Skip to main content
Glama
sunick2009

OWASP Pentest Guide Knowledge Base

by sunick2009

pentest-guide-kb

A read-only, versioned knowledge base for OWASP testing guides, served over the Model Context Protocol (MCP) so AI agents and IDEs can query them precisely instead of relying on training-data memory.

This project is not an official OWASP project and is not endorsed by OWASP. It compiles and re-serves content from independent OWASP testing guides under their own licenses -- see Licensing. No content from this project's retrieval or recommendation logic is official OWASP guidance; always cite the guide name, version, and source commit a result traces back to.

What it does

  • Precise lookup of a specific OWASP test by id (versioned or canonical).

  • Natural-language search across test procedures (full-text + semantic).

  • Browsing a guide by version, category, platform, or feature keyword.

  • Cross-guide relationship traversal, with provenance on every edge.

  • Version comparison for a test across two compiled guide releases.

  • Candidate-test generation for a target profile -- explicitly labeled unverified candidates, never a completed test plan.

Every result carries full provenance (repository, commit, path, content hash, license), so a citation always traces back to the exact upstream source.

It is a knowledge retrieval service, not an offensive security execution platform. It does not — and will not — execute scanning/exploitation tools, expose a shell, reach a caller-specified target, act as an autonomous pentest agent, or mutate data over MCP (source sync and ingestion are offline CLI-only steps). See SECURITY.md for the full threat model.

Related MCP server: Guild Wars 1 MCP

Architecture

Official OWASP Git Repositories (wstg, mastg, owasp-istg, www-project-ai-testing-guide)
        |
        v
Source Mirror and Version Lock        sources/sources.lock.yaml, sources/.cache/
        |
        v
Deterministic Guide Compilers         src/pentest_guide_kb/ingestion/*
        |
        v
Canonical Registry (PostgreSQL)       src/pentest_guide_kb/storage/*
        |
        +-- metadata + JSONB (test_cases, test_case_sections, ...)
        +-- full-text search (tsvector + GIN)
        +-- pgvector semantic search (embeddings)
        +-- Generated Markdown Wiki    src/pentest_guide_kb/wiki/*
        +-- Optional Neo4j projection  src/pentest_guide_kb/graph/*  (--profile graph)
        |
        v
Read-only MCP Server                  src/pentest_guide_kb/mcp/*
        |
        v
AI Agents and IDE Clients

The PostgreSQL registry is the single source of truth. The Wiki, the vector index, and the Neo4j graph are derived views compiled from it -- none independently store content that could drift out of sync. See docs/architecture.md and docs/data-model.md.

Supported guides

Guide

Short name

Upstream repository

Pinned

OWASP Web Security Testing Guide

WSTG

OWASP/wstg

tag v4.2

OWASP Mobile App Security Testing Guide

MASTG

OWASP/mastg

tag v2.0.0

OWASP IoT Security Testing Guide

ISTG

OWASP/owasp-istg

tag v1.0.1

OWASP AI Testing Guide

AITG

OWASP/www-project-ai-testing-guide

main commit (no tagged release yet)

Exact pins live in sources/sources.lock.yaml (see docs/versioning.md). latest is never a valid version anywhere -- it's rejected by a validator.

Quickstart

Requires Python 3.12+, uv, and Docker.

uv sync --all-extras
cp .env.example .env                    # local-dev defaults, no real secrets
docker compose up -d postgres           # PostgreSQL + pgvector
uv run alembic upgrade head             # apply the schema

uv run pentest-guide source sync --guide wstg   # fetch a pinned source
uv run pentest-guide ingest --all               # compile into the registry
uv run pentest-guide index embeddings           # build the semantic index

uv run pentest-guide query search "credentials over http" --mode hybrid
uv run pentest-guide mcp serve                  # stdio; --transport streamable-http for HTTP

Prefer a container? Pull the prebuilt multi-arch image instead of building: docker pull ghcr.io/sunick2009/mcp-owasp-pentesting-guide:latest -- full run/serve and MCP-client wiring in docs/deployment.md.

