______________________________________________________________________
~~(Start drawing the pie)~~A MCP server based on LLM driver that integrates intelligence collection, threat modeling, vulnerability analysis, vulnerability exploitation, post penetration attacks, reporting, and repair. Compared to the traditional Agent model, its cross platform interoperability, security, and permission control have more advantages
Acknowledgments
Subdomain collection:shmilylty/OneForAll
Path discovery:maurosoria/dirsearch
Development SDK:modelcontextprotocol/python-sdk
Directory Structure
/Scan_Tool/
├── OneForAll/ # 子域收集脚本
│ ├── .venv/ # Python 3.8
│ ├── oneforall.py
│ └── ...
└── mcp-server/ # MCP Server
├── .venv/ # Python 3.12
├── mcp_server.py
├── pyproject.toml
└── ...environment setup
This project uses uv Manage it
# 渗透相关工具环境
cd ./OneForAll/
uv venv --python 3.8
source .venv/bin/activate
uv pip install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/
# 检查环境
./oneforall.py --help
# mcp服务器环境
cd .mcp-server/
uv syncImport MCP server from JSON
Using VSCode mcp.json for example
{
"servers": {
"Scanner_Hub": {
"command": "uv", // Windows环境下可能需要替换为绝对路径
"args": [
"--directory",
"PATH/TO/mcp-server", // mcp-server文件夹的路径
"run",
"python",
"-u",
"main.py"
],
"env": {
"PYTHONUNBUFFERED": "1"
}
}
}
}Original language summary
Tools
| Name | Parameters | Function Description |
|---|---|---|
| Submaain_comcollect | domain: Target primary domain name | Asynchronous start of OneForAll subdomain collection task. |
| Check_ofa_stus | domain: Target primary domain name | Check if the OneForAll result table has been generated to determine if the task has been completed. |
| Get_dab schema | None | View the table structure of the OneForAll result library. |
| Searchable db | SQL: SQL query statement | Execute queries in the OneForAll result library, supporting filtering/statistics. |
| Dirsearch | domain: Target domain/URL | Asynchronous start dirsearch directory scan to generate Markdown report. |
| Checkd_dsr_status | domain: Target domain/URL | Check if the dirsearch report has been generated. |
Prompts
| Name | Parameters | Function Description |
|---|---|---|
| Pentest.exe | Domain: Target Domain | Enter Penetration Testing Expert Mode |
Resources
| Name | Parameters | Function Description |
|---|---|---|
| Getunreport | domain_underscored | Read the dirsearch Markdown scan report content for the specified domain name. |
ALL
- \[x\] Environment construction
- \[x\] Subdomain collection function
- \[\] Spatial surveying function
- \[x\] Fingerprint recognition function
- \[x\] Path discovery function
- \[\] Attack Vector Analysis