map +1 -1
- package/dist/data/payloads/ssti.d.ts.map +1 -1
- package/dist/data/payloads/ssti.js +3 -0
- package/dist/data/payloads/ssti.js.map +1 -1
- package/dist/data/payloads/xss.d.ts.map +1 -1
- package/dist/data/payloads/xss.js +5 -1
- package/dist/data/payloads/xss.js.map +1 -1
- package/dist/data/waf-bypass/index.d.ts.map +1 -1
- package/dist/data/waf-bypass/index.js +3 -1
- package/dist/data/waf-bypass/index.js.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-analyze-response.tool.d.ts +8 -8
- package/dist/mcp-server/tools/definitions/pentest-analyze-response.tool.d.ts.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-analyze-response.tool.js +12 -12
- package/dist/mcp-server/tools/definitions/pentest-analyze-response.tool.js.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-encode.tool.d.ts +5 -5
- package/dist/mcp-server/tools/definitions/pentest-encode.tool.d.ts.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-encode.tool.js +12 -7
- package/dist/mcp-server/tools/definitions/pentest-encode.tool.js.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.d.ts +30 -36
- package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.d.ts.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.js +5 -18
- package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.js.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-guide.tool.d.ts +10 -16
- package/dist/mcp-server/tools/definitions/pentest-guide.tool.d.ts.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-guide.tool.js +16 -22
- package/dist/mcp-server/tools/definitions/pentest-guide.tool.js.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-lookup-group.tool.js +4 -6
- package/dist/mcp-server/tools/definitions/pentest-lookup-group.tool.js.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-lookup-technique.tool.d.ts.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-lookup-technique.tool.js +6 -8
- package/dist/mcp-server/tools/definitions/pentest-lookup-technique.tool.js.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-map-techniques.tool.d.ts +13 -9
- package/dist/mcp-server/tools/definitions/pentest-map-techniques.tool.d.ts.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-map-techniques.tool.js +19 -7
- package/dist/mcp-server/tools/definitions/pentest-map-techniques.tool.js.map +1 -1
- package/dist/mcp-server/tools/index.d.ts +174 -180
- package/dist/mcp-server/tools/index.d.ts.map +1 -1
- package/dist/services/attack/attack-service.d.ts.map +1 -1
- package/dist/services/attack/attack-service.js +18 -21
- package/dist/services/attack/attack-service.js.map +1 -1
- package/dist/services/encoding/encoding-service.d.ts.map +1 -1
- package/dist/services/methodology/methodology-service.d.ts +249 -1
- package/dist/services/methodology/methodology-service.d.ts.map +1 -1
- package/dist/services/methodology/methodology-service.js +7 -17
- package/dist/services/methodology/methodology-service.js.map +1 -1
- package/dist/services/payload/payload-service.d.ts +2 -2
- package/dist/services/payload/payload-service.d.ts.map +1 -1
- package/dist/services/payload/payload-service.js +1 -3
- package/dist/services/payload/payload-service.js.map +1 -1
- package/dist/services/response-analysis/response-analysis-service.d.ts.map +1 -1
- package/dist/services/response-analysis/response-analysis-service.js +1 -1
- package/dist/services/response-analysis/response-analysis-service.js.map +1 -1
- package/package.json +18 -18
- package/server.json +3 -3
|
@@ -3,12 +3,11 @@
|
|
|
3
3
|
* @module mcp-server/tools/definitions/pentest-generate-payloads.tool
|
|
4
4
|
*/
|
|
5
5
|
import { tool, z } from '@cyanheads/mcp-ts-core';
|
|
6
|
-
import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
|
|
7
6
|
import { getPayloadService } from '../../../services/payload/payload-service.js';
|
|
8
7
|
const AUTHORIZED_USE_REMINDER = 'AUTHORIZED TESTING ONLY: These payload templates are for use against systems you own or are explicitly authorized to test. Adapt to your specific authorized target only.';
|
|
9
8
|
export const pentestGeneratePayloadsTool = tool('pentest_generate_payloads', {
|
|
10
9
|
title: 'Pentest Generate Payloads',
|
|
11
|
-
description: 'Generate payload templates for authorized
|
|
10
|
+
description: 'Generate context-specific payload templates for authorized systems. Each template includes its vulnerability category, context rationale, WAF/IDS detection signature, mitigation, optional WAF research note, and optional encoded variant.',
|
|
12
11
|
annotations: { readOnlyHint: true, openWorldHint: false, idempotentHint: true },
|
|
13
12
|
input: z.object({
|
|
14
13
|
category: z
|
|
@@ -78,7 +77,7 @@ export const pentestGeneratePayloadsTool = tool('pentest_generate_payloads', {
|
|
|
78
77
|
])
|
|
79
78
|
.describe('An encoding step to apply.'))
|
|
80
79
|
.optional()
|
|
81
|
-
.describe('
|
|
80
|
+
.describe('Optional encoding chain applied left to right to each returned template.'),
|
|
82
81
|
count: z
|
|
83
82
|
.number()
|
|
84
83
|
.int()
|
|
@@ -104,10 +103,10 @@ export const pentestGeneratePayloadsTool = tool('pentest_generate_payloads', {
|
|
|
104
103
|
.describe('What this payload tests and why it works in the specified injection context.'),
|
|
105
104
|
detection_signature: z
|
|
106
105
|
.string()
|
|
107
|
-
.describe('Signature a WAF or IDS might match
|
|
106
|
+
.describe('Signature a WAF or IDS might match, such as keywords or patterns.'),
|
|
108
107
|
mitigation: z
|
|
109
108
|
.string()
|
|
110
|
-
.describe('
|
|
109
|
+
.describe('Input validation or encoding control that prevents this payload class.'),
|
|
111
110
|
waf_bypass_note: z
|
|
112
111
|
.string()
|
|
113
112
|
.optional()
|
|
@@ -120,22 +119,11 @@ export const pentestGeneratePayloadsTool = tool('pentest_generate_payloads', {
|
|
|
120
119
|
.describe('A payload template annotated with offense context (what it tests, how it works) and defense context (detection signature, mitigation).'))
