Skip to content

v3.3.0: Endpoint Fuzzing, Dual-Engine Subdomain Discovery, Stream Filtering & MCP Prompts

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Aug 14:41
· 61 commits to main since this release
v3.3.0
db93c36

Overview

Cybermes v3.3.0 introduces native endpoint and parameter fuzzing, dual-engine subdomain discovery, token-optimized stream filtering, MCP resources and workflow prompts, and AI prompt injection assessment playbooks.

What's New

1. Endpoint & Parameter Fuzzing (cybermes_fuzz_endpoints)

  • High-performance, rate-controlled HTTP fuzzer implemented in Go.
  • Configurable concurrency, rate limiting, and HTTP status code filtering (-mc).
  • Automatic fallback worker pool and built-in wordlist path resolution.

2. Dual-Engine Subdomain Discovery (cybermes_discover_subdomains)

  • Multi-tiered subdomain enumeration engine.
  • Leverages native DNS/certificate inspection with automated fallback to external binaries (subfinder).
  • Output cleaning and deduplication pipeline.

3. Stream Filtering & Token Budgeting (cybermes_filter_stream)

  • Stream output processor to prevent dumping large, low-signal outputs into LLM context windows.
  • Line cleaning, entropy calculation, and signal-to-noise scoring.

4. MCP Static Resources & Workflow Prompts

  • Static resources API exposing internal guidelines, directives, and configuration schemas.
  • Pre-defined MCP prompt templates for end-to-end security assessment workflows.

5. Authenticated Probing & Crawling

  • Probing (pkg/probe) and crawling (pkg/crawl) engines now support custom authentication headers and session cookies.

6. AI Prompt Injection Playbooks

  • Added structured testing playbooks and prompt execution guidelines for auditing LLM applications and AI agents.

Multi-Client Support & NPM

  • Published cybermes-mcp@3.3.0 to the NPM registry.
  • Auto-installer updated to register and auto-approve new tools across supported clients (Claude Desktop, Cursor, OpenCode, Windsurf, Cline, Roo Code, etc.).

Verification & Testing

  • 100% test pass rate across all Go unit test suites (pkg/crawl, pkg/fuzz, pkg/mcp, pkg/probe, pkg/subdomain, pkg/scope, pkg/secrets, pkg/stream).
  • All 7 NPM CLI test suites verified.
Assets 8
Loading