High-risk tools in Redteam

High severity Redteam MCP Server 18 of 20 tools

18 of the 20 tools in Redteam are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at high risk

amass_enum Execute

Perform in-depth DNS enumeration and attack surface mapping with Amass.
arjun_params Execute

Discover hidden HTTP GET/POST parameters on a web endpoint.
commix_scan Execute

Detect and exploit OS command injection vulnerabilities.
curl_request Execute

curl_request
dnsrecon_enum Execute

Perform DNS reconnaissance on a target domain.
ffuf_fuzz Execute

ffuf_fuzz
gobuster_dir Execute

gobuster_dir
httpx_probe Execute

httpx_probe
hydra_brute Execute

hydra_brute
msf_auxiliary Execute

Run a Metasploit Framework auxiliary module non-interactively.
nikto_scan Execute

Scan a web server for known vulnerabilities using Nikto.
nmap_scan Execute

Run an Nmap scan against a target.
nuclei_scan Execute

Run Nuclei template-based vulnerability scanner against a target.
sqlmap_scan Execute

sqlmap_scan
sslscan_audit Execute

Audit SSL/TLS configuration of a target for weak ciphers, protocols, and certificates.
subfinder_enum Execute

Enumerate subdomains of a target domain using Subfinder.
whatweb_scan Execute

Identify technologies used by a web application.
wpscan_scan Execute

Scan a WordPress site for vulnerabilities, plugins, themes, and users.

Attacks that target this class

High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

Destructive Action Autonomy
Runaway Tool Loops
Prompt Injection via Tool Results

High-risk tools in Redteam

Tools at high risk

Attacks that target this class

More on Redteam

Enforce policy on every Redteam tool call.