Skip to main content
Glama

TargetFinder

Find bug-bounty targets worth your time, from public data, on your own machine. TargetFinder collects the scope of every public program on HackerOne, Bugcrowd, Intigriti, YesWeHack, HackenProof and Sherlock, tracks what changed since the last run (new programs, new targets, removed targets, fee and reward changes, pushes to in-scope source repositories) and serves it through a CLI, a local HTTP API and an MCP server for AI assistants.

What it looks like

targetfinder leads hot --free: programs worth a look right now, free to submit to.

leads

targetfinder program gitlab: one program as a card, with its best-scored targets.

program card

targetfinder status: collector health, so you know the data is fresh.

status

Related MCP server: Bug Bounty MCP Server

Who this is for

People hunting their first bounty. The hard part early on is not finding bugs, it is picking a target that is fresh, in scope, pays, and is not already crowded. TargetFinder puts that information in one place and tells you when it changes. If you would rather not run anything, the hourly data published by the GitHub Action (see below) is the same thing as JSON files.

Always confirm scope on the program page before testing. Platforms change scope, rules and rewards without notice; the program page is the only source that counts when you submit.

Quickstart

git clone https://github.com/NaroChatyan/targetfinder.git && cd targetfinder
bin/targetfinder init                     # first run: collects every platform (10–20 min), writes public/ snapshots
bin/targetfinder sweep                    # the report: new programs, fee changes, added/removed targets, pushes, rankings

Keep it fresh, pick one:

bin/targetfinder sweep --sync             # on demand: collect, then report
bin/targetfinder schedule install --every 1   # hourly in the background (systemd user timer on Linux, launchd on macOS; prints the schtasks command on Windows)
bin/targetfinder loop --every 2           # foreground loop: sync + sweep every 2 hours, Ctrl-C to stop

Or as a container, with the data kept in a named volume:

docker build -t targetfinder .
docker run -v targetfinder-data:/data targetfinder init
docker run -v targetfinder-data:/data targetfinder sweep
docker run -i -v targetfinder-data:/data targetfinder          # the MCP server over stdio

Reports land in sweeps/SWEEP_<date>.md with a JSON twin. The first run records a baseline, so the first sweep shows no "added" targets: changes are only reported for things TargetFinder had already seen.

What you get

command

what it does

targetfinder sweep [--since ISO] [--live-only] [--all-pushes] [--max-per-program N] [--bulk-threshold N]

the standing report; a paid submission fee is the only thing that gets deprioritised, nothing is hidden

targetfinder programs --free --search gitlab / program <id> / targets <id>

browse programs and their scope with scores

targetfinder changes --type added --since 2026-10-01T00:00:00Z --free

target changes, page or cursor mode

targetfinder commits --since ...

pushes to in-scope repositories with compare links, classified code / docs / deps / ci / tests

`targetfinder leads top

hot

`targetfinder rankings scope

rewards

targetfinder watch add "Program name" then watch report

your watchlist; the sweep and the alerts give it its own section

targetfinder clones --dir ~/targets

which of your local git clones are behind the tracked HEAD, with the pushes you missed

targetfinder diff <push-id>

saves the compare diff of a push to sweeps/diffs_<date>/

targetfinder search api.example.com

which program lists an asset

targetfinder serve

HTTP API on http://127.0.0.1:8787/api/ (docs/API.md)

targetfinder mcp

MCP server over stdio (18 tools, docs/API.md)

targetfinder status

counts, collectors, last successful run per platform, stale flags

targetfinder resolve nado / payouts <id>

find a program id from a name; payout signals and platform-published facts

Every lookup prints a readable table; add --json for the same data as JSON. targetfinder alone prints the grouped command list, targetfinder <command> -h the options. Exit codes: 0 ok, 1 not found, 2 usage error, 3 every collector failed. Colors appear only on a terminal and honour NO_COLOR.

Alerts (Discord / Telegram)

bin/targetfinder notify setup --discord <webhook-url> --telegram-token <bot-token> --telegram-chat <chat-id>
bin/targetfinder notify test

After every sync you get: brand-new programs with their scope, watchlist changes (targets, fee, rewards, status, code pushes) and fresh in-scope targets everywhere (free-submission only by default; tune with notify setup --min-score 50 --platforms HackerOne,YesWeHack --free-only off). Nothing is sent twice; the first sync after setup only initialises the cursors. Credentials live in data/notify.json (mode 600) or in DISCORD_WEBHOOK_URL, TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID.

