SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsmcp-autopentest-orchestrator

mcp-autopentest-orchestrator

Agents & models

View repository

Updated 10-16 08:38

About this skill

MCP Autopentest Orchestrator

Semi-autonomous driver for the kit. Read ../../SECURITY_RULES.md first — it overrides everything here.

Autonomy boundary (non-negotiable):

  • Read-only by default. The deterministic runner never calls write/destructive tools authenticated; the orchestrator must not either. Writes = human gate.
  • Scope-lock: one authorized host, taken from policy.json. Never probe a host not in scope (no SSRF-out, no prod-by-accident).
  • Rate-limit per policy. This is assessment, not load testing.
  • Redact secrets: type + location + first4/last4 only.
  • Show the plan before any live probe. Stop and ask when a write/destructive test is the only way forward.

Inputs

  • ../../autonomy/policy.json (from policy.example.json): target, scope_lock_host, your own short-lived token, tenant/project headers, rate limit.

Flow

  1. Scope & plan. Load policy. Restate the authorized host, token fingerprint, and the read-only battery you will run. Get go-ahead.

  2. Deterministic core. Run the runner and read its JSON:

    python3 ../../autonomy/probe_runner.py --policy ../../autonomy/policy.json

    It performs: discovery (401 + WWW-Authenticate), token-validation matrix (forged variants → expect 401), tools/list, and a no-token deny-probe for every tool. Ingest findings / passed / skipped / tools.

  3. Parallel read-only fan-out (optional). For breadth, spawn up to 3 sub-agents IN PARALLEL, each strictly read-only, each reporting structured results back to you (you hold state). See ../../autonomy/README.md for the exact briefs. Suggested split:

    • discovery-agent — PRM/ASM/well-known review, transport/CORS, error leakage (playbooks: oauth-discovery, protected-resource-metadata, mcp-transport-security).
    • authz-sweep-agent — per-tool authz reasoning + tenant/project header swaps + IDOR on read tools using IDs surfaced by the runner (playbooks: per-tool-authorization, multi-tenant-isolation). Read-only.
    • injection-probe-agent — tool-poisoning / prompt-injection surface on metadata, resources, tool results (playbook: mcp-metadata-poisoning), benign markers + example.invalid only.

    Do NOT spawn a sub-agent that can call write tools. Sub-agents propose; the coordinator (you) decides; writes go to the human.

  4. Reason & correlate. Merge runner output + sub-agent reports. De-dupe. Separate Confirmed (reproduced) from Suspected. Note coverage gaps explicitly (e.g. cross-user isolation needs a second token — do not mark it passed).

  5. Human-gated deep tests. List the write/destructive and cross-user tests that require a human decision or extra credentials. Never self-approve.

  6. Report & regression. Hand results to the security-report-writer skill; emit findings (../../templates/finding.md), a fix plan, and a regression test per finding + per deny-by-default expectation.

State the orchestrator holds

  • policy (target, scope-lock, token fingerprint)
  • tool inventory + classification
  • discovered IDs (note/project/resource) for IDOR reasoning
  • per-check verdicts (pass / finding / skipped-human-gate)

What this skill will NOT do autonomously

  • Call any write/destructive tool with a valid token.
  • Probe a host outside scope_lock_host.
  • Run the browser-OAuth login (a human completes it; capture the token, add it to policy, then re-run — see ../../playbooks/browser-login-flow-review.md).
  • Mark an untested control as passed.