Skip to main content
Glama

suggest_for_bounty

Get curated cybersecurity tool recommendations for any bug bounty target type, from web apps to LLMs. Includes installation status, methodology steps, common vulnerabilities, and quick wins.

Instructions

Suggest cybersecurity tools for a bug bounty target type.

Provides curated tool recommendations with installation status, methodology steps (starting with scope verification), common vulnerabilities, and quick wins for 7 target types: web_app, api, mobile_app, cloud, network, iot, llm.

Also accepts aliases: web/webapp (web_app), rest/graphql (api), android/ios/mobile (mobile_app), aws/azure/gcp/k8s (cloud), infra/infrastructure (network), firmware/embedded (iot).

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
target_typeYesType of bug bounty target (e.g. "web_app", "api", "cloud").

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.2.0

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses what the tool returns: curated recommendations, installation status, methodology steps, common vulnerabilities, and quick wins. It does not explicitly state that it performs no modifications, but 'suggest' and the recommendation framing imply a read-only behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: a clear opening sentence, a detailed breakdown of output content, and a concise list of aliases. Every sentence adds value and the most important information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a single required parameter, a complete output schema, and no complications like nesting or enums, the description covers everything needed: valid target types, aliases, what the tool returns, and its general methodology. No critical information is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema only provides two example values for target_type, while the description enumerates all seven accepted values and their aliases. This is essential for correct invocation, especially since the schema defines no enum. The description adds substantial meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: suggesting cybersecurity tools for a bug bounty target type. It enumerates the seven accepted target types and lists aliases, making the tool's scope unmistakable and differentiating it from siblings like suggest_for_ctf.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on when to use the tool: when the user needs tool recommendations for a specific bug bounty target type. It does not explicitly discuss alternatives or exclusions, but the target-type list and bug bounty framing make selection straightforward.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.