run_joomscan

What run_joomscan does on Pentester-MCP

AI agents invoke run_joomscan to trigger actions in Pentester-MCP. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why run_joomscan is rated High

JoomScan is an active web application scanner that probes target Joomla installations for vulnerabilities, misconfigurations, and exploitable components. It executes network requests against external targets, making it an Execute-category tool. The server context confirms tools are run autonomously against targets. Misuse could involve unauthorized scanning of third-party systems, hence high severity.

From the tool's definition Tool name 'run_joomscan' on a server explicitly designed to 'autonomously execute over 200 open-source penetration testing tools' including 'web exploitation'. JoomScan is a well-known Joomla CMS vulnerability scanner used in penetration testing.

The rule that runs run_joomscan safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Pentester-MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For run_joomscan, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "run_joomscan": {
      "limits": [
        {
          "counter": "run_joomscan_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about run_joomscan