Documentation

Topic

Doc

Deploy & connect a client (Compose, GHCR image, MCP config)

docs/deployment.md

Local dev loop (setup, sync, ingest, tests, adding a guide)

docs/development.md

MCP API — 11 tools, 10 resource templates, 5 prompts

docs/mcp-api.md

Architecture & the single-source-of-truth model

docs/architecture.md

Data model & schema

docs/data-model.md

Ingestion — per-guide parsers & determinism

docs/ingestion.md

Retrieval — classify → exact → FTS/vector → RRF → rerank

docs/retrieval.md

Versioning — canonical vs versioned ids, pinning

docs/versioning.md

Licensing & attribution chain

docs/licensing.md

Source pinning workflow

sources/README.md

Security threat model

SECURITY.md

What's implemented vs. known limitations

IMPLEMENTATION_STATUS.md

Glossary

docs/glossary.md

Licensing

  • This project's own code: Apache-2.0 (LICENSE).

  • Each upstream guide's content: CC BY-SA 4.0, per sources/licenses/ -- carried through on every compiled TestCase.source.license.

This repository does not bulk-copy OWASP guide text: source sync + local compilation + provenance reference is the model; committed fixtures under tests/fixtures/ are short, attributed excerpts. See NOTICE and docs/licensing.md for the full attribution chain.

Key file paths

What

Where

Domain models

src/pentest_guide_kb/domain/models.py

Guide parsers

src/pentest_guide_kb/ingestion/{wstg,mastg,istg,aitg}.py

Storage / repositories

src/pentest_guide_kb/storage/

Retrieval pipeline

src/pentest_guide_kb/retrieval/

MCP server

src/pentest_guide_kb/mcp/{server,resources,tools,prompts}.py

CLI

src/pentest_guide_kb/cli.py

Wiki generator + Error Book

src/pentest_guide_kb/wiki/

Neo4j projection (optional)

src/pentest_guide_kb/graph/

Source lock

sources/sources.lock.yaml

Curated relationships

registry/relationships/cross-guide.yaml

Agent Skill

skills/owasp-guide-research/SKILL.md

Tests

tests/{unit,integration,contract,evals}/

Available Tools

11 tools
guide_browse_categoryC

List every test case in one guide/version/category.

ParametersJSON Schema
NameRequiredDescriptionDefault
inputYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. Description claims 'list every test case' but input schema includes an optional `limit` parameter (default 10, max 100), implying pagination and a cap, creating a contradiction. No mention of ordering, error handling, or behavior when no results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence is concise and front-loaded with the core action. However, could include more details without becoming verbose; still efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 4 parameters, no annotations, and 0% schema coverage, description is incomplete. Lacks prerequisites, error cases, and clarification of limit behavior. Output schema exists but does not compensate for missing behavioral context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%. Description does not elaborate on any parameter (guide, version, category, limit) beyond their existence. No format, default values, or constraints explained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states verb 'List', resource 'test cases', and scope 'in one guide/version/category'. It distinguishes from siblings like guide_search (search) and guide_list_tests (likely broader).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives such as guide_search or guide_list_tests. No mention of prerequisites or typical use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

guide_compare_versionsC

Compare a test case's title/objectives/sections/source across two compiled guide versions.

ParametersJSON Schema
NameRequiredDescriptionDefault
inputYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden but only states the action. It does not disclose whether the tool is read-only, requires specific permissions, has rate limits, or what side effects (if any) occur. The description is purely functional without behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that efficiently conveys the core function. However, it could be improved by structuring the explanation to explicitly mention the key parameters (guide, canonical_id, version_a, version_b) for clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the 4 parameters, no annotations, and presence of an output schema (which reduces the need to describe return values), the description still fails to provide essential context like what constitutes a 'guide' or how versions are specified. The tool is underspecified for reliable agent use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, yet the description does not elaborate on any parameter meanings. It implies the parameters correspond to a test case and two versions but omits details like expected formats or relationships. The agent must infer parameter semantics solely from names, which is insufficient for correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description specifies a clear verb 'Compare' and a specific resource: 'test case's title/objectives/sections/source across two compiled guide versions'. It uniquely identifies a comparison operation, clearly distinguishing it from sibling tools like guide_search or guide_browse_category.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like guide_get_test or guide_list_tests. There is no mention of prerequisites, such as needing to identify a test case's canonical_id or versions beforehand, which limits the agent's ability to decide appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

guide_explain_relationshipC

Explain one relationship edge: source test, target test, type, and full provenance (source_type, rationale, confidence, review_status).

