hercules-application-testing

Files (22)

• SKILL.md
• ai-trust-boundaries.md · references/
• api-abuse-controls.md · references/
• api-authorization.md · references/
• business-logic.md · references/
• command-injection.md · references/
• deserialization.md · references/
• file-upload.md · references/
• graphql.md · references/
• idor.md · references/
• jwt-validation.md · references/
• oauth-flow.md · references/
• open-redirect.md · references/
• parameter-pollution.md · references/
• race-condition.md · references/
• request-smuggling.md · references/
• sqli.md · references/
• ssrf.md · references/
• ssti.md · references/
• waf-differential.md · references/
• xss.md · references/
• xxe.md · references/

SKILL.md (first lines)

# Hercules application-testing

Choose one topic below, then read only that reference. Use `network_curl` for reproducible request pairs and browser tools for rendered state or multi-step interaction. Confirm target scope and disposable test identities. Check positive and negative controls before scanning broadly. Obscura does not enforce CSP and has no SSRF boundary; never call a browser result proof of Chromium parity or browse an unapproved destination.

## Select one topic

- [AI-assisted application trust boundaries](references/ai-trust-boundaries.md)
- [API business abuse controls](references/api-abuse-controls.md)
- [API authorization and schema](references/api-authorization.md)
- [JWT validation](references/jwt-validation.md)
- [OAuth and OpenID flow](references/oauth-flow.md)
- [Business-logic invariants](references/business-logic.md)
- [Untrusted deserialization](references/deserialization.md)
- [File upload validation](references/file-upload.md)
- [GraphQL query boundaries](references/graphql.md)
- [Object-reference authorization](references/idor.md)
- [Redirect destination validation](references/open-redirect.md)
- [Duplicate parameter handling](references/parameter-pollution.md)
- [Concurrent state transitions](references/race-condition.md)
- [Command execution boundary](references/command-injection.md)
- [HTTP request-framing disagreement](references/request-smuggling.md)
- [SQL injection validation](references/sqli.md)
- [Server-side outbound request control](references/ssrf.md)
- [Template-expression handling](references/ssti.md)
- [WAF and application differential](references/waf-differential.md)
- [Cross-site scripting validation](references/xss.md)
- [XML external entity handling](references/xxe.md)

The reference is guidance, not authorization. Check the current MCP schema and installed backend before executing a suggested route. If a prerequisite is absent, report the coverage gap instead of inventing a tool or widening scope.

## Finish

Remove disposable records and markers only within the approved fixture, retain request/response artifacts, settle owned jobs, and stop the Hercules container after coordinated work.

From 0xMihirK/hercules-mcp, MIT.

More from 0xMihirK/hercules-mcp