|
|
121
120
|
.describe('Payload templates ordered by coverage breadth, each annotated with offense and defense context.'),
|
|
122
121
|
}),
|
|
123
|
-
errors: [
|
|
124
|
-
{
|
|
125
|
-
reason: 'no_payloads',
|
|
126
|
-
code: JsonRpcErrorCode.NotFound,
|
|
127
|
-
when: 'No payload templates exist for the category + injection_context combination.',
|
|
128
|
-
recovery: 'Try injection_context: "generic" for broad templates, or a different category.',
|
|
129
|
-
},
|
|
130
|
-
],
|
|
131
122
|
handler(input, ctx) {
|
|
132
123
|
const svc = getPayloadService();
|
|
133
124
|
// Filter out 'none' from encoding chain
|
|
134
125
|
const encodingChain = (input.encoding ?? []).filter((e) => e !== 'none');
|
|
135
126
|
const payloads = svc.getPayloads(input.category, input.injection_context, input.waf_profile, encodingChain, input.count, ctx);
|
|
136
|
-
if (!payloads) {
|
|
137
|
-
throw ctx.fail('no_payloads', `No payload templates found for category "${input.category}" in context "${input.injection_context}".`);
|
|
138
|
-
}
|
|
139
127
|
ctx.log.info('pentest_generate_payloads returned', {
|
|
140
128
|
category: input.category,
|
|
141
129
|
injectionContext: input.injection_context,
|
|
@@ -155,8 +143,7 @@ export const pentestGeneratePayloadsTool = tool('pentest_generate_payloads', {
|
|
|
155
143
|
`# Payloads: ${result.category} / ${result.injection_context}`,
|
|
156
144
|
'',
|
|
157
145
|
];
|
|
158
|
-
for (
|
|
159
|
-
const p = result.payloads[i];
|
|
146
|
+
for (const [i, p] of result.payloads.entries()) {
|
|
160
147
|
lines.push(`## Payload ${i + 1}`);
|
|
161
148
|
lines.push('```');
|
|
162
149
|
lines.push(p.template);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pentest-generate-payloads.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-generate-payloads.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"pentest-generate-payloads.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-generate-payloads.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAEjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAE1E,MAAM,uBAAuB,GAC3B,2KAA2K,CAAC;AAE9K,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC,2BAA2B,EAAE;IAC3E,KAAK,EAAE,2BAA2B;IAClC,WAAW,EACT,8OAA8O;IAChP,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,QAAQ,EAAE,CAAC;aACR,IAAI,CAAC;YACJ,KAAK;YACL,MAAM;YACN,MAAM;YACN,KAAK;YACL,gBAAgB;YAChB,MAAM;YACN,mBAAmB;YACnB,eAAe;YACf,MAAM;YACN,iBAAiB;YACjB,KAAK;YACL,gBAAgB;YAChB,iBAAiB;YACjB,aAAa;SACd,CAAC;aACD,QAAQ,CAAC,gDAAgD,CAAC;QAC7D,iBAAiB,EAAE,CAAC;aACjB,IAAI,CAAC;YACJ,gBAAgB;YAChB,WAAW;YACX,WAAW;YACX,aAAa;YACb,iBAAiB;YACjB,eAAe;YACf,UAAU;YACV,WAAW;YACX,aAAa;YACb,aAAa;YACb,eAAe;YACf,aAAa;YACb,YAAY;YACZ,cAAc;YACd,WAAW;YACX,SAAS;SACV,CAAC;aACD,QAAQ,CACP,kKAAkK,CACnK;QACH,WAAW,EAAE,CAAC;aACX,IAAI,CAAC;YACJ,YAAY;YACZ,SAAS;YACT,iBAAiB;YACjB,SAAS;YACT,QAAQ;YACR,cAAc;YACd,mBAAmB;YACnB,mBAAmB;YACnB,MAAM;YACN,SAAS;SACV,CAAC;aACD,OAAO,CAAC,MAAM,CAAC;aACf,QAAQ,CACP,qJAAqJ,CACtJ;QACH,QAAQ,EAAE,CAAC;aACR,KAAK,CACJ,CAAC;aACE,IAAI,CAAC;YACJ,MAAM;YACN,KAAK;YACL,YAAY;YACZ,aAAa;YACb,SAAS;YACT,KAAK;YACL,QAAQ;YACR,WAAW;SACZ,CAAC;aACD,QAAQ,CAAC,4BAA4B,CAAC,CAC1C;aACA,QAAQ,EAAE;aACV,QAAQ,CAAC,0EAA0E,CAAC;QACvF,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,CAAC;aACP,OAAO,CAAC,CAAC,CAAC;aACV,QAAQ,CACP,+HAA+H,CAChI;KACJ,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAC5D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QACtE,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,CAAC,gEAAgE,CAAC;QAC7E,QAAQ,EAAE,CAAC;aACR,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,QAAQ,CACP,iHAAiH,CAClH;YACH,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,CACP,8EAA8E,CAC/E;YACH,mBAAmB,EAAE,CAAC;iBACnB,MAAM,EAAE;iBACR,QAAQ,CAAC,mEAAmE,CAAC;YAChF,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,CAAC,wEAAwE,CAAC;YACrF,eAAe,EAAE,CAAC;iBACf,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,2GAA2G,CAC5G;YACH,eAAe,EAAE,CAAC;iBACf,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,uGAAuG,CACxG;SACJ,CAAC;aACD,QAAQ,CACP,wIAAwI,CACzI,CACJ;aACA,QAAQ,CACP,iGAAiG,CAClG;KACJ,CAAC;IAEF,OAAO,CAAC,KAAK,EAAE,GAAG;QAChB,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;QAEhC,wCAAwC;QACxC,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAmB,CAAC;QAE3F,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAC9B,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,WAAW,EACjB,aAAa,EACb,KAAK,CAAC,KAAK,EACX,GAAG,CACJ,CAAC;QAEF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE;YACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,KAAK,CAAC,iBAAiB;YACzC,KAAK,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,uBAAuB,EAAE,uBAAuB;YAChD,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa;YACtB,QAAQ,MAAM,CAAC,uBAAuB,EAAE;YACxC,EAAE;YACF,eAAe,MAAM,CAAC,QAAQ,MAAM,MAAM,CAAC,iBAAiB,EAAE;YAC9D,EAAE;SACH,CAAC;QAEF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC;YAChE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC,CAAC,eAAe;gBAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBACnC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;gBAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -3,24 +3,23 @@
|
|
|
3
3
|
* @module mcp-server/tools/definitions/pentest-guide.tool
|
|
4
4
|
*/
|
|
5
5
|
import { z } from '@cyanheads/mcp-ts-core';
|
|
6
|
-
import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
|
|
7
6
|
export declare const pentestGuideTool: import("@cyanheads/mcp-ts-core").ToolDefinition<z.ZodObject<{