MCP (Claude Code, Cursor, any MCP client)

{"mcpServers": {"targetfinder": {"command": "/path/to/targetfinder/bin/targetfinder", "args": ["mcp"]}}}

Start with the guide tool. recent_target_changes and recent_repo_pushes take an after_id cursor for polling; find_programs and leads accept free_submission_only.

Use the published data without running anything

The repository's GitHub Action runs sync every hour and commits JSON snapshots to the data branch: programs.json, targets.json (active and inactive rows with added_at / removed_at), repos.json (tracked HEADs), and 90-day windows of target_changes_90d.json, program_events_90d.json, repo_changes_90d.json, payouts_90d.json, plus meta.json. Fetch them raw, or clone and run bin/targetfinder import-snapshot --in public to get a local database with history, then sync to continue from there. The data branch always holds exactly one commit (each run rewrites it, so the repository does not grow by 55 MB an hour); the 90-day history is inside the files. GitHub pauses scheduled workflows after 60 days without commits, which the hourly data commits prevent.

Data sources

platform

what is read

notes

HackerOne

public directory GraphQL (programs, structured scopes, public stats)

reports/90d, paid/90d, first-response hours feed the briefs

Bugcrowd

engagements.json; scope from bounty-targets-data or the engagement changelog

VDPs detected from the reward summary

Intigriti

public programs API; scope from bounty-targets-data

only public-scope programs have targets

YesWeHack

public API: programs and program detail

submission cost in credits is the fee

HackenProof

listing and program pages

submission fee and reward table from the program page

Sherlock

bug-bounties listing and detail pages

the per-report USDC deposit is recorded as the fee

Immunefi

off by default (its terms prohibit automated access, docs/PLATFORMS.md)

TARGETFINDER_ENABLE_IMMUNEFI=1 opts in for personal use

Request rates are conservative (one request in flight per host, at least one second apart, 1.5 s on HackerOne) with an identifying User-Agent. Every collector has fixture tests; a platform that changes its pages makes its collector fail loudly, keeps the previous data intact, and is flagged stale in status and at the top of the sweep.

Scores are heuristics

competitionRisk and opportunity scores are comparative estimates derived from public counts, not measured probabilities. Target scores (0–100, labels top/strong/promising/normal), competition levels (low/medium/high/unknown) and lead tiers (top/hot/solid/possible) are TargetFinder's own point models over freshness, target type, maximum bounty and public report counts; docs/SCORING.md lists every weight. Report counts mean different things on different platforms, so use scores to order a list, never to skip reading the program page.

Layout

targetfinder/        package: collectors/, sync, repowatch, snapshot, queries, model, activity, api, mcp_server, sweep, tools, notify, schedule, cli
bin/targetfinder     launcher
tests/               unittest suite (python3 -m unittest -v); tests/fixtures/ holds recorded, trimmed platform payloads
tools/record_fixtures.py   maintainer tool: re-record the fixtures (network)
docs/                API.md, DESIGN.md, SCORING.md, PLATFORMS.md
public/              JSON snapshots (written by init / export-snapshot, git-ignored on main; the data branch in CI)
data/                your database and logs (git-ignored)

Environment: TARGETFINDER_DATA_DIR, TARGETFINDER_DB, TARGETFINDER_SWEEP_DIR, TARGETFINDER_API_HOST, TARGETFINDER_API_PORT, TARGETFINDER_ENABLE_IMMUNEFI, GITHUB_TOKEN (optional: raises the GitHub compare budget used to classify pushes from 50/h to 5000/h).

Contributing

Run python3 -m unittest -v (no network). To add a platform, write parse_listing / parse_scope as pure functions, record a trimmed fixture with tools/record_fixtures.py, add the terms review line to docs/PLATFORMS.md, and register collect(). MIT licensed.