ParametersJSON Schema
NameRequiredDescriptionDefault
inputYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must convey all behavioral traits. It mentions it 'explains' but does not state whether it's read-only, has side effects, or requires specific permissions. Minimal disclosure beyond output fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, but it is front-loaded with the purpose. Could be more concise by removing redundant listing of fields, but overall acceptable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists but description fails to clarify how to specify the relationship (by IDs vs relationship_id). For a tool with three optional input fields, more detail is needed to avoid ambiguity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, and description lists 'source test, target test, type, and full provenance' as outputs, not inputs. The actual parameters (source_test_id, target_test_id, relationship_id) are not explained, and their purpose is unclear from the description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool explains a relationship edge and lists the provenance fields it provides. It distinguishes from siblings by focusing on a single relationship rather than listing or searching, though not explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives like guide_get_related_tests or guide_find_by_feature. No exclusions or prerequisites stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

guide_find_by_featureB

Find test cases matching ANY of one or more feature keywords (OR semantics; e.g. oauth, webview, agent-tools). Each result lists which terms matched in matched_terms.

ParametersJSON Schema
NameRequiredDescriptionDefault
inputYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses OR semantics and matched_terms but omits behavioral traits like authentication needs, read-only nature, rate limits, or failure modes. This is insufficient for safe invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded with key semantics and examples, no filler. Earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Has output schema to explain return values, but description lacks edge cases (e.g., no matches) and parameter constraints. Adequate for a simple search but not comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description adds no per-parameter details beyond field names. Parameters like limit and guides remain unexplained, forcing the agent to rely on names and types alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool finds test cases by feature keywords with OR semantics, provides examples (e.g., oauth, webview), and mentions result structure. This distinguishes it from sibling tools like guide_search or guide_browse_category.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context (search with OR semantics) but does not explicitly state when not to use or suggest alternatives. For a feature-driven search, this is sufficient for an agent to infer appropriate use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

guide_get_source_excerptB

Fetch a single section's raw text (or all sections) for a test case, with full provenance.

ParametersJSON Schema
NameRequiredDescriptionDefault
inputYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden for behavioral disclosure. 'Full provenance' hints at metadata, but the description does not clarify read-only status, authentication needs, or side effects. The tool is likely read-only, but this is not stated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single 15-word sentence, front-loaded with the key action and resource. It is concise and efficient, though this brevity omits important details covered in other dimensions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has an output schema (not shown) which reduces the need to describe returns, but with no annotations and no parameter descriptions, the description falls short. It provides minimal context for correct invocation, lacking usage guidance and behavioral details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not mention either parameter (test_id or section). The optional enum for section is not explained, nor is the required test_id. The description adds no value beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the action ('Fetch'), the resource ('raw text of a section for a test case'), and the scope ('single section or all sections') with an additional qualifier ('full provenance'). It clearly differentiates from sibling tools like guide_get_test which likely returns structured test data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for retrieving raw text of a test case section, but it does not provide explicit guidance on when to use this tool versus alternatives like guide_get_test or guide_search. No exclusion criteria or context is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

guide_get_testA

Fetch one test case by versioned id, canonical id, alias, or slug.

ParametersJSON Schema
NameRequiredDescriptionDefault
inputYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It does not disclose whether the operation is read-only, requires authentication, error handling (e.g., not found), or side effects. The boolean flags that affect behavior are not mentioned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with no redundant words, front-loaded with the core action and resource. Every word serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having an output schema and multiple parameters, the description only covers the identifier aspect. It omits details about optional flags, expected output, and error conditions, making it insufficient for complete understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds meaning to test_id by listing allowed identifier types, but does not explain the three boolean parameters (include_inferred, include_full_content, include_relationships). With 0% schema description coverage, the description should compensate for all parameters, but it only partially addresses one.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states verb 'Fetch' and resource 'one test case', and specifies multiple identifier types (versioned id, canonical id, alias, slug). This distinguishes it from sibling tools like guide_list_tests (list) and guide_search (search).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implicitly tells when to use: when you have one of the specified identifiers and need a single test case. No explicit exclusions or alternatives are mentioned, but the context with siblings is clear given the specific identification methods.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

guide_list_testsB

List test cases in a guide/version, optionally filtered by category. Cursor is the offset as a string.