|
|
8
7
|
vector: z.ZodEnum<{
|
|
9
|
-
path_traversal: "path_traversal";
|
|
10
|
-
jwt_attack: "jwt_attack";
|
|
11
8
|
auth_bypass: "auth_bypass";
|
|
9
|
+
command_injection: "command_injection";
|
|
12
10
|
cors: "cors";
|
|
13
|
-
xss: "xss";
|
|
14
11
|
csrf: "csrf";
|
|
12
|
+
deserialization: "deserialization";
|
|
15
13
|
idor: "idor";
|
|
14
|
+
jwt_attack: "jwt_attack";
|
|
15
|
+
open_redirect: "open_redirect";
|
|
16
|
+
path_traversal: "path_traversal";
|
|
17
|
+
race_condition: "race_condition";
|
|
16
18
|
sqli: "sqli";
|
|
17
19
|
ssrf: "ssrf";
|
|
18
|
-
xxe: "xxe";
|
|
19
20
|
ssti: "ssti";
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
deserialization: "deserialization";
|
|
23
|
-
race_condition: "race_condition";
|
|
21
|
+
xss: "xss";
|
|
22
|
+
xxe: "xxe";
|
|
24
23
|
}>;
|
|
25
24
|
target_context: z.ZodOptional<z.ZodObject<{
|
|
26
25
|
stack: z.ZodOptional<z.ZodString>;
|
|
@@ -29,10 +28,10 @@ export declare const pentestGuideTool: import("@cyanheads/mcp-ts-core").ToolDefi
|
|
|
29
28
|
}, z.core.$strip>>;
|
|
30
29
|
phase: z.ZodDefault<z.ZodEnum<{
|
|
31
30
|
all: "all";
|
|
32
|
-
recon: "recon";
|
|
33
31
|
enumeration: "enumeration";
|
|
34
32
|
exploitation: "exploitation";
|
|
35
33
|
post_exploitation: "post_exploitation";
|
|
34
|
+
recon: "recon";
|
|
36
35
|
}>>;
|
|
37
36
|
}, z.core.$strip>, z.ZodObject<{
|
|
38
37
|
vector: z.ZodString;
|
|
@@ -57,10 +56,5 @@ export declare const pentestGuideTool: import("@cyanheads/mcp-ts-core").ToolDefi
|
|
|
57
56
|
reason: z.ZodString;
|
|
58
57
|
args: z.ZodRecord<z.ZodString, z.ZodUnknown>;
|
|
59
58
|
}, z.core.$strip>>;
|
|
60
|
-
}, z.core.$strip>,
|
|
61
|
-
readonly reason: "unknown_vector";
|
|
62
|
-
readonly code: JsonRpcErrorCode.ValidationError;
|
|
63
|
-
readonly when: "Vector value is not in the supported enum.";
|
|
64
|
-
readonly recovery: "Use one of the listed enum values for the vector parameter.";
|
|
65
|
-
}], undefined>;
|
|
59
|
+
}, z.core.$strip>, undefined, undefined>;
|
|
66
60
|
//# sourceMappingURL=pentest-guide.tool.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pentest-guide.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-guide.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"pentest-guide.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-guide.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAMjD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wCAsO3B,CAAC"}
|
|
@@ -3,12 +3,11 @@
|
|
|
3
3
|
* @module mcp-server/tools/definitions/pentest-guide.tool
|
|
4
4
|
*/
|
|
5
5
|
import { tool, z } from '@cyanheads/mcp-ts-core';
|
|
6
|
-
import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
|
|
7
6
|
import { getMethodologyService } from '../../../services/methodology/methodology-service.js';
|
|
8
7
|
const AUTHORIZED_USE_REMINDER = 'AUTHORIZED TESTING ONLY: This methodology applies exclusively to systems you own or are explicitly authorized to test. Unauthorized access is illegal and unethical.';
|
|
9
8
|
export const pentestGuideTool = tool('pentest_guide', {
|
|
10
9
|
title: 'Pentest Guide',
|
|
11
|
-
description: 'Return
|
|
10
|
+
description: 'Return an authorized-testing methodology for a selected vector and optional target context. The playbook covers reconnaissance, enumeration, exploitation, and post-exploitation phases with objectives, techniques, detection signals, mitigations, common pitfalls, references, and context-derived tool suggestions across 15 vectors.',
|
|
12
11
|
annotations: { readOnlyHint: true, openWorldHint: false, idempotentHint: true },
|
|
13
12
|
input: z.object({
|
|
14
13
|
vector: z
|
|
@@ -50,7 +49,7 @@ export const pentestGuideTool = tool('pentest_guide', {
|
|
|
50
49
|
phase: z
|
|
51
50
|
.enum(['all', 'recon', 'enumeration', 'exploitation', 'post_exploitation'])
|
|
52
51
|
.default('all')
|
|
53
|
-
.describe('
|
|
52
|
+
.describe('Methodology phase selector. "all" returns the complete playbook; a named phase returns only that phase.'),
|
|
54
53
|
}),
|
|
55
54
|
output: z.object({
|
|
56
55
|
vector: z.string().describe('The requested attack vector.'),
|
|
@@ -63,7 +62,7 @@ export const pentestGuideTool = tool('pentest_guide', {
|
|
|
63
62
|
phase: z.string().describe('Phase name (e.g., "Reconnaissance", "Exploitation").'),
|
|
64
63
|
objectives: z
|
|
65
64
|
.array(z.string().describe('An objective for this phase.'))
|
|
66
|
-
.describe('
|
|
65
|
+
.describe('Discovery or execution objectives for this phase.'),
|
|
67
66
|
techniques: z
|
|
68
67
|
.array(z
|
|
69
68
|
.object({
|
|
@@ -73,10 +72,10 @@ export const pentestGuideTool = tool('pentest_guide', {
|
|
|
73
72
|
.describe('How to perform the technique in authorized testing.'),
|
|
74
73
|
detection: z
|
|
75
74
|
.string()
|
|
76
|
-
.describe('
|
|
75
|
+
.describe('Observable logs, signatures, and anomalies for this technique.'),
|
|
77
76
|
mitigation: z
|
|
78
77
|
.string()
|
|
79
|
-
.describe('
|
|
78
|
+
.describe('Configuration or control that prevents or reduces impact.'),
|
|
80
79
|
stack_note: z
|
|
81
80
|
.string()
|
|
82
81
|
.optional()
|
|
@@ -86,7 +85,7 @@ export const pentestGuideTool = tool('pentest_guide', {
|
|
|
86
85
|
.describe('Applicable techniques for this phase.'),
|
|
87
86
|
tools_commonly_used: z
|
|
88
87
|
.array(z.string().describe('A tool commonly used in this phase.'))