Support

TargetFinder is free and has no paid tier. If it helped you land a bounty and you want to give something back, small amounts on cheap networks are welcome:

network

address

ETH or USDC on Base, Arbitrum or Ethereum

0x5e806C4453885d65df0c860CD295ff51af1766B6

USDT (TRC-20) on TRON

TE5HHm8tVSPYUfSz33dGtLS4HVoxfDgMVV

Send on the network named next to the address; funds sent on another network cannot be recovered. HAPPY HACKING!!!

Available Tools

18 tools
export_targetsC

Bounded export (max 500 rows) of current targets.

NameRequiredDescriptionDefault
tagsNo
limitNo
tiersNo
platformsNo
program_idsNo
include_ineligibleNo
include_out_of_scopeNo

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it only discloses the 500-row cap. It does not say whether the export is read-only (implied but unstated), what happens when more than 500 rows match (silent truncation vs error), whether filters are ANDed, or how results are ordered/returned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no waste; the bound is stated immediately. It is brief to the point of under-specification rather than padded, which is better than verbosity but leaves gaps elsewhere.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 7 undocumented filter parameters, no annotations, and no output schema, this description is far too thin; an agent cannot know filter semantics, truncation behavior, or the response shape. Only the row cap is covered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 7 parameters, so the description must compensate and it does not: tags, tiers, platforms, program_ids, include_ineligible, and include_out_of_scope are never mentioned. The 500-row bound loosely maps to the limit parameter but gives no default or interaction rules.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (export) and resource (current targets) with a scoping bound (max 500 rows), so an agent knows exactly what it produces. It does not distinguish itself from siblings like list_targets or search_targets, which an agent must choose between when it wants target data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No indication of when to use this versus list_targets, search_targets, or watchlist_new_targets, and no prerequisites or context such as what 'current' means. The agent must infer that export is for bulk retrieval versus interactive listing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_program_by_targetC

Which program(s) list a domain / URL / repo / wildcard.

NameRequiredDescriptionDefault
targetYes
platformsNo

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden and does not meet it. It says nothing about matching semantics (exact vs. wildcard/subdomain matching), result shape, pagination, permissions, or whether multiple programs can be returned per target. The only behavioral hint is the list of accepted target kinds.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single front-loaded fragment with no wasted words, but the terseness crosses into under-specification rather than efficiency. There is no structure beyond the one line to guide an agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with zero annotation coverage, zero schema documentation, and no output schema, the description is far too thin. It never explains what a result looks like, how wildcard targets match subdomains, or how the platforms filter interacts with the lookup.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for both parameters, so the description must compensate and only partly does. It clarifies that 'target' accepts a domain, URL, repo, or wildcard, but says nothing about the 'platforms' array — whether it filters or scopes the lookup, or what values it accepts.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear reverse-lookup: given a target, return the program(s) that list it. The enumerated target kinds (domain / URL / repo / wildcard) make it distinguishable from siblings like find_programs and list_targets, which go in the other direction. It stops short of a proper verb phrasing (it is a question fragment), but an agent can still tell what it does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied by the framing: you have a target and want to know which programs cover it. There is no explicit statement of when to prefer this over find_programs, search_targets, or get_program, and no exclusions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_programsC

Program discovery with combined filters.

NameRequiredDescriptionDefault
fullNoinclude payouts/activity blocks (default false)
kindNo
sortNo
tagsNo
limitNodefault 50
searchNoname/handle/platform/target substring
platformsNo
min_bountyNo
competitionNolow|medium|high|unknown
wildcard_onlyNo
recent_scope_daysNoonly programs with scope changes in the last N days
free_submission_onlyNo

TDQS

C2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden, but it says nothing about read-only behavior, pagination, default result limits, authentication needs, or return shape. The only behavioral hint is that filters can be combined.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single short fragment, so it is technically concise, but it is under-specified rather than efficient. It front-loads the resource but omits the essential context needed to call the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 12 parameters, no annotations, no output schema, and incomplete parameter descriptions, the description is far too sparse. It does not explain what is returned, how filters combine, or how results are ordered or limited.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 42% across 12 parameters, and several parameters such as tags, platforms, min_bounty, wildcard_only, and free_submission_only have no descriptions. The description contributes no parameter semantics beyond the vague phrase 'combined filters'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies the resource (programs) and implies filtering, but 'discovery' is a vague verb and 'combined filters' adds little specificity. It does not distinguish this tool from siblings such as get_program, program_brief, search_targets, or find_program_by_target.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives, no exclusions, and no prerequisites. With many sibling tools that retrieve or search programs, an agent has to infer the intended use case entirely.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_programB

One program by id, handle or unambiguous name (full object).

