hackerone-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| H1_USERNAME | Yes | Your HackerOne username | |
| H1_API_TOKEN | Yes | Your HackerOne API token | |
| H1_CACHE_DIR | No | Optional directory for disk cache | |
| H1_CACHE_TTL | No | Cache TTL in seconds (default 3600) | 3600 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_programsA | List all HackerOne programs your account can access. The full list is large; pass |
| count_programsA | Count programs without listing them: total, bounty programs, VDPs (offers_bounties=false), and a breakdown by submission_state. One cheap API call, tiny response — use this for 'how many ...' questions. |
| get_programA | Get full policy/details for a program by its handle. |
| get_program_scopesC | Get structured scopes for a program, summarized in/out of scope. |
| get_program_weaknessesA | List the weaknesses (CWE types) a program tracks: name, external_id (e.g. CWE-79), and description. |
| filter_programsB | List programs matching filters, compactly. Examples: all VDPs (offers_bounties=false), all bounty programs (offers_bounties=true), only open programs (submission_state="open"), your bookmarked programs (bookmarked=true). Omitted filters are not applied. |
| list_my_reportsA | List your own submitted reports (compact: id, title, state, dates). Use get_report(id) for the full detail of one report. |
| search_disclosed_reportsA | Search HackerOne's PUBLIC disclosed reports (hacktivity). Filters:
free-text |
| list_cwe_typesB | List valid CWE/weakness names usable as the |
| search_directoryA | Search HackerOne's public program directory by name/handle term. Returns up to 10 matches (name, handle). |
| search_scopesA | Search assets across your programs by keyword and optional asset_type. Scans every program you can access, which on a cold cache means one API
call per program and can be slow/rate-limited. Pass |
| rank_programsA | Rank your programs by attractiveness (bounties, scope breadth, severity). Scans every program you can access, which on a cold cache means one API
call per program and can be slow/rate-limited. Pass |
| get_balanceA | Read your current HackerOne balance. |
| list_earningsB | List your HackerOne earnings. |
| get_reportB | Read a specific report by its id. |
| draft_reportC | Format a HackerOne-style report in markdown for you to submit yourself. |
| raw_getA | Authenticated read-only GET against any HackerOne v1 path, for reads not covered by a dedicated tool. Pass a RELATIVE path (no host). Known read endpoints: hackers/programs hackers/programs/{handle} hackers/programs/{handle}/structured_scopes hackers/programs/{handle}/weaknesses hackers/me/reports hackers/reports/{id} hackers/payments/balance hackers/payments/earnings |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 17 tools
Most tools have distinct purposes, with clear boundaries between listing programs, filtering, searching, and getting details. However, `list_programs`, `filter_programs`, and `search_directory` could cause minor confusion, and `raw_get` overlaps with any read operation.
All tools follow a consistent `verb_noun` snake_case pattern (e.g., `count_programs`, `get_program`, `search_disclosed_reports`). Even `raw_get` fits the pattern as an adjective-verb combination.
17 tools cover the HackerOne domain well—program management, report viewing, earnings, and search—without being excessive. Each tool serves a clear purpose within the read-only scope.
The tool surface is read-only, lacking any write operations (e.g., submitting reports, updating programs, or managing account settings). `draft_report` prepares a report for manual submission, but there is no tool to actually submit it, creating a dead end.