Skip to main content
Glama

Bounty Programs Search

bounty_programs_search
Read-onlyIdempotent

Search public bug-bounty program directories on Bugcrowd, YesWeHack and HackerOne — program name, cash bounty range, and status (open/paused/disabled), each sourced from that platform's own public, unauthenticated directory. has_wildcard checks real scope asset identifiers on YesWeHack and HackerOne (Bugcrowd's scope is behind a researcher login and is reported as such, not silently empty).

Input Schema

NameRequiredDescriptionDefault
limitNoMax rows to return (default 50, max 200).
queryNoCase-insensitive substring match on the program name.
platformNoRestrict to one platform. Omit to search all three.
min_bountyNoOnly programs whose published max bounty (USD) is at least this.
has_wildcardNoOnly programs whose scope includes a wildcard asset ("*.example.com"). Checked via a per-program detail call on yeswehack/hackerone; unavailable for bugcrowd (login-walled).
launched_sinceNoISO date. Only programs with a known launch date on/after this (currently HackerOne only — see bounty_new_programs note).

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnlyHint, idempotentHint, destructiveHint=false), but the description adds real value: data comes from public unauthenticated directories, and Bugcrowd scope is login-walled and reported as such rather than silently empty. It also discloses that has_wildcard triggers per-program detail calls on YesWeHack/HackerOne — useful cost/behavior context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences, purpose front-loaded before the cross-platform caveat. The second sentence is long but earns its place by disclosing the Bugcrowd scope limitation and the per-program cost of has_wildcard; only minor tightening is possible.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 6-parameter, cross-platform search tool with no output schema, the description names the returned fields, the data provenance, and platform-specific behavioral caveats (Bugcrowd scope, HackerOne-only launch dates). The unexplained 'see bounty_new_programs note' reference is the only real gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all six parameters and the enum; baseline is 3. The description adds some semantic depth for has_wildcard (real scope asset identifiers, Bugcrowd unavailable) and platform-specific limitations, but largely reinforces what the schema states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Search) and resource (public bug-bounty program directories) across three named platforms, plus the returned fields (program name, cash bounty range, status). An agent can distinguish this from siblings like bounty_new_programs and bounty_program without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied — search bounty directories when you want to find/list programs — but there is no explicit when-to-use/when-not guidance or routing to the sibling bounty_program (single) or bounty_new_programs tools. The only speculative handoff ('see bounty_new_programs note') is referenced but never explained.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.