# create_vulnerability_report

A write tool on the Hexstrike Ai MCP server.

Agent View of the PolicyLayer registry record for `create_vulnerability_report`. HTML page: https://policylayer.com/tools/hexstrike-ai/create-vulnerability-report

## Facts

- Tool: `create_vulnerability_report`
- Server: Hexstrike Ai (`0x4m4/hexstrike-ai`) — https://policylayer.com/tools/hexstrike-ai.md
- Homepage: https://github.com/0x4m4/hexstrike-ai
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "create_vulnerability_report",
    "arguments": {}
  }
}
```

## Why create_vulnerability_report is rated Medium

The tool creates (writes) vulnerability reports, which are data artifacts. While the empty description limits confidence, the name and server context indicate this produces new data that could be used to document or communicate security findings. This is Write rather than Execute/Destructive because it generates a report (reversible data creation) rather than directly exploiting systems or deleting data.

From the tool's own definition: "Tool name is 'create_vulnerability_report'; description is empty but context shows this is part of a pentesting/security research server ('automated pentesting, vulnerability discovery, bug bounty automation')."

## Use case

AI agents use create_vulnerability_report to create or update resources in Hexstrike Ai, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Hexstrike Ai environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Hexstrike Ai:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "create_vulnerability_report": {
      "limits": [
        {
          "counter": "create_vulnerability_report_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Hexstrike Ai (149)

- `clear_cache` — Destructive — https://policylayer.com/tools/hexstrike-ai/clear-cache.md
- `delete_file` — Destructive — https://policylayer.com/tools/hexstrike-ai/delete-file.md
- `advanced_payload_generation` — Execute — https://policylayer.com/tools/hexstrike-ai/advanced-payload-generation.md
- `ai_generate_attack_suite` — Execute — https://policylayer.com/tools/hexstrike-ai/ai-generate-attack-suite.md
- `ai_generate_payload` — Execute — https://policylayer.com/tools/hexstrike-ai/ai-generate-payload.md
- `ai_reconnaissance_workflow` — Execute — https://policylayer.com/tools/hexstrike-ai/ai-reconnaissance-workflow.md
- `ai_test_payload` — Execute — https://policylayer.com/tools/hexstrike-ai/ai-test-payload.md
- `ai_vulnerability_assessment` — Execute — https://policylayer.com/tools/hexstrike-ai/ai-vulnerability-assessment.md
- `amass_scan` — Execute — https://policylayer.com/tools/hexstrike-ai/amass-scan.md
- `angr_symbolic_execution` — Execute — https://policylayer.com/tools/hexstrike-ai/angr-symbolic-execution.md
- `api_fuzzer` — Execute — https://policylayer.com/tools/hexstrike-ai/api-fuzzer.md
- `arjun_parameter_discovery` — Execute — https://policylayer.com/tools/hexstrike-ai/arjun-parameter-discovery.md
- `arjun_scan` — Execute — https://policylayer.com/tools/hexstrike-ai/arjun-scan.md
- `arp_scan_discovery` — Execute — https://policylayer.com/tools/hexstrike-ai/arp-scan-discovery.md
- `autorecon_comprehensive` — Execute — https://policylayer.com/tools/hexstrike-ai/autorecon-comprehensive.md
- `autorecon_scan` — Execute — https://policylayer.com/tools/hexstrike-ai/autorecon-scan.md
- `binwalk_analyze` — Execute — https://policylayer.com/tools/hexstrike-ai/binwalk-analyze.md
- `browser_agent_inspect` — Execute — https://policylayer.com/tools/hexstrike-ai/browser-agent-inspect.md
- `bugbounty_authentication_bypass_testing` — Execute — https://policylayer.com/tools/hexstrike-ai/bugbounty-authentication-bypass-testing.md
- `bugbounty_business_logic_testing` — Execute — https://policylayer.com/tools/hexstrike-ai/bugbounty-business-logic-testing.md
- `bugbounty_comprehensive_assessment` — Execute — https://policylayer.com/tools/hexstrike-ai/bugbounty-comprehensive-assessment.md
- `bugbounty_file_upload_testing` — Execute — https://policylayer.com/tools/hexstrike-ai/bugbounty-file-upload-testing.md
- `bugbounty_osint_gathering` — Execute — https://policylayer.com/tools/hexstrike-ai/bugbounty-osint-gathering.md
- `bugbounty_reconnaissance_workflow` — Execute — https://policylayer.com/tools/hexstrike-ai/bugbounty-reconnaissance-workflow.md
- `bugbounty_vulnerability_hunting` — Execute — https://policylayer.com/tools/hexstrike-ai/bugbounty-vulnerability-hunting.md
- `burpsuite_alternative_scan` — Execute — https://policylayer.com/tools/hexstrike-ai/burpsuite-alternative-scan.md
- `burpsuite_scan` — Execute — https://policylayer.com/tools/hexstrike-ai/burpsuite-scan.md
- `checkov_iac_scan` — Execute — https://policylayer.com/tools/hexstrike-ai/checkov-iac-scan.md
- `clair_vulnerability_scan` — Execute — https://policylayer.com/tools/hexstrike-ai/clair-vulnerability-scan.md
- `comprehensive_api_audit` — Execute — https://policylayer.com/tools/hexstrike-ai/comprehensive-api-audit.md
- …and 119 more: https://policylayer.com/tools/hexstrike-ai.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=hexstrike-ai · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/hexstrike-ai