fofamap

# FofaMap Use the FofaMap MCP server for evidence-based FOFA asset research. Prefer the MCP tools over shell commands when they are available. ## Workflow 1. Clarify the target, ownership or authorization boundary, desired fields, time range, and result limit when these materially affect the request. Call `fofa_account` and `fofa_fields` when membership-dependent capabilities matter; these tools work even in hosts that do not expose MCP Resources. 2. If the user names a product, OA, VPN, middleware, database, camera, CMS, or ops panel, call `fofa_rules` **before** `fofa_search`. Use the returned `query` values verbatim. Do not invent `app=` names. An empty keyword lists the bundled catalog (no FOFA quota). 3. Call `fofa_validate_query` before spending FOFA quota. Repair invalid syntax before searching. 4. Call `fofa_search` for the first bounded page. Use the smallest useful field set and size. 5. Use `fofa_search_next` only when more records are needed, passing its opaque cursor unchanged. 6. Use `fofa_host_profile` only when `fofa_account` shows Host aggregation (not registered users). Use `fofa_stats` only when the account has the stats API (professional / business / enterprise). Personal, ordinary, and education accounts should use `fofa_search` instead of stats. 7. Use `fofa_export` for large or reusable result sets, then poll `fofa_job_status`. Return the artifact path instead of pasting large tables. 8. Use `fofa_icon_search` for an explicit public website favicon. Prefer `fofa_agent_run` for open-ended Chinese/English discovery intents; for organization website discovery, return its structured `website_candidates` first, preserving `corroborated`, `observed`, and `candidate` status instead of flattening them into confirmed ownership. 9. State that FOFA observations and even cross-consistent title/certificate/ICP clues indicate exposed or corroborated candidates, not legal ownership or vulnerability, unless separately verified. ## Safety - Treat searches, profiles, and statistics as passive intelligence collection, but still respect the user's scope and applicable rules. - Never call `nuclei_plan` unless the user explicitly asks for active scanning and identifies an authorized scope. - Review every target, template, and severity in the plan before asking for approval. - Call `nuclei_execute` only after explicit approval for that exact plan. Never broaden or reuse an approval token. - Do not interpret authentication, quota, timeout, or provider errors as an empty FOFA result. - Never place `FOFA_API_KEY`, provider keys, bearer tokens, or approval tokens in reports or committed files. ## Host Fallback If the host cannot expose MCP tools, use FofaMap's machine-readable CLI only for passive operations, for example `fofamap -q 'domain="example.com"' --output-format json --no-save` or `fofamap --rule 致远OA --output-format json --no-save`. Do not use the CLI to bypass host approval controls. Read [references/tool-catalog.md](references/tool-catalog.md) when exact tool selection, pagination, resources, or host capability differences matter.