NameRequiredDescriptionDefault
program_idYes

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden, and it discloses almost nothing: not what happens on a miss, whether ambiguity errors vs. returns a best match, nor any auth or rate-limit context. Only '(full object)' hints at return weight.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tight sentence with zero padding, and the resource plus lookup keys are front-loaded. Brevity tips into under-specification rather than waste, but nothing is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter lookup with no annotations and no output schema, the description covers enough to attempt a call but omits error/ambiguity behavior and return format detail beyond '(full object)'. Adequate minimum, not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the single parameter has an empty description, so the description must compensate. It does add real meaning by listing three accepted identifier forms, but gives no syntax detail (handle format, case sensitivity, examples) and never says how ambiguity is resolved despite the word 'unambiguous'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific resource (one program) and the accepted lookup keys (id, handle, unambiguous name), plus the return shape ('full object'). It implies single-record retrieval versus the sibling find_programs, but never names that sibling, so the differentiation is left to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The tool's purpose implies usage: call it when you already hold an identifier. But there is no explicit when-to-use or when-not statement, and no routing advice for the obvious alternative (find_programs) when the name is ambiguous or only partial information is available.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

guideA

How to choose among these tools; id format; filter vocabulary.

NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses the topics covered (tool choice, id format, filter vocabulary), which is useful, but says nothing about the return format or that this is a static, read-only reference rather than an action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short fragments with no filler, and the primary purpose (choosing among tools) is front-loaded before the secondary topics. It is terse but each element earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations, no output schema, and no parameters, the description is the sole source of context. It lists the covered topics but does not explain the nature of the output or how an agent should apply the guidance, leaving a moderate gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to clarify beyond the schema. Baseline 4 applies; no parameter-level omissions exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific function (guidance on tool selection) and lists concrete coverage areas: id format and filter vocabulary. It is clearly not a data-query tool like its siblings, though the fragmentary style makes it slightly less crisp than a full sentence would.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'How to choose among these tools' implies this is a meta-reference to consult before selecting siblings, but it never explicitly says when to call it (e.g., before first use) or when not to. Usage is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

leadsD

Programs in one lead tier.

NameRequiredDescriptionDefault
pageNo
tagsNo
tierYes
searchNo
page_sizeNo
platformsNo
free_submission_onlyNo

TDQS

D1.3/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations and no output schema, so the description carries the full burden, yet it says nothing about ordering, pagination, result shape, or whether the tier filter is exclusive. A 7-parameter query tool is left completely opaque.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single five-word fragment is not concise but under-specified; there is nothing to front-load because no substance exists. It wastes no words, but that is only because it says almost nothing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter filtered-list tool with no annotations and no output schema, the definition omits pagination behavior, filter semantics, and return content entirely. An agent cannot call this correctly without opening the schema and reverse-engineering intent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and six of seven properties have empty description strings. The description adds no meaning for tier's enum values, tags, platforms, search, page/page_size, or free_submission_only, so nothing compensates for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Programs in one lead tier" is a noun phrase with no verb and no object beyond "programs"; it hints at a list operation filtered by tier but the agent cannot tell what it returns or how it differs from siblings like find_programs, search_targets, or list_targets.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use, when-not-to-use, or alternative routing is given. With 17 sibling tools including several that also enumerate programs/targets, the absence of any disambiguation leaves selection entirely to guesswork.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_filtersC

Observed filter values (platforms, tags, target types) and the fixed vocabularies.

