Joseph Magly
0c35a833b9
Add user and developer documentation plus Pagenary docsite publishing support. Includes Getting Started, Developer Guide, API and MCP references, Pagenary tenant metadata, npm scripts for sync/build/check/serve, and validation coverage for the generated docsite. Closes #102
66 lines
1.3 KiB
Markdown
66 lines
1.3 KiB
Markdown
# MCP Guide
|
|
|
|
T3MP3ST includes a Model Context Protocol stdio server in `src/mcp-server.ts`.
|
|
|
|
## Start The Server
|
|
|
|
From a development checkout:
|
|
|
|
```bash
|
|
npm run mcp
|
|
```
|
|
|
|
From a built package:
|
|
|
|
```bash
|
|
npm run build
|
|
npm run mcp:prod
|
|
```
|
|
|
|
## Exposed Tool
|
|
|
|
| Tool | Purpose |
|
|
|---|---|
|
|
| `security_recon` | Runs quick DNS and nmap reconnaissance against a hostname or IP |
|
|
|
|
Input schema:
|
|
|
|
```json
|
|
{
|
|
"target": "example.com",
|
|
"scan_type": "quick"
|
|
}
|
|
```
|
|
|
|
`scan_type` may be `quick`, `standard`, `full`, or `stealth`.
|
|
|
|
## Safety And Validation
|
|
|
|
The MCP server validates the target before it reaches a subprocess:
|
|
|
|
- Target must be a hostname or IP-like value matching `[A-Za-z0-9._:-]`
|
|
- Shell metacharacters, spaces, pipes, and command separators are rejected
|
|
- Subprocesses use `execFile`, not a shell
|
|
- Executable names are restricted to an allowlist
|
|
|
|
The current `security_recon` implementation calls:
|
|
|
|
- `dig +short <target> ANY`
|
|
- `nmap` with scan arguments selected by `scan_type`
|
|
|
|
Only use this tool against systems inside your authorized scope.
|
|
|
|
## Example MCP Tool Call
|
|
|
|
```json
|
|
{
|
|
"name": "security_recon",
|
|
"arguments": {
|
|
"target": "scanme.nmap.org",
|
|
"scan_type": "quick"
|
|
}
|
|
}
|
|
```
|
|
|
|
The response is JSON text containing DNS records, nmap output, command summaries, and suggested next steps.
|