MCP Tools

Return a random ParaCyberBellum message of the day with its author.

No parameter

Generate a random corporate jargon sentence from the ParaCyberBellum Pipotron database.

No parameter

Compute the HMAC of a message with a secret key.

Hash a text and return the intermediate steps of the computation.

Look an MD5 or SHA1 hash up in the public reverse hash databases and return its clear text when it is known. An unknown hash reports `found` as false.

Decode a JSON Web Token, annotate its exp, iat and nbf claims with their date and their validity, and verify its signature when a secret is supplied. The header and the payload are always returned, whether the signature is valid or not.

Build and sign a JSON Web Token. The standard time claims are injected only when the payload does not already carry them.

Apply a Python regular expression to a text and return every match with its position and its capture groups.

Compute the Shannon entropy of a string, with its length and its unique character count. A high entropy points at a key, a token or an encrypted payload.

Guess the possible types of a string by matching it against the ParaCyberBellum pattern database: hashes, tokens, identifiers, encoded values and network objects.

Decode a base64, hexadecimal or URI percent encoded string. The hexadecimal decoder accepts the \x and 0x prefixes and the space separated forms.

Encode a string to base64, hexadecimal or URI percent encoding.

Convert a human date and time to the machine timestamp formats: Unix epoch in seconds and milliseconds, ISO 8601, RFC 2822, Windows FILETIME, Mac Absolute Time and HFS+ timestamp.

Validate a JSON string and return the parsed structure, or the parsing error and its position when it is malformed.

Generate a QR code from a text and return it as a base64 encoded PNG image.

Convert a machine timestamp to the human readable date and time formats.

Split a URL into its components and percent decode them: scheme, host, port, path, query string, fragment and the individual query parameters.

Split a URL into its components without decoding them, to inspect the raw encoded values. Use `url_decode` to read the decoded ones.

Identify the type and the MIME type of a file from its content, whatever its extension.

Look a file hash up in the CIRCL hashlookup database of known files, from a hash value or from a file whose hash is computed first. An unknown hash is a successful lookup reporting `found` as false.

Extract the metadata of an image: format, dimensions, colour mode, EXIF fields and GPS coordinates when the picture is geotagged.

Embed JavaScript into a PDF file and return the modified document, base64 encoded. Used to test the JavaScript execution policy of the PDF readers.

Extract the text content of a PDF file, page by page.

Compare the checksum stored in the optional header of a Windows PE file with the checksum computed from its content. A mismatch indicates a tampered binary.

Scan the import table of a Windows PE file and report the API functions known to be used by malware, with their description and the attack techniques they serve.

Hide a text message inside an image with LSB steganography and return the resulting PNG, base64 encoded. The message is encrypted with AES-GCM when a secret is supplied.

Extract a message hidden in an image by `image_hide_message`.

Return the description of a Windows API function and the attack techniques malware uses it for. A function absent from the database reports `found` as false.

Compile a set of YARA rules and match them against a file, reporting the matching rules with their tags, metadata and matched strings.

Return the default credentials published for a vendor, from the DefaultCreds cheat sheet database. A vendor with no known default credentials returns an empty list.

Return the vendor names of the default credentials database matching a search string, at most 50. Call it to find the exact vendor name `default_credentials` expects.

Return the leaked NTLM hashes starting with a five character prefix, with the number of times each one appears in the breach corpus. The prefix based query never discloses the searched hash to the service.

Rank a PIN code against the leaked PIN codes database. The returned strength is the position of the PIN in the frequency ordered list divided by the size of the PIN space: the closer to zero, the more common and the weaker the PIN.

Return the credentials found in the public breach compilations for a user name, an email address or a domain.

Identify a known weak cryptographic secret across the web frameworks covered by badsecrets: ASP.NET machine keys, Flask, Django, Rails, Express, Symfony and others. A secret which is not a known weak one reports `found` as false.

Search the Certificate Transparency logs for the certificates issued for a domain, which reveals its subdomains. Queries the Cert Spotter API.

Resolve a DNS record for a domain name.

Return the WHOIS registration data of a domain name: registrar, creation, update and expiration dates, name servers, status and contacts.

Validate an email address: syntax, existence of the MX records of its domain, and membership of its domain in the disposable email domains list.

Download the favicon of a web site, compute its MMH3 hash and build the Shodan search URL listing every host serving the same favicon.

Return the geolocation and the network ownership of an IP address: organization, city, region, country, timezone, coordinates, ISP and autonomous system.

Check an IP address against the ParaCyberBellum threat intelligence bad IP lists: PyRASP blacklist, Tor exit nodes, open HTTP, SOCKS4 and SOCKS5 proxies.

Compute the network address, netmask, broadcast address, first and last usable hosts and the host count of an IPv4 subnet.

Return the vendor and the allocation block of a MAC address. A MAC address with no known vendor is a successful lookup reporting `found` as false.

Return the public IP address the caller is seen from, its geolocation and the request headers received by the server. Use it to answer "what is my IP address".

No parameter

Resolve the PTR record of an IP address. An address without a reverse record is a successful lookup reporting that no record was found.

Validate the email authentication DNS records of a domain: SPF, DMARC, MX and the problems found in them.

Retrieve and analyse the TLS certificate served by a host: subject, issuer, validity dates, subject alternative names, fingerprints and chain. An expired or self signed certificate is reported, not rejected.

Return the Active Directory attack commands matching the selected criteria. The accepted values are listed by `ad_commands_options`.

Return the filter values available in the Active Directory attack commands database: operating systems, attack types, services and required items. Call it before `ad_commands` to know which values it accepts.

No parameter

Search GitHub for the repositories holding an exploit or a proof of concept for a CVE, by repository name then by readme content.

Fetch a web page, typically a threat report, and extract its indicators of compromise: IP addresses, domains, URLs, file hashes, CVE identifiers, email addresses, registry keys, file paths and YARA rules.

Generate the obfuscated representations of an IPv4 address used to bypass the filters: dotted and full decimal, hexadecimal and octal, zero padded and mixed forms.

Build a reverse shell command and the matching listener command.

Obfuscate a JavaScript or PowerShell script by renaming its functions and variables, substituting its strings and flattening its content.