MCP Autopentest Orchestrator

MCP Autopentest Orchestrator

Semi-autonomous driver for the kit. Read ../../SECURITY_RULES.md first — it overrides everything here.

Autonomy boundary (non-negotiable):

• Read-only by default. The deterministic runner never calls write/destructive tools authenticated; the orchestrator must not either. Writes = human gate.
• Scope-lock: one authorized host, taken from policy.json. Never probe a host not in scope (no SSRF-out, no prod-by-accident).
• Rate-limit per policy. This is assessment, not load testing.
• Redact secrets: type + location + first4/last4 only.
• Show the plan before any live probe. Stop and ask when a write/destructive test is the only way forward.

Inputs

• ../../autonomy/policy.json (from policy.example.json): target, scope_lock_host, your own short-lived token, tenant/project headers, rate limit.

Flow

1. Scope & plan. Load policy. Restate the authorized host, token fingerprint, and the read-only battery you will run. Get go-ahead.

2. Deterministic core. Run the runner and read its JSON:

   python3 ../../autonomy/probe_runner.py --policy ../../autonomy/policy.json
   

   It performs: discovery (401 + WWW-Authenticate), token-validation matrix (forged variants → expect 401), tools/list, and a no-token deny-probe for every tool. Ingest findings / passed / skipped / tools.

3. Parallel attacker-profile fan-out (optional). For breadth, spawn the personas from ../../playbooks/attacker-profiles.md IN PARALLEL, each strictly read-only, each reporting structured results back to you (you hold state):

   • P1 Outsider (no credentials / off-VPN) — token battery from the outsider vantage, discovery, route/error mining. Runnable now, no token.
   • P2 Low-priv insider — per-tool authz, IDOR, tenant tampering, escalation (cross-user needs a 2nd identity → gate).
   • P3 Injection specialist — tool-poisoning / prompt-injection / insecure output handling. Benign [TEST-POISON] + example.invalid only.
   • P4 Resilience / rate-limit — controlled rate-limit / token-entropy / cost. Owned/staging, low volume. No blind token brute-force (futile + DoS + against the rules).

   For SSO/OAuth + VPN targets, also run ../../playbooks/enterprise-access-layer.md (SSO/SAML federation, deprovisioning, VPN-as-control). The agent uses your live SSO session — it does not perform the SSO login itself.

   Do NOT spawn a sub-agent that can call write tools. Sub-agents propose; the coordinator (you) decides; writes go to the human.

4. Reason & correlate. Merge runner output + sub-agent reports. De-dupe. Separate Confirmed (reproduced) from Suspected. Note coverage gaps explicitly (e.g. cross-user isolation needs a second token — do not mark it passed).

5. Human-gated deep tests. List the write/destructive and cross-user tests that require a human decision or extra credentials. Never self-approve.

6. Report & regression. Hand results to the security-report-writer skill; emit findings (../../templates/finding.md), a fix plan, and a regression test per finding + per deny-by-default expectation.

State the orchestrator holds

• policy (target, scope-lock, token fingerprint)
• tool inventory + classification
• discovered IDs (note/project/resource) for IDOR reasoning
• per-check verdicts (pass / finding / skipped-human-gate)

What this skill will NOT do autonomously

• Call any write/destructive tool with a valid token.
• Probe a host outside scope_lock_host.
• Run the browser-OAuth login (a human completes it; capture the token, add it to policy, then re-run — see ../../playbooks/browser-login-flow-review.md).
• Mark an untested control as passed.