# MCP Autopentest Orchestrator

> Semi-autonomous orchestrator for authorized MCP security assessment. Drives the deterministic probe_runner (read-only battery) plus optional parallel read-only sub-agents (discovery / authz-sweep / injection-probe), holds engagement state (tokens, discovered IDs), reasons over structured results, and produces the report. Safe-by-default: read-only, write/destructive tools are human-gated, scope-locked to one host. Use to run the kit with minimal manual curl.

- Skill: `rwcod/mcp-autopentest-orchestrator` (Agent Skill)
- Install (CLI): `npx skillmds@latest add rwcod/mcp-autopentest-orchestrator`
- Raw SKILL.md: https://api.skillmd.com/api/skills/rwcod/mcp-autopentest-orchestrator/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- Author: rwcod (https://skillmd.com/u/rwcod)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/rwcod/mcp-autopentest-orchestrator

---


# MCP Autopentest Orchestrator

Semi-autonomous driver for the kit. Read [../../SECURITY_RULES.md](../../SECURITY_RULES.md)
first — it overrides everything here.

**Autonomy boundary (non-negotiable):**
- Read-only by default. The deterministic runner never calls write/destructive
  tools authenticated; the orchestrator must not either. Writes = **human gate**.
- **Scope-lock:** one authorized host, taken from `policy.json`. Never probe a
  host not in scope (no SSRF-out, no prod-by-accident).
- **Rate-limit** per policy. This is assessment, not load testing.
- **Redact** secrets: type + location + first4/last4 only.
- Show the plan before any live probe. Stop and ask when a write/destructive
  test is the only way forward.

## Inputs
- `../../autonomy/policy.json` (from `policy.example.json`): target,
  scope_lock_host, your own short-lived token, tenant/project headers, rate limit.

## Flow

1. **Scope & plan.** Load policy. Restate the authorized host, token
   fingerprint, and the read-only battery you will run. Get go-ahead.

2. **Deterministic core.** Run the runner and read its JSON:
   ```
   python3 ../../autonomy/probe_runner.py --policy ../../autonomy/policy.json
   ```
   It performs: discovery (401 + WWW-Authenticate), token-validation matrix
   (forged variants → expect 401), `tools/list`, and a no-token deny-probe for
   every tool. Ingest `findings` / `passed` / `skipped` / `tools`.

3. **Parallel attacker-profile fan-out (optional).** For breadth, spawn the
   personas from `../../playbooks/attacker-profiles.md` IN PARALLEL, each strictly
   read-only, each reporting structured results back to you (you hold state):
   - **P1 Outsider** (no credentials / off-VPN) — token battery from the outsider
     vantage, discovery, route/error mining. Runnable now, no token.
   - **P2 Low-priv insider** — per-tool authz, IDOR, tenant tampering, escalation
     (cross-user needs a 2nd identity → gate).
   - **P3 Injection specialist** — tool-poisoning / prompt-injection / insecure
     output handling. Benign `[TEST-POISON]` + `example.invalid` only.
   - **P4 Resilience / rate-limit** — controlled rate-limit / token-entropy /
     cost. Owned/staging, low volume. **No blind token brute-force** (futile +
     DoS + against the rules).

   For SSO/OAuth + VPN targets, also run `../../playbooks/enterprise-access-layer.md`
   (SSO/SAML federation, deprovisioning, VPN-as-control). The agent uses your live
   SSO session — it does not perform the SSO login itself.

   Do NOT spawn a sub-agent that can call write tools. Sub-agents propose; the
   coordinator (you) decides; writes go to the human.

4. **Reason & correlate.** Merge runner output + sub-agent reports. De-dupe.
   Separate Confirmed (reproduced) from Suspected. Note coverage gaps explicitly
   (e.g. cross-user isolation needs a second token — do not mark it passed).

5. **Human-gated deep tests.** List the write/destructive and cross-user tests
   that require a human decision or extra credentials. Never self-approve.

6. **Report & regression.** Hand results to the `security-report-writer` skill;
   emit findings (`../../templates/finding.md`), a fix plan, and a regression
   test per finding + per deny-by-default expectation.

## State the orchestrator holds
- policy (target, scope-lock, token fingerprint)
- tool inventory + classification
- discovered IDs (note/project/resource) for IDOR reasoning
- per-check verdicts (pass / finding / skipped-human-gate)

## What this skill will NOT do autonomously
- Call any write/destructive tool with a valid token.
- Probe a host outside `scope_lock_host`.
- Run the browser-OAuth login (a human completes it; capture the token, add it
  to policy, then re-run — see `../../playbooks/browser-login-flow-review.md`).
- Mark an untested control as passed.