ParametersJSON Schema
NameRequiredDescriptionDefault
inputYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It mentions pagination via cursor as offset, which is useful. However, it does not disclose read-only nature, rate limits, or any side effects. The output schema exists but behavior beyond pagination is unclear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise at two sentences (18 words), with no unnecessary information. It is front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 5 parameters with no schema descriptions and no annotations, the description is insufficient. It omits details on required guide, limit range, and version parameter, leaving the agent guessing. The output schema exists but does not compensate for missing parameter guidance.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%. The description only explains cursor and mentions category filtering, but fails to describe guide, limit, and version parameters. It adds minimal meaning beyond the schema structure.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists test cases in a guide/version, with optional category filtering. It is specific about the resource and action, but does not explicitly differentiate from sibling tools like guide_get_related_tests.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives, nor does it mention prerequisites or exclusions. It only describes a basic usage hint about cursor.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

guide_recommend_candidatesA

Produce CANDIDATE tests for a target system profile. This is not a verified pentest plan and nothing in the output has been executed -- see the uncertainty field.

ParametersJSON Schema
NameRequiredDescriptionDefault
inputYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden. It discloses that the output is unexecuted and unverified, and directs the agent to the 'uncertainty' field, providing useful behavioral context beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loading the purpose and immediately adding a critical caveat. Every sentence earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema and a single complex parameter, the description is moderately complete but lacks detail on what 'candidates' means, how to interpret the output, and the role of optional parameters like guides or include_inferred_relationships.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description has 0% schema coverage and does not explain any parameter beyond mentioning the target system profile. The input schema is relatively self-explanatory, but the description fails to add value for the nested objects like guides or include_inferred_relationships.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it produces candidate tests for a target system profile, using a specific verb and resource. While it distinguishes the tool's purpose from siblings like guide_list_tests, it could explicitly differentiate from guide_get_related_tests.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context by stating the output is not a verified pentest plan and nothing has been executed, but it does not explicitly state when to use this tool over alternatives or provide when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

guide_validate_referenceA

Check whether a test id/version exists and whether a given content hash still matches the compiled registry -- use before trusting a previously-cached citation.

ParametersJSON Schema
NameRequiredDescriptionDefault
inputYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses that the tool checks existence and hash matching but does not mention side effects, auth needs, or error behavior. With an output schema, return values are covered, but further behavioral context would help.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is front-loaded with the core action. No extraneous words, efficiently conveying purpose and usage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low parameter count and the presence of an output schema, the description covers the main purpose and usage scenario. It lacks detail on return values and errors, but these are partially addressed by the output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It maps 'test id/version' to test_id and 'content hash' to expected_content_hash, adding meaningful context beyond the schema's bare property titles.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb ('check') and the resources ('test id/version', 'content hash', 'compiled registry'), making it easy to distinguish from sibling tools like guide_browse_category or guide_search.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'use before trusting a previously-cached citation,' providing clear guidance on when to use. However, it does not mention when not to use or list alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 11 tool updatesv0.1.0
    • First observedguide_browse_category
    • First observedguide_compare_versions
    • First observedguide_explain_relationship
    • First observedguide_find_by_feature
    • First observedguide_get_related_tests
    • First observedguide_get_source_excerpt
    • First observedguide_get_test
    • First observedguide_list_tests
    • First observedguide_recommend_candidates
    • First observedguide_search
    • First observedguide_validate_reference

TDQS

A3.5/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose: browsing categories, comparing versions, explaining relationships, finding by features, traversing relationships, fetching source excerpts, retrieving tests, listing tests, recommending candidates, searching, and validating references. No two tools have ambiguous boundaries.

Naming Consistency5/5

All tool names follow a consistent 'guide_' prefix followed by a verb_noun pattern (e.g., browse_category, compare_versions, get_test). The naming is uniform and predictable, making it easy for agents to infer functionality.

Tool Count5/5

With 11 tools, the set is well-scoped for a knowledge base of OWASP pentesting guides. Each tool addresses a specific access or exploration need without redundancy or excess, earning its place in the surface.

Completeness4/5

The tool set covers browsing, searching, retrieval, comparison, relationship exploration, and reference validation. A minor gap is the lack of a tool to list available guides/versions themselves, but the core query and navigation workflows are well-represented.

Maintenance

ActivitySlowing
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    A
    maintenance
    Public read-only MCP server for turva.dev's agent-readiness audit, enabling AI agents to query service catalog, security evidence, and engagement principles via structured JSON.
    1
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    A read-only MCP server for navigating OpenAPI / Swagger specifications, enabling agents to search endpoints, retrieve parameters and schemas, and inspect authentication without loading the full spec into context.
    9
    19
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/sunick2009/mcp-owasp-pentesting-guide'

If you have feedback or need assistance with the MCP directory API, please join our Discord server