Video wird geladen...

Video konnte nicht geladen werden

Zur Startseite

Pentest tools tier list: learn about which tools are actually used in pentests, and why, with Andy Swift Please comment why you disagree and what we've missed!! The three S-tier tools have a shared attribute: They only do ONE thing, but do it really well and reliably

49,126 Aufrufe • vor 4 Monaten •via X (Twitter)

0 Kommentare

Keine Kommentare verfügbar

Kommentare vom Original-Post werden hier angezeigt

Ähnliche Videos

your agent has thirty tools. it calls two of them. the other twenty eight are not sitting idle somewhere. they are in the request, every request, and they are doing damage in two places at once. first the obvious one. tool schemas go into the prompt, and a schema is not a name. it is a description, a parameter list, types, required fields, an example. thirty of those is a few thousand tokens that ship with every single call, including the ones where the agent just says thanks and stops. you are paying rent on twenty eight tools that have never fired. second, and this is the one that costs more. when the request says cancel the order, the model picks by matching against everything available. four of your tools are plausible: cancel_order, refund_order, update_order, void_order. it is choosing among them based on the descriptions you wrote, one afternoon, months ago. every tool you add is another candidate in that shortlist. the twenty eight you never call are not neutral. they are noise in the one decision that determines whether the run works. > why it grows without anyone deciding to nobody adds thirty tools on purpose. you add one for a task, it works, it stays. six months later the registry is a catalogue and no one has ever removed anything, because removing a tool feels risky and adding one feels free. and there is no feedback telling you otherwise. the unused ones never error. they never appear in a failing trace. they are invisible in exactly the way that lets them accumulate. > what to actually do count calls per tool over the last thousand runs. this is one group-by and it usually shocks people. the ones at zero are pure cost. ship the tools the task needs, not the whole registry. a research phase does not need deploy. a writing phase does not need the database. swap the set between phases instead of loading everything up front. same agent, different tools, depending on where the run is. and when two tools could both plausibly answer the same request, that is not redundancy you can ignore. it is a coin flip you built into the system. the twenty eight tools are not unused. they are used every time, by the part of the run you cannot see.

Hanako

24,656 Aufrufe • vor 9 Tagen