mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-19 23:01:29 +02:00
Yogesh OjhaandClaude Opus 5
0bb32328fa
Recon MCP servers expose one verb: go and scan. reconFTW v5 ships seven tools and not one of them reads a result, because a pipeline that writes files has nothing to query. reNgine's value is the correlated corpus, so this server is read-first — fourteen tools for asking questions, of which four can act and only two reach a target. Wrapping the OpenAPI document instead would have cost 276 tools and 112,600 tokens of definitions, and would still not work, because every result endpoint needs a scan id an agent has no way to choose. Everything lives in mcp/, mounted into the api the way stages/ and reports/ are. The protocol is implemented directly rather than through an SDK: a tools-only server is a small JSON-RPC surface, this keeps the package free of dependencies, and protocol.py is the only module that knows the wire format. Tools are plug-and-play like stages and report sections — one file under mcp/tools/, a Tool subclass whose Input model is both the schema the model plans against and the schema the server validates with. Nothing registers it. mcp/dimensions.py is the second axis, one entry per result dimension, so query_assets, group_assets, surface_brief and describe_query_language each stay short and a sixth dimension is a single entry. ToolResult carries the product's contracts structurally. Every count comes back with the query token that reproduces it, so a number an agent reports equals the rows a human lands on. A dimension nobody has scanned is reported as not scanned rather than as zero, which is why resolve_target resolves the scan that actually covered each dimension instead of taking the newest one. Rows carrying text the scanned party wrote are flagged untrusted, so the model reports them rather than following them. Access is an opaque service token, hashed at rest, bound to a project and a capability set, revocable by row. Read, plan, write and launch are separate; launch is the only one that reaches a machine you do not own and is off at the instance ceiling until an operator raises it. No token may exceed the ceiling, lowering it narrows the tokens that already exist, and tools/list returns only what a token may call. Start and stop live on the MCP page rather than in a config file — the server is mounted in the api, so stopped means refusing connections rather than a supervised daemon, and the dialog says so: stopping does not cancel a scan an agent already started. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J6fcWDtvxTer9chPWAwKd2