|
|
89
|
-
.describe('
|
|
88
|
+
.describe('Named tools commonly associated with this phase.'),
|
|
90
89
|
common_mistakes: z
|
|
91
90
|
.array(z.string().describe('A common mistake.'))
|
|
92
91
|
.describe('Pitfalls that lead to missed findings or noisy testing.'),
|
|
@@ -104,23 +103,17 @@ export const pentestGuideTool = tool('pentest_guide', {
|
|
|
104
103
|
.object({
|
|
105
104
|
toolName: z
|
|
106
105
|
.string()
|
|
107
|
-
.describe('
|
|
108
|
-
reason: z
|
|
106
|
+
.describe('Suggested tool name (e.g., "pentest_generate_payloads").'),
|
|
107
|
+
reason: z
|
|
108
|
+
.string()
|
|
109
|
+
.describe('Relationship between the playbook and the suggested tool.'),
|
|
109
110
|
args: z
|
|
110
111
|
.record(z.string(), z.unknown())
|
|
111
|
-
.describe('
|
|
112
|
+
.describe('Arguments derived from the methodology context.'),
|
|
112
113
|
})
|
|
113
|
-
.describe('A
|
|
114
|
-
.describe('Suggested
|
|
114
|
+
.describe('A suggested tool with arguments derived from the playbook.'))
|
|
115
|
+
.describe('Suggested tools and arguments derived from the playbook.'),
|
|
115
116
|
}),
|
|
116
|
-
errors: [
|
|
117
|
-
{
|
|
118
|
-
reason: 'unknown_vector',
|
|
119
|
-
code: JsonRpcErrorCode.ValidationError,
|
|
120
|
-
when: 'Vector value is not in the supported enum.',
|
|
121
|
-
recovery: 'Use one of the listed enum values for the vector parameter.',
|
|
122
|
-
},
|
|
123
|
-
],
|
|
124
117
|
handler(input, ctx) {
|
|
125
118
|
const svc = getMethodologyService();
|
|
126
119
|
const { phases, owasp_references, attack_technique_ids } = svc.getMethodology(input.vector, input.phase, input.target_context, ctx);
|
|
@@ -225,11 +218,12 @@ function buildNextToolSuggestions(vector, targetContext, attackIds) {
|
|
|
225
218
|
});
|
|
226
219
|
}
|
|
227
220
|
// ATT&CK lookup suggestion for the first technique
|
|
228
|
-
|
|
221
|
+
const primaryAttackId = attackIds[0];
|
|
222
|
+
if (primaryAttackId) {
|
|
229
223
|
suggestions.push({
|
|
230
224
|
toolName: 'pentest_lookup_technique',
|
|
231
225
|
reason: `Deep-dive on the primary ATT&CK technique for ${vector} for detection/mitigation context.`,
|
|
232
|
-
args: { query:
|
|
226
|
+
args: { query: primaryAttackId },
|
|
233
227
|
});
|
|
234
228
|
}
|
|
235
229
|
// Suggest cross-server tool for CVE context
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pentest-guide.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-guide.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"pentest-guide.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-guide.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AAEtF,MAAM,uBAAuB,GAC3B,sKAAsK,CAAC;AAEzK,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,eAAe,EAAE;IACpD,KAAK,EAAE,eAAe;IACtB,WAAW,EACT,2UAA2U;IAC7U,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,MAAM,EAAE,CAAC;aACN,IAAI,CAAC;YACJ,aAAa;YACb,MAAM;YACN,MAAM;YACN,KAAK;YACL,MAAM;YACN,KAAK;YACL,gBAAgB;YAChB,MAAM;YACN,MAAM;YACN,eAAe;YACf,iBAAiB;YACjB,gBAAgB;YAChB,MAAM;YACN,mBAAmB;YACnB,YAAY;SACb,CAAC;aACD,QAAQ,CACP,qJAAqJ,CACtJ;QACH,cAAc,EAAE,CAAC;aACd,MAAM,CAAC;YACN,KAAK,EAAE,CAAC;iBACL,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,iJAAiJ,CAClJ;YACH,GAAG,EAAE,CAAC;iBACH,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,iJAAiJ,CAClJ;YACH,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,wJAAwJ,CACzJ;SACJ,CAAC;aACD,QAAQ,EAAE;aACV,QAAQ,CACP,+IAA+I,CAChJ;QACH,KAAK,EAAE,CAAC;aACL,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,mBAAmB,CAAC,CAAC;aAC1E,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CACP,yGAAyG,CAC1G;KACJ,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAC3D,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,CACP,gGAAgG,CACjG;QACH,MAAM,EAAE,CAAC;aACN,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;YAClF,UAAU,EAAE,CAAC;iBACV,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;iBAC1D,QAAQ,CAAC,mDAAmD,CAAC;YAChE,UAAU,EAAE,CAAC;iBACV,KAAK,CACJ,CAAC;iBACE,MAAM,CAAC;gBACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAC5C,WAAW,EAAE,CAAC;qBACX,MAAM,EAAE;qBACR,QAAQ,CAAC,qDAAqD,CAAC;gBAClE,SAAS,EAAE,CAAC;qBACT,MAAM,EAAE;qBACR,QAAQ,CAAC,gEAAgE,CAAC;gBAC7E,UAAU,EAAE,CAAC;qBACV,MAAM,EAAE;qBACR,QAAQ,CAAC,2DAA2D,CAAC;gBACxE,UAAU,EAAE,CAAC;qBACV,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CACP,0HAA0H,CAC3H;aACJ,CAAC;iBACD,QAAQ,CACP,4EAA4E,CAC7E,CACJ;iBACA,QAAQ,CAAC,uCAAuC,CAAC;YACpD,mBAAmB,EAAE,CAAC;iBACnB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;iBACjE,QAAQ,CAAC,kDAAkD,CAAC;YAC/D,eAAe,EAAE,CAAC;iBACf,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;iBAC/C,QAAQ,CAAC,yDAAyD,CAAC;SACvE,CAAC;aACD,QAAQ,CAAC,4EAA4E,CAAC,CAC1F;aACA,QAAQ,CACP,8FAA8F,CAC/F;QACH,gBAAgB,EAAE,CAAC;aAChB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;aACpD,QAAQ,CAAC,oEAAoE,CAAC;QACjF,oBAAoB,EAAE,CAAC;aACpB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;aACrD,QAAQ,CACP,oFAAoF,CACrF;QACH,mBAAmB,EAAE,CAAC;aACnB,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,QAAQ,CAAC,0DAA0D,CAAC;YACvE,MAAM,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,QAAQ,CAAC,2DAA2D,CAAC;YACxE,IAAI,EAAE,CAAC;iBACJ,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC/B,QAAQ,CAAC,iDAAiD,CAAC;SAC/D,CAAC;aACD,QAAQ,CAAC,4DAA4D,CAAC,CAC1E;aACA,QAAQ,CAAC,0DAA0D,CAAC;KACxE,CAAC;IAEF,OAAO,CAAC,KAAK,EAAE,GAAG;QAChB,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC;QACpC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,GAAG,GAAG,CAAC,cAAc,CAC3E,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,cAAc,EACpB,GAAG,CACJ,CAAC;QAEF,8BAA8B;QAC9B,MAAM,mBAAmB,GAAG,wBAAwB,CAClD,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,cAAc,EACpB,oBAAoB,CACrB,CAAC;QAEF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACrC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,MAAM,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,uBAAuB,EAAE,uBAAuB;YAChD,MAAM;YACN,gBAAgB;YAChB,oBAAoB;YACpB,mBAAmB;SACpB,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa;YACtB,QAAQ,MAAM,CAAC,uBAAuB,EAAE;YACxC,EAAE;YACF,oBAAoB,MAAM,CAAC,MAAM,EAAE;YACnC,EAAE;SACH,CAAC;QAEF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,UAAU;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;YAC3D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAEf,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBACpC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC7B,IAAI,IAAI,CAAC,UAAU;oBAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;gBACpE,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC/C,KAAK,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;gBACjD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,CAAC;YAED,IAAI,KAAK,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,KAAK,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBACnC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe;oBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,MAAM,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBAC3C,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,KAAK,CAAC,IAAI,CACR,WAAW,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC;AAEH,iDAAiD;AACjD,SAAS,wBAAwB,CAC/B,MAAc,EACd,aAAmF,EACnF,SAAmB;IAEnB,MAAM,WAAW,GACf,EAAE,CAAC;IAEL,+BAA+B;IAC/B,MAAM,uBAAuB,GAA2B;QACtD,GAAG,EAAE,KAAK;QACV,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,KAAK;QACV,cAAc,EAAE,gBAAgB;QAChC,IAAI,EAAE,MAAM;QACZ,iBAAiB,EAAE,mBAAmB;QACtC,aAAa,EAAE,eAAe;QAC9B,IAAI,EAAE,MAAM;QACZ,eAAe,EAAE,iBAAiB;QAClC,UAAU,EAAE,KAAK;KAClB,CAAC;IACF,MAAM,eAAe,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,WAAW,GAA4B;YAC3C,QAAQ,EAAE,eAAe;YACzB,iBAAiB,EAAE,SAAS;SAC7B,CAAC;QACF,IAAI,aAAa,EAAE,GAAG;YAAE,WAAW,CAAC,aAAa,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACrF,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,2BAA2B;YACrC,MAAM,EAAE,gDAAgD,MAAM,WAAW;YACzE,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;IACL,CAAC;IAED,mDAAmD;IACnD,MAAM,eAAe,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,eAAe,EAAE,CAAC;QACpB,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,0BAA0B;YACpC,MAAM,EAAE,iDAAiD,MAAM,oCAAoC;YACnG,IAAI,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE;SACjC,CAAC,CAAC;IACL,CAAC;IAED,4CAA4C;IAC5C,WAAW,CAAC,IAAI,CAAC;QACf,QAAQ,EAAE,qCAAqC;QAC/C,MAAM,EAAE,uEAAuE,MAAM,GAAG;QACxF,IAAI,EAAE;YACJ,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,aAAa,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;SAC5E;KACF,CAAC,CAAC;IAEH,OAAO,WAAW,CAAC;AACrB,CAAC"}
|
|
@@ -8,7 +8,7 @@ import { getAttackService } from '../../../services/attack/attack-service.js';
|
|
|
8
8
|
const AUTHORIZED_USE_REMINDER = 'AUTHORIZED TESTING ONLY: ATT&CK threat group and software data is provided for authorized penetration testing, threat intelligence, and defensive detection coverage only.';
|
|
9
9
|
export const pentestLookupGroupTool = tool('pentest_lookup_group', {
|
|
10
10
|
title: 'Pentest Lookup Group',
|
|
11
|
-
description: 'Look up a MITRE ATT&CK threat group
|
|
11
|
+
description: 'Look up a MITRE ATT&CK threat group or software entry by ID, name, or keyword. Results include ATT&CK identity, aliases, type, description, and associated techniques with procedure-level context from public ATT&CK reporting.',
|
|
12
12
|
annotations: { readOnlyHint: true, openWorldHint: false, idempotentHint: true },
|
|
13
13
|
input: z.object({
|
|
14
14
|
query: z
|
|
@@ -38,10 +38,8 @@ export const pentestLookupGroupTool = tool('pentest_lookup_group', {
|
|
|
38
38
|
.describe('How this group or software used the technique, from public ATT&CK reporting.'),
|
|
39
39
|
})
|
|
40
40
|
.describe('A technique used by this group or software with procedure context.'))
