Run any Skill in Manus with one click

mcp-manager

Stars21

Forks2

UpdatedJune 1, 2026 at 05:38

Discover and invoke MCP tools registered in `.pentester/mcp/`. Automatically consulted before each PTES phase. Manually triggered via /pentester:mcp.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

fb0sh

fb0sh/pentester

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Computer Occupations, All OtherComputer and Mathematical Occupations·SOC 15-1299

SKILL.md

readonly

name	mcp-manager
description	Discover and invoke MCP tools registered in `.pentester/mcp/`. Automatically consulted before each PTES phase. Manually triggered via /pentester:mcp.

MCP Tool Manager

Manage and invoke Model Context Protocol (MCP) tools for penetration testing. MCP servers are hosted externally; this skill manages client-side discovery and invocation.

When to Use

自动触发：每个 PTES 阶段开始前，ROLE.md §5 要求检查 mcp/INDEX.md
用户要求 "调用 MCP 工具"、"执行扫描"、"使用自动化工具"
发现可用 MCP 工具注册在 .pentester/mcp/ 时

How to Use

Step 1: Discover Available Tools

Open .pentester/mcp/INDEX.md to see all registered MCP tools by category.

Each tool has its own subdirectory under .pentester/mcp/<tool-name>/ with:

README.md — Tool description, parameters, server endpoint, invocation examples
examples.md — Usage examples with sample inputs/outputs

Step 2: Read Tool Specification

For the selected tool, read its README.md to understand:

What the tool does (capabilities and limitations)
Parameters required (endpoint, authentication, input format)
Output format (how results are returned)
Risk level and authorization requirements

Step 3: Invoke the Tool

Invocation method depends on how the tool is implemented:

Method A: Via Pi Extension (preferred if available)

If a pi extension registers the tool via pi.registerTool(), call it directly as a built-in tool.

Method B: Via MCP CLI Client

# Using mcp-cli or similar client
mcp call <server-name> <tool-name> --params '{"key": "value"}'

Method C: Via HTTP (if server exposes HTTP endpoint)

curl -s -X POST <server-url>/call \
  -H "Content-Type: application/json" \
  -d '{"tool": "<tool-name>", "params": {"key": "value"}}'

Step 4: Process Results

Parse the tool output and extract relevant findings
Write findings to target/${IP}/ following the project data structure
If the tool discovered new vulnerabilities or methods, consider recording via knowledge-base skill

Phase-Specific MCP Tool Lookup

PTES Phase	MCP Tool Category to Check
Pre-engagement	Scope/target initialization tools
Intelligence Gathering	Information gathering tools
Vulnerability Analysis	Vulnerability scanning/analysis tools
Exploitation	Exploitation tools
Reporting	Report generation tools

Safety Rules

Never pass target credentials or API keys in plaintext in tool parameters unless authorized
Verify tool risk level before invocation (check README.md risk section)
Document all tool calls and results in target/${IP}/
If a tool performs destructive actions (write, delete, modify), pause for user confirmation
Report any MCP server connection issues to the user

More from this repository

same repository

setup-pentester-tools

fb0sh/pentester

初始化渗透测试环境——检查并安装 Playwright 浏览器、Docker Kali 镜像等依赖。

2026-07-1021

src-hunter

fb0sh/pentester

实战 SRC / 众测 / Bug bounty 漏洞挖掘 playbook 库（在 pentester 框架中以 playbook 源方式使用，不独立触发工作流）。包含：19 个攻击类 playbook（SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS）、305 个结构化 payload、263 个 WAF/EDR 绕过变体、2887 份 HackerOne 真实 High/Critical 已披露案例、国产 OA / 中间件指纹库。

2026-07-1021

knowledge-base

fb0sh/pentester

Query, create, update, and organize reusable penetration testing knowledge under .pentester/knowledge. Manually triggered via /pentester:knowledge-base.

2026-07-1021

gen-report

fb0sh/pentester

Collect current project penetration test data and generate a final report following the PTES report template. Manually triggered via /pentester:gen-report.

2026-06-0121

enum-services

fb0sh/pentester

Run comprehensive service enumeration on a target including port scanning, version detection, and protocol-specific enumeration. Manually triggered via /pentester:enum-services or auto-suggested after target initialization.

2026-05-2821

init-target

fb0sh/pentester

Initialize target directory structure and Docker container for a new penetration test target. Manually triggered via /pentester:init-target or auto-suggested when a new target IP is provided.

2026-05-2821

name	mcp-manager
description	Discover and invoke MCP tools registered in `.pentester/mcp/`. Automatically consulted before each PTES phase. Manually triggered via /pentester:mcp.

MCP Tool Manager

Manage and invoke Model Context Protocol (MCP) tools for penetration testing. MCP servers are hosted externally; this skill manages client-side discovery and invocation.

When to Use

自动触发：每个 PTES 阶段开始前，ROLE.md §5 要求检查 mcp/INDEX.md
用户要求 "调用 MCP 工具"、"执行扫描"、"使用自动化工具"
发现可用 MCP 工具注册在 .pentester/mcp/ 时

How to Use

Step 1: Discover Available Tools

Open .pentester/mcp/INDEX.md to see all registered MCP tools by category.

Each tool has its own subdirectory under .pentester/mcp/<tool-name>/ with:

README.md — Tool description, parameters, server endpoint, invocation examples
examples.md — Usage examples with sample inputs/outputs

Step 2: Read Tool Specification

For the selected tool, read its README.md to understand:

What the tool does (capabilities and limitations)
Parameters required (endpoint, authentication, input format)
Output format (how results are returned)
Risk level and authorization requirements

Step 3: Invoke the Tool

Invocation method depends on how the tool is implemented:

Method A: Via Pi Extension (preferred if available)

If a pi extension registers the tool via pi.registerTool(), call it directly as a built-in tool.

Method B: Via MCP CLI Client

# Using mcp-cli or similar client
mcp call <server-name> <tool-name> --params '{"key": "value"}'

Method C: Via HTTP (if server exposes HTTP endpoint)

curl -s -X POST <server-url>/call \
  -H "Content-Type: application/json" \
  -d '{"tool": "<tool-name>", "params": {"key": "value"}}'

Step 4: Process Results

Parse the tool output and extract relevant findings
Write findings to target/${IP}/ following the project data structure
If the tool discovered new vulnerabilities or methods, consider recording via knowledge-base skill

Phase-Specific MCP Tool Lookup

PTES Phase	MCP Tool Category to Check
Pre-engagement	Scope/target initialization tools
Intelligence Gathering	Information gathering tools
Vulnerability Analysis	Vulnerability scanning/analysis tools
Exploitation	Exploitation tools
Reporting	Report generation tools

Safety Rules

Never pass target credentials or API keys in plaintext in tool parameters unless authorized
Verify tool risk level before invocation (check README.md risk section)
Document all tool calls and results in target/${IP}/
If a tool performs destructive actions (write, delete, modify), pause for user confirmation
Report any MCP server connection issues to the user