Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add forefy/.context --skill mcp-server-pentestgit clone --depth 1 https://github.com/forefy/.contextWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/forefy/.context/mcp-server-pentest)<a href="https://agentmods.dev/skills/forefy/.context/mcp-server-pentest"><img src="https://agentmods.dev/badge/skills/forefy/.context/mcp-server-pentest/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/forefy/.context/mcp-server-pentest"><img src="https://agentmods.dev/badge/skills/forefy/.context/mcp-server-pentest.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.03618 |
| Opus 5 | $0.00025 | $0.01809 |
| Sonnet 5 | $0.00010 | $0.00724 |
| Haiku 4.5 | $0.00005 | $0.00362 |
Grade C, and why
mcp-server-pentest scanned grade C with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads MCP configurationlowAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
Inspect `claude_desktop_config.json`, `.mcp.json`, `.vscode/mcp.json`, container env, compose files, and any systemd unit. Run the secret patterns from `../../applicative-pentest/webapp-probe/references/secret-regexes.md Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Cloud metadata endpointmediumServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
- AWS IMDSv2 is a two-step and needs method plus header control: `PUT http://169.254.169.254/latest/api/token` with `X-aws-ec2-metadata-token-ttl-seconds: 21600`, then `GET .../latest/meta-data/iam/security-credentials/` Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sik -X POST "$URL" -H 'Content-Type: application/json' \ Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
Target tools whose name or description implies a shell, a filesystem, a query language, or template rendering. With repo access, grep for `child_process`, `spawn`, `exec`, `subprocess`, `os.system`, `eval`, and unnormali How it starts
The opening of the file, as written. The whole thing — 178 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Contents
- Scope & authorization (blast-radius labels)
- Input modes: what a URL gets you, what a repo adds
- Passive:
- Inventory & transport fingerprint
- Destination-shaped tool parameters
- Credential scope & identity blast radius
- Config & secret storage (repo/host only)
- Active: 5. Session forgery, unauthenticated access & reachability 6. Confused-deputy SSRF via caller-chosen destination 7. Tool-argument injection
- False-positive gates
- Runnable snippets
- Output
Scope & authorization
Only run against an MCP server you own or are contractually engaged to test. Note the unusual consent shape: these checks speak JSON-RPC to the server directly, which bypasses the agent's tool-approval UI. Anything the operator believed a human would confirm before it ran will run unattended here. Confirm that is in scope before check 5.
Blast-radius labels:
- Passive (1, 2, 3, 4) - reads the server's own manifest, config and schemas. Check 1 completes the MCP handshake, which is one benign request the server is built to answer; nothing else leaves your machine.
- Active (5, 6) - live JSON-RPC to the target. Check 6 also reaches third parties (your OAST host, cloud metadata endpoints).
- Aggressive (7) - sends injection payloads through tools that may execute them. Run last, in a low-traffic window.
Input modes
The protocol is self-describing, so a URL alone carries most of the surface: tools/list returns a machine-readable schema of every tool and parameter before you send a single payload.
| Input | Runs | Notes |
|---|---|---|
| Remote URL (default) | 1, 2, 5, 6, 7, partial 3 | Everything except config storage. |
| + repo or host access | adds 4, completes 3, sharpens 7 | Source tells you which tools shell out, so check 7 targets instead of fuzzes; env/config tells you the real grants behind check 3. |
Transport decides more than source does. A stdio server has no URL and no listener: spawn it yourself, run 1, 2, 3, 4, 7, and skip 5 and 6 unless it also serves HTTP.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 178 lines · 50 tokens per session scan C 3044adab9e28
mcp-server-pentest is a skill published in the GitHub repository forefy/.context (146 stars, last pushed 3d ago), licensed MIT. It adds 50 tokens to every session and 3,618 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 4 findings (reads mcp configuration, cloud metadata endpoint, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-08.
Other skills, from other repositories
eresus-manual-security-audit
Elite manual security code review skill for deep, adversarial vulnerability hunting and exploit-chain discovery. Trigger when the user asks to: "do a deep security audit", "manual code review", "find exploit chains", "hunt for logic bugs", "red-team this codebase", "do an offensive security review", "review this like…
eresus-php-audit
Deep PHP-specific security audit skill covering injection, deserialization, file operations, auth bypass, POP chain discovery, and CMS-specific patterns. Trigger when auditing PHP code: "audit this PHP app", "find PHP security issues", "check Laravel/WordPress for vulnerabilities", "PHP SAST review", "check for PHP…
eresus-sast-scanner
General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis. Trigger when the user asks to: "analyze code for vulnerabilities", "review code security", "find security bugs", "do a SAST scan", "check for [vulnerability type] in code", "audit source code", or requests a security code…
eresus-python-audit
Deep Python-specific security audit skill with 50+ vulnerability class coverage across 7 categories. Trigger when auditing Python code: "audit this Python app", "find Python security issues", "check Flask/Django for vulnerabilities", "Python SAST review", "check for pickle vulnerabilities", "review this FastAPI code".…
eresus-remediator
Security remediation skill for fixing confirmed or likely SAST findings in source code. Trigger when the user asks to: "fix a vulnerability", "patch this security bug", "remediate SAST findings", "harden this endpoint", "make this auth flow safe", or wants code changes that remove a confirmed security issue while…
eresus-variant-analysis
GHSA/CVE variant analysis workflow for finding similar vulnerability patterns across a codebase. Trigger when the user asks to: "find variants of this CVE", "GHSA variant analysis", "find similar bugs", "hunt for the same pattern", "are there other places with this vulnerability?", or when a known vulnerability is…