|
|
41
|
-
.describe('
|
|
42
|
-
attack_version: z
|
|
43
|
-
.string()
|
|
44
|
-
.describe('ATT&CK dataset version used (e.g., "Enterprise v19.1"). Included so callers know the data vintage.'),
|
|
41
|
+
.describe('Up to 20 techniques associated with the group or software, including procedure-level context and technique IDs.'),
|
|
42
|
+
attack_version: z.string().describe('ATT&CK dataset version used (e.g., "Enterprise v19.1").'),
|
|
45
43
|
}),
|
|
46
44
|
errors: [
|
|
47
45
|
{
|
|
@@ -62,7 +60,7 @@ export const pentestLookupGroupTool = tool('pentest_lookup_group', {
|
|
|
62
60
|
group = results[0];
|
|
63
61
|
}
|
|
64
62
|
if (!group) {
|
|
65
|
-
throw ctx.fail('no_match', `No ATT&CK group or software found for query: "${query}"
|
|
63
|
+
throw ctx.fail('no_match', `No ATT&CK group or software found for query: "${query}"`, ctx.recoveryFor('no_match'));
|
|
66
64
|
}
|
|
67
65
|
ctx.log.info('pentest_lookup_group found', {
|
|
68
66
|
id: group.id,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pentest-lookup-group.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-lookup-group.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAEvE,MAAM,uBAAuB,GAC3B,4KAA4K,CAAC;AAE/K,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC,sBAAsB,EAAE;IACjE,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EACT,
|
|
1
|
+
{"version":3,"file":"pentest-lookup-group.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-lookup-group.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAEvE,MAAM,uBAAuB,GAC3B,4KAA4K,CAAC;AAE/K,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC,sBAAsB,EAAE;IACjE,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EACT,kOAAkO;IACpO,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,QAAQ,CACP,yNAAyN,CAC1N;KACJ,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,CACP,8FAA8F,CAC/F;QACH,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;QACvF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;QAC9E,OAAO,EAAE,CAAC;aACP,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC;aAC3E,QAAQ,CAAC,oCAAoC,CAAC;QACjD,IAAI,EAAE,CAAC;aACJ,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;aAC3B,QAAQ,CAAC,+EAA+E,CAAC;QAC5F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;QACrF,eAAe,EAAE,CAAC;aACf,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;YACzE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACtD,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,CACP,8EAA8E,CAC/E;SACJ,CAAC;aACD,QAAQ,CAAC,oEAAoE,CAAC,CAClF;aACA,QAAQ,CACP,iHAAiH,CAClH;QACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;KAC/F,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,gBAAgB,CAAC,QAAQ;YAC/B,IAAI,EAAE,+CAA+C;YACrD,QAAQ,EACN,wJAAwJ;SAC3J;KACF;IAED,OAAO,CAAC,KAAK,EAAE,GAAG;QAChB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAEjC,6CAA6C;QAC7C,IAAI,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhF,mCAAmC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC7C,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,GAAG,CAAC,IAAI,CACZ,UAAU,EACV,iDAAiD,KAAK,GAAG,EACzD,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,CAC5B,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE;YACzC,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;QAEH,OAAO;YACL,uBAAuB,EAAE,uBAAuB;YAChD,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa;YACtB,QAAQ,MAAM,CAAC,uBAAuB,EAAE;YACxC,EAAE;YACF,KAAK,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,IAAI,EAAE;YAChC,EAAE;YACF,aAAa,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,2BAA2B,EAAE;YACrG,uBAAuB,MAAM,CAAC,cAAc,EAAE;SAC/C,CAAC;QAEF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAEvC,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;YACpE,KAAK,CAAC,IAAI,CACR,oGAAoG,EACpG,EAAE,CACH,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;gBACzD,IAAI,CAAC,CAAC,WAAW;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QAED,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pentest-lookup-technique.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-lookup-technique.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
|
1
|
+
{"version":3,"file":"pentest-lookup-technique.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-lookup-technique.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAyMrC,CAAC"}
|
|
@@ -9,7 +9,7 @@ import { truncate } from '../../../utils/text.js';
|
|
|
9
9
|
const AUTHORIZED_USE_REMINDER = 'AUTHORIZED TESTING ONLY: ATT&CK technique data is provided for authorized penetration testing, security research, and defensive detection coverage only.';
|
|
10
10
|
export const pentestLookupTechniqueTool = tool('pentest_lookup_technique', {
|
|
11
11
|
title: 'Pentest Lookup Technique',
|
|
12
|
-
description: 'Look up a MITRE ATT&CK technique by ID or keyword
|
|
12
|
+
description: 'Look up a MITRE ATT&CK technique by exact ID or keyword. Results include tactics, platforms, description, detection data, public procedure examples, mitigations, related sub-techniques, and dataset version.',
|
|
13
13
|
annotations: { readOnlyHint: true, openWorldHint: false, idempotentHint: true },
|
|
14
14
|
input: z.object({
|
|
15
15
|
query: z
|
|
@@ -43,7 +43,7 @@ export const pentestLookupTechniqueTool = tool('pentest_lookup_technique', {
|
|
|
43
43
|
.array(z.string().describe('A behavioral indicator or signature.'))
|
|
44
44
|
.describe('Concrete behavioral indicators and signatures.'),
|
|
45
45
|
})
|
|
46
|
-
.describe('
|
|
46
|
+
.describe('ATT&CK detection context for the technique.'),
|
|
47
47
|
mitigations: z
|
|
48
48
|
.array(z
|
|
49
49
|
.object({
|
|
@@ -66,7 +66,7 @@ export const pentestLookupTechniqueTool = tool('pentest_lookup_technique', {
|
|
|
66
66
|
.describe('How the group or software used this technique, from public ATT&CK reporting.'),
|
|
67
67
|
})
|
|
68
68
|
.describe('A real-world usage example from ATT&CK public reporting.'))
|
|
69
|
-
.describe('Real-world usage examples from ATT&CK public reporting.
|
|
69
|
+
.describe('Real-world usage examples from ATT&CK public reporting.'),
|
|
70
70
|
sub_techniques: z
|
|
71
71
|
.array(z
|
|
72
72
|
.object({
|
|
@@ -76,11 +76,9 @@ export const pentestLookupTechniqueTool = tool('pentest_lookup_technique', {
|
|
|
76
76
|
.string()
|
|
77
77
|
.describe('Brief description of the sub-technique (first 200 chars).'),
|
|
78
78
|
})
|
|
79
|
-
.describe('A sub-technique
|
|
79
|
+
.describe('A sub-technique ID, name, and brief description.'))
