MoonMcp: Skill for Claude Code

Assessment Planning

Convert a broad security request into an approved, scope-safe run before active work. Keep planning proportional: do not turn one well-defined check into ceremony.

Adapted for security assessments from obra/superpowers' MIT-licensed brainstorming and writing-plans workflows.

Classify the work

Choose one path:

• Single check: one known endpoint and hypothesis. Confirm scope, state the exact low-noise check, then execute it.
• Bounded assessment: one target or feature with a clear focus. Present a short plan, create a run, and seed or adjust tasks.
• Campaign: several assets, roles, applications, or independent goals. Split into runs with separate budgets and coverage; do not hide a campaign inside one unbounded task.

Upgrade to the heavier path when new independent surfaces appear. Never silently downgrade rules of engagement.

Establish the contract

Before target traffic:

1. Recall prior state with memory_brief(target) and memory_lesson(action="recall").
2. Read server_status, scope_list, and the active program profile.
3. Confirm target, inclusions, exclusions, credentials/roles, permitted test classes, rate limits, state-change restrictions, time window, and stopping conditions.
4. Resolve ambiguity with the operator. Do not infer authorization from DNS ownership, public reachability, or a bug-bounty brand.
5. Select budgets for requests, tool calls, and intrusive calls. Start below the permitted maximum.

Design coverage from evidence

Inventory only applicable dimensions:

• assets and hosts;
• endpoints, methods, and parameters;
• anonymous and authenticated roles;
• technologies and protocols;
• vulnerability hypotheses;
• validation and reporting.

Mark each item open, in_progress, covered, not_applicable, or blocked. A checklist item without an evidence source is not covered.

Create the run

1. Authorize with program_use or scope_add.
2. Call run_start(target, focus, max_requests, max_tool_calls, max_intrusive_calls).
3. Inspect the seeded coordinator→mapper→hypothesis→validator→reporter graph.
4. Add target-specific tasks with run_task_add; connect prerequisites with depends_on.
5. Add or refine coverage using run_coverage_update.
6. Show the operator the plan when it includes intrusive, authenticated, expensive, or state-changing work. Wait for explicit approval before that tier.