NameRequiredDescriptionDefault

No parameters

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. The word 'Observed' hints that values are derived from actual data rather than being static, but nothing states whether the result is read-only, how fresh it is, or whether the vocabularies are stable across calls — all material for a tool whose whole purpose is to feed valid values into other tools.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single compact sentence with no filler, and the core content (platforms, tags, target types) is front-loaded. It is slightly clipped — the dangling 'and the fixed vocabularies' reads as an afterthought — but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a zero-parameter, no-annotation, no-output-schema tool, so the description must explain the shape of what comes back. It lists the three categories, which helps, but it never says how they are grouped (one map keyed by category? flat lists?) or how an agent should apply them to other tools' filters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has zero parameters, so there is nothing to document and the baseline of 4 applies. The description correctly implies no input is needed to enumerate the vocabularies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the resource (filter values: platforms, tags, target types) and adds 'fixed vocabularies', so the subject matter is identifiable. However, it is a noun phrase with no verb — it never says whether it lists, returns, or enumerates anything — and it does nothing to distinguish itself from siblings like list_targets or guide.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use statement and no named alternative. At best an agent can infer this is a reference lookup to discover valid filter values before calling search/find tools, but that routing is left entirely to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_targetsC

Targets of one program with scores.

NameRequiredDescriptionDefault
typeNodomain|api|source code|smart contract|mobile|...
labelNo
limitNomax 500
offsetNo
searchNo
compactNodefault true
min_scoreNo
program_idYes
competitionNo
eligibilityNo

TDQS

C2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden and largely fails it: nothing about pagination defaults (offset/limit max 500), the default compact=true behavior, permission requirements, or whether filtering is server-side. The only behavioral crumb is 'with scores', which hints at payload contents but not its shape.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Six words is short but under-specified rather than concise — there is no wasted language, but there is also no front-loaded information beyond a noun phrase. Conciseness should not come at the cost of the minimum needed to call the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter, non-annotated, output-schema-less list tool, this description is drastically incomplete. There is no explanation of return shape, pagination behavior, default compact output, or how the score field relates to min_score/label filters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Ten parameters with 30% schema description coverage, and several have empty descriptions (offset, search, min_score, program_id, competition, eligibility enum). The description adds no meaning for any parameter — it never mentions type, label, min_score, compact, or eligibility, so the agent must infer arguably the most consequential filters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The phrase 'Targets of one program with scores' identifies the resource (targets scoped to a program) and hints at the returned data (scores), but the verb is only implied and there is no differentiation from siblings like search_targets, export_targets, or watchlist_new_targets. An agent can guess it is a list operation, but cannot tell from the description alone why it should pick this over search_targets.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use, when-not-to-use, or alternative is mentioned despite three sibling tools operating on targets (search_targets, export_targets, watchlist_new_targets). The only usable signal is the phrase 'of one program', which implies program scoping but is not framed as guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

program_briefB

One-screen summary: rewards, fee, competition, scope counts, recent activity, payouts, sample eligible targets.

NameRequiredDescriptionDefault
program_idYes

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description lists the summary's contents, which gives useful behavioral context about what will be returned. However, with no annotations, it does not state that the operation is read-only, whether it requires authentication or specific permissions, how fresh the 'recent activity' is, or whether any limits apply.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence fragment with a colon-delimited list of outputs. It is efficient and has no filler, though it is terse enough that some important context is omitted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only summary tool with one required parameter and no output schema, the description gives a reasonable list of return categories. It is still incomplete because it does not explain program_id semantics, disambiguate from sibling tools, or describe behavioral constraints such as read-only status or data freshness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description does not mention program_id at all. The parameter name is self-describing, but no format, example, or constraint is provided to compensate for the empty schema description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies a summary resource for a program and enumerates the included content areas: rewards, fee, competition, scope counts, recent activity, payouts, and sample eligible targets. It does not explicitly distinguish itself from sibling tools like get_program or program_payouts, but the 'one-screen summary' framing makes its role reasonably clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'one-screen summary' implies a quick overview use case, but there is no explicit guidance on when to use this tool versus get_program, program_payouts, or other siblings. No exclusions or prerequisites are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

program_historyB

Event history (program/scope/rewards/fees/status/repositories) for one program, or all programs when program_id is omitted.