|
|
80
80
|
.describe('Sub-techniques of this parent technique. Empty when querying a sub-technique itself, or when include_subtechniques is false.'),
|
|
81
|
-
attack_version: z
|
|
82
|
-
.string()
|
|
83
|
-
.describe('ATT&CK dataset version used (e.g., "Enterprise v19.1"). Included so callers know the data vintage.'),
|
|
81
|
+
attack_version: z.string().describe('ATT&CK dataset version used (e.g., "Enterprise v19.1").'),
|
|
84
82
|
}),
|
|
85
83
|
errors: [
|
|
86
84
|
{
|
|
@@ -101,7 +99,7 @@ export const pentestLookupTechniqueTool = tool('pentest_lookup_technique', {
|
|
|
101
99
|
technique = results[0];
|
|
102
100
|
}
|
|
103
101
|
if (!technique) {
|
|
104
|
-
throw ctx.fail('no_match', `No ATT&CK technique found for query: "${input.query}"
|
|
102
|
+
throw ctx.fail('no_match', `No ATT&CK technique found for query: "${input.query}"`, ctx.recoveryFor('no_match'));
|
|
105
103
|
}
|
|
106
104
|
// Fetch sub-techniques if requested
|
|
107
105
|
const sub_techniques = input.include_subtechniques
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pentest-lookup-technique.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-lookup-technique.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,MAAM,uBAAuB,GAC3B,0JAA0J,CAAC;AAE7J,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC,0BAA0B,EAAE;IACzE,KAAK,EAAE,0BAA0B;IACjC,WAAW,EACT,
|
|
1
|
+
{"version":3,"file":"pentest-lookup-technique.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-lookup-technique.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,MAAM,uBAAuB,GAC3B,0JAA0J,CAAC;AAE7J,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC,0BAA0B,EAAE;IACzE,KAAK,EAAE,0BAA0B;IACjC,WAAW,EACT,gNAAgN;IAClN,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,QAAQ,CACP,uOAAuO,CACxO;QACH,qBAAqB,EAAE,CAAC;aACrB,OAAO,EAAE;aACT,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CACP,sGAAsG,CACvG;KACJ,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,CACP,2FAA2F,CAC5F;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;QACzE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAC5C,OAAO,EAAE,CAAC;aACP,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;aAC5C,QAAQ,CAAC,iFAAiF,CAAC;QAC9F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;QACxE,SAAS,EAAE,CAAC;aACT,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;aAChD,QAAQ,CAAC,iEAAiE,CAAC;QAC9E,SAAS,EAAE,CAAC;aACT,MAAM,CAAC;YACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;YAChF,YAAY,EAAE,CAAC;iBACZ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;iBAC5D,QAAQ,CAAC,4CAA4C,CAAC;YACzD,UAAU,EAAE,CAAC;iBACV,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC;iBAClE,QAAQ,CAAC,gDAAgD,CAAC;SAC9D,CAAC;aACD,QAAQ,CAAC,6CAA6C,CAAC;QAC1D,WAAW,EAAE,CAAC;aACX,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;YAC3E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAC7C,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,CAAC,4DAA4D,CAAC;SAC1E,CAAC;aACD,QAAQ,CAAC,4EAA4E,CAAC,CAC1F;aACA,QAAQ,CAAC,sCAAsC,CAAC;QACnD,kBAAkB,EAAE,CAAC;aAClB,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,iBAAiB,EAAE,CAAC;iBACjB,MAAM,EAAE;iBACR,QAAQ,CAAC,6DAA6D,CAAC;YAC1E,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,CACP,8EAA8E,CAC/E;SACJ,CAAC;aACD,QAAQ,CAAC,0DAA0D,CAAC,CACxE;aACA,QAAQ,CAAC,yDAAyD,CAAC;QACtE,cAAc,EAAE,CAAC;aACd,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;YAChE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAChD,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,CAAC,2DAA2D,CAAC;SACzE,CAAC;aACD,QAAQ,CAAC,kDAAkD,CAAC,CAChE;aACA,QAAQ,CACP,8HAA8H,CAC/H;QACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;KAC/F,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,gBAAgB,CAAC,QAAQ;YAC/B,IAAI,EAAE,iCAAiC;YACvC,QAAQ,EACN,sJAAsJ;SACzJ;KACF;IAED,OAAO,CAAC,KAAK,EAAE,GAAG;QAChB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;QAE/B,4BAA4B;QAC5B,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,IAAI,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEzE,8BAA8B;QAC9B,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC7C,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,GAAG,CAAC,IAAI,CACZ,UAAU,EACV,yCAAyC,KAAK,CAAC,KAAK,GAAG,EACvD,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,CAC5B,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,MAAM,cAAc,GAAG,KAAK,CAAC,qBAAqB;YAChD,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC9C,EAAE,EAAE,EAAE,CAAC,EAAE;gBACT,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,CAAC;aAC3C,CAAC,CAAC;YACL,CAAC,CAAC,EAAE,CAAC;QAEP,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QAE3F,OAAO;YACL,uBAAuB,EAAE,uBAAuB;YAChD,YAAY,EAAE,SAAS,CAAC,EAAE;YAC1B,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;YAChD,cAAc;YACd,cAAc,EAAE,GAAG,CAAC,OAAO;SAC5B,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa;YACtB,QAAQ,MAAM,CAAC,uBAAuB,EAAE;YACxC,EAAE;YACF,KAAK,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,IAAI,EAAE;YAC1C,EAAE;YACF,gBAAgB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC3C,kBAAkB,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC/C,uBAAuB,MAAM,CAAC,cAAc,EAAE;YAC9C,EAAE;YACF,MAAM,CAAC,WAAW;YAClB,EAAE;SACH,CAAC;QAEF,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAChC,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,YAAY;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACnC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACpC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAC1C,IAAI,CAAC,CAAC,WAAW;oBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,iBAAiB,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAChC,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -8,21 +8,21 @@ export declare const pentestMapTechniquesTool: import("@cyanheads/mcp-ts-core").
|
|
|
8
8
|
stack: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
9
9
|
services: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
10
10
|
auth_type: z.ZodOptional<z.ZodEnum<{
|
|
11
|
-
unknown: "unknown";
|
|
12
|
-
jwt: "jwt";
|
|
13
|
-
none: "none";
|
|
14
|
-
session_cookie: "session_cookie";
|
|
15
11
|
api_key: "api_key";
|
|
16
|
-
oauth2: "oauth2";
|
|
17
12
|
basic_auth: "basic_auth";
|
|
18
|
-
|
|
13
|
+
jwt: "jwt";
|
|
19
14
|
kerberos: "kerberos";
|
|
15
|
+
none: "none";
|
|
16
|
+
ntlm: "ntlm";
|
|
17
|
+
oauth2: "oauth2";
|
|
18
|
+
session_cookie: "session_cookie";
|
|
19
|
+
unknown: "unknown";
|
|
20
20
|
}>>;
|
|
21
21
|
os: z.ZodOptional<z.ZodEnum<{
|
|
22
|
-
unknown: "unknown";
|
|
23
22
|
linux: "linux";
|
|
24
|
-
windows: "windows";
|
|
25
23
|
macos: "macos";
|
|
24
|
+
unknown: "unknown";
|
|
25
|
+
windows: "windows";
|
|
26
26
|
}>>;
|
|
27
27
|
limit: z.ZodDefault<z.ZodNumber>;
|
|
28
28
|
}, z.core.$strip>, z.ZodObject<{
|
|
@@ -49,5 +49,9 @@ export declare const pentestMapTechniquesTool: import("@cyanheads/mcp-ts-core").
