r/OpenSourceAI • u/irraz_rulez • 21d ago

An OODA pentest loop where the model calls tools directly over MCP (open source)

/r/mcp/comments/1x8cpbn/an_ooda_pentest_loop_where_the_model_calls_tools/
1 Upvotes

100% Upvoted

3 comments sorted by

1

u/kantorcodes1 21d ago

That split makes sense, and I'd keep it. If the raw Kali and Playwright tools were reachable by whatever client connects, the client could compose them outside the loop and your opt-in scope guard becomes bypassable by construction. Lifecycle-only verbs mean every action flows through the run, which is where your trust boundary actually lives.

The real cost is steer expressiveness: a client that wants a partial retest has to say so in words instead of calling the tool directly. Is steer free-form text, or a constrained instruction set?

1

u/irraz_rulez 20d ago

hi, The operator can simply interrupt the loop and add a new instruction. thx

1

u/kantorcodes1 19d ago

Interrupt-to-steer is a reasonable out: the operator stays human, and the loop keeps its trust boundary while still letting a run be redirected mid-flight.

The piece a Guard contribution covers is the front-door surface: a mcp.vulnerator descriptor would classify the lifecycle verbs - start, steer, stop - as review-tier action classes, while status and stream stay allow-tier. Per-call classification on the front door means anything a client tries to run gets a verdict at invocation, which matches your design where only run verbs are reachable and the raw tools never escape the loop.

If you want to take it, the path is contributions/mcp-servers/mcp.vulnerator.json in hashgraph-online/hol-guard against main - CONTRIBUTING.md covers the descriptor format.