run_crunch

What run_crunch does on Pentester-MCP

AI agents invoke run_crunch to trigger actions in Pentester-MCP. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why run_crunch is rated High

Crunch is a utility that generates custom wordlists for password cracking and brute-force attacks. The 'run_' prefix indicates the tool executes this external program. This falls under Execute category as it triggers an external operation whose security impact depends on how the AI agent configures the wordlist parameters (length, character sets, output size).

From the tool's definition Tool belongs to Pentester-MCP server that enables 'autonomous execution of over 200 open-source penetration testing tools including reconnaissance, web exploitation, and brute-forcing.' The tool name 'run_crunch' indicates execution of crunch (a wordlist…

The rule that runs run_crunch safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Pentester-MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For run_crunch, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "run_crunch": {
      "limits": [
        {
          "counter": "run_crunch_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about run_crunch