|
|
|
49
49
|
readonly code: JsonRpcErrorCode.ValidationError;
|
|
50
50
|
readonly when: "No profile fields were provided.";
|
|
51
51
|
readonly recovery: "Provide at least one of stack, services, auth_type, or os.";
|
|
52
|
-
}],
|
|
52
|
+
}], {
|
|
53
|
+
readonly truncated: z.ZodBoolean;
|
|
54
|
+
readonly shown: z.ZodNumber;
|
|
55
|
+
readonly cap: z.ZodNumber;
|
|
56
|
+
}>;
|
|
53
57
|
//# sourceMappingURL=pentest-map-techniques.tool.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pentest-map-techniques.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-map-techniques.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAwDjE,eAAO,MAAM,wBAAwB
|
|
1
|
+
{"version":3,"file":"pentest-map-techniques.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-map-techniques.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAwDjE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiUnC,CAAC"}
|
|
@@ -54,7 +54,7 @@ const VECTOR_MAP = {
|
|
|
54
54
|
const AUTHORIZED_USE_REMINDER = 'AUTHORIZED TESTING ONLY: Technique mapping is for scoping and prioritizing authorized penetration testing engagements only.';
|
|
55
55
|
export const pentestMapTechniquesTool = tool('pentest_map_techniques', {
|
|
56
56
|
title: 'Pentest Map Techniques',
|
|
57
|
-
description: '
|
|
57
|
+
description: 'Rank ATT&CK techniques and OWASP test cases against an authorized target profile of technology stack, exposed services, authentication type, and operating system. Results include profile-specific relevance, detection opportunities, mitigations, and associated methodology vectors.',
|
|
58
58
|
annotations: { readOnlyHint: true, openWorldHint: false, idempotentHint: true },
|
|
59
59
|
input: z.object({
|
|
60
60
|
stack: z
|
|
@@ -103,20 +103,20 @@ export const pentestMapTechniquesTool = tool('pentest_map_techniques', {
|
|
|
103
103
|
tactic: z.string().describe('Primary tactic (e.g., "Initial Access").'),
|
|
104
104
|
relevance_score: z
|
|
105
105
|
.number()
|
|
106
|
-
.describe('
|
|
106
|
+
.describe('Relative relevance to the supplied target profile; higher scores indicate stronger matches.'),
|
|
107
107
|
relevance_rationale: z
|
|
108
108
|
.string()
|
|
109
109
|
.describe('Explanation of why this technique is relevant to the provided target profile.'),
|
|
110
110
|
detection_opportunity: z
|
|
111
111
|
.string()
|
|
112
|
-
.describe('Primary detection opportunity
|
|
112
|
+
.describe('Primary observable detection opportunity (truncated to 200 characters).'),
|
|
113
113
|
mitigation_summary: z
|
|
114
114
|
.string()
|
|
115
115
|
.describe('Key mitigation recommendation for this technique.'),
|
|
116
116
|
pentest_guide_vector: z
|
|
117
117
|
.string()
|
|
118
118
|
.optional()
|
|
119
|
-
.describe('
|
|
119
|
+
.describe('Associated pentest_guide methodology vector. Absent when no direct mapping exists.'),
|
|
120
120
|
})
|
|
121
121
|
.describe('A ranked ATT&CK technique with relevance rationale and defense context.'))
|
|
122
122
|
.describe('Techniques ordered by relevance_score descending.'),
|
|
@@ -135,9 +135,14 @@ export const pentestMapTechniquesTool = tool('pentest_map_techniques', {
|
|
|
135
135
|
.describe('Relevant OWASP Testing Guide test cases for the profile (up to 10).'),
|
|
136
136
|
profile_summary: z
|
|
137
137
|
.string()
|
|
138
|
-
.describe('One-sentence summary of the target profile
|
|
138
|
+
.describe('One-sentence normalized summary of the supplied target profile.'),
|
|
139
139
|
attack_version: z.string().describe('ATT&CK dataset version used for technique data.'),
|
|
140
140
|
}),
|
|
141
|
+
enrichment: {
|
|
142
|
+
truncated: z.boolean().describe('True when ranked_techniques was capped by limit.'),
|
|
143
|
+
shown: z.number().describe('Number of ranked techniques returned.'),
|
|
144
|
+
cap: z.number().describe('The limit applied to ranked_techniques.'),
|
|
145
|
+
},
|
|
141
146
|
errors: [
|
|
142
147
|
{
|
|
143
148
|
reason: 'no_profile',
|
|
@@ -147,8 +152,12 @@ export const pentestMapTechniquesTool = tool('pentest_map_techniques', {
|
|
|
147
152
|
},
|
|
148
153
|
],
|
|
149
154
|
handler(input, ctx) {
|
|
150
|
-
|
|
151
|
-
|
|
155
|
+
const hasProfile = (input.stack?.length ?? 0) > 0 ||
|
|
156
|
+
(input.services?.length ?? 0) > 0 ||
|
|
157
|
+
input.auth_type !== undefined ||
|
|
158
|
+
input.os !== undefined;
|
|
159
|
+
if (!hasProfile) {
|
|
160
|
+
throw ctx.fail('no_profile', 'At least one of stack, services, auth_type, or os must be provided.', ctx.recoveryFor('no_profile'));
|
|
152
161
|
}
|
|
153
162
|
const svc = getAttackService();
|
|
154
163
|
const allTechniques = svc.getAllTechniques();
|
|
@@ -222,6 +231,9 @@ export const pentestMapTechniquesTool = tool('pentest_map_techniques', {
|
|
|
222
231
|
if (totalMatched > input.limit) {
|
|
223
232
|
ctx.enrich.truncated({ shown: topN.length, cap: input.limit });
|
|
224
233
|
}
|
|
234
|
+
else {
|
|
235
|
+
ctx.enrich({ truncated: false, shown: topN.length, cap: input.limit });
|
|
236
|
+
}
|
|
225
237
|
const ranked_techniques = topN.map(({ technique, score, rationale }) => {
|
|
226
238
|
const primaryTactic = technique.tactics[0] ?? 'Unknown';
|
|
227
239
|
const mitigation = technique.mitigations[0];
|