http_compare

What http_compare does on Kali Security MCP

AI agents invoke http_compare to trigger actions in Kali Security MCP. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why http_compare is rated High

This tool sends HTTP requests and compares responses specifically for blind injection detection (SQL injection, command injection, etc.). It actively triggers external HTTP operations to probe target systems for vulnerabilities. In the context of a penetration testing server with siblings like adaptive_sqli_test and adaptive_cmdi_test, it is part of an attack/assessment workflow.

From the tool's definition '比较两个HTTP响应的差异 - 用于盲注检测' (Compare differences between two HTTP responses - for blind injection detection); part of a penetration testing server with tools like adaptive_sqli_test and adaptive_cmdi_test

The rule that runs http_compare safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Kali Security MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For http_compare, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "http_compare": {
      "limits": [
        {
          "counter": "http_compare_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about http_compare