Recon and attack surface
1 tool (+1 demo). Compare how each tool runs, what it needs, where it sends data, what it can change and what its code can touch. Feed: /tasks/recon-attack-surface/feed.xml
| Tool | Runs and needsWhere the tool runs and what must be in place before it works. | Sends data toOutside parties the tool contacts, read from the code and the documentation. Other connections are not ruled out. | Can change thingsWhether the tool's functions only read, or also create, change or delete things, run commands, or send data out. | How to run itThe run advice where we have read the tool under the verdict rule, else what the code shows; below it, whether it has run in our lab. |
|---|---|---|---|---|
| HexStrike AIDraft · awaiting review MCP server that lets an agent drive more than 150 offensive security tools through a local API server, including arbitrary shell commands. MCP server · 0x4m4, pushed 2026-08-03 | Local service; listens on all interfaces without sign-in Works with: Any MCP client Needs: Python 3.8 or later; The 150+ external security tools installed separately; Kali Linux includes most; +5 more | NVD (nvd.nist.gov), GitHub API, User-named target, PyPI (pip) | changes, deletes, runs commands | Run isolated Its API listens on all network interfaces with no login and runs any shell command it receives. Not run yet |
| Example Recon SkillDemo · fictional Enumerates subdomains and open ports of a declared target and writes a Markdown report. Skill · example, pushed 2026-10-09 | Inside your AI client Works with: Claude Code, Codex, Gemini CLI Needs: nmap installed on your machine; Permission to test the target you name | Your target, api.example.net | changes, runs commands, sends data out | Code shows: writes outside the project · talks to any host · runs shell commands or eval Ran once, 2026-10-10: did more than it said |