NameRequiredDescriptionDefault
limitNo
sinceNo
cursorNo
categoryNo
program_idNo

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses the scope and event categories, but gives no information about ordering, pagination behavior, authorization requirements, or how much history is returned. For a five-parameter history tool with no structured annotations, this is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single efficient sentence with no filler. The scoping rule is front-loaded and the event categories are compactly enumerated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has five optional parameters, no output schema, no annotations, and no parameter descriptions. The description supplies only the high-level scope and event categories, leaving pagination, time filtering, category filtering, and return shape unexplained. It is not complete enough for an agent to invoke the tool confidently beyond the simplest case.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for five undocumented parameters. It explains program_id omission and lists category-like values, but says nothing about limit, since, cursor, or how the listed categories map to the category parameter. This leaves most parameters semantically undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource as event history and lists the event categories it can return. It also distinguishes the scoped case (one program via program_id) from the unscoped case (all programs). The main gap is that it does not explicitly name a sibling alternative, but the purpose is still easy to understand.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives one useful usage rule: omit program_id to get all programs. It does not say when to prefer this tool over siblings like status, get_program, program_brief, or program_payouts, nor does it explain when the event history is more appropriate than those alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

program_payoutsC

Payout facts, windows, signals and labels for one program.

NameRequiredDescriptionDefault
program_idYes

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full disclosure burden, and it discloses almost nothing: read-only vs mutation is only implied by the noun phrasing, and there is no mention of permissions, rate limits, or whether labels/signals are static or computed. The enumeration of data categories is the only behavioral signal offered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single nine-word sentence with no filler, and the scoping constraint ('one program') is front-loaded. It is efficient; the problem is omission, not verbosity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read tool with no output schema, listing the four categories of data returned gives the agent a reasonable picture of the response shape. Missing is any confirmation that it is a non-mutating read and any semantics for the sole required parameter.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and program_id has an empty description, so the description is the only source of meaning. 'for one program' weakly implies the parameter scopes results to a single program, but it never says whether program_id is a numeric ID, slug, or name, nor what happens with an unknown ID.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The phrase enumerates the resource contents (payout facts, windows, signals, labels) scoped to 'one program', which is more than a bare restatement of the name. But it is a noun phrase with no verb, so it never states whether it fetches, lists, or computes, and it does nothing to distinguish it from siblings like get_program, program_brief, or program_history.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus get_program, program_brief, or program_history, all of which plausibly return overlapping program-level data. No prerequisites, no exclusions, no framing of the decision the agent faces.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

rankingsD

One ranked page of a view.

NameRequiredDescriptionDefault
sortNo
tagsNo
viewYes
kindsNo
limitNo1-100
cursorNo
labelsNo
periodNo24h|7d|30d|90d|all (per view)
directionNo
platformsNo

TDQS

D1.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden and largely fails it. The word 'page' hints at cursor-based pagination, but there is no disclosure of permission requirements, ranking algorithm, default sort, rate limits, or return shape for a 10-parameter query tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The single four-word sentence is technically concise with no waste, but it is under-specified rather than appropriately sized. It is front-loaded yet carries almost no information, leaving the definition effectively empty for a complex query tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 10 parameters, only 20% schema description coverage, no annotations, and no output schema, the definition is completely inadequate. An agent cannot determine from the description what the views mean, how ranking works, or how pagination is expected to behave.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 20% and the description adds nothing about any parameter. The critical `view` enum (scope, rewards, updates, status, payouts, response, all) is entirely unexplained, and terms like `sort`, `direction`, and 'period (per view)' are left for the agent to guess.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description is a bare noun phrase, 'One ranked page of a view,' with no verb and no statement of what entity is being ranked (programs, targets, payouts?). It conveys only that a paginated ranked listing is returned, and does nothing to distinguish it from siblings such as search_targets or program_history.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives like search_targets, list_targets, or program_history. No prerequisites, no exclusions, no mention of how it relates to the views offered in the schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

recent_repo_pushesC

Source-repository pushes (page mode or after_id cursor). Compare links, no code.

NameRequiredDescriptionDefault
pageNo
tagsNo
kindsNocode|docs|deps|ci|tests|mixed|unknown
sinceNo
searchNo
after_idNo
page_sizeNomax 100
platformsNo
program_idNo
include_targetsNodefault false
free_submission_onlyNo

TDQS

C2.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden; it does disclose that results are repository pushes and that output is comparison links rather than code, plus the two pagination modes. That is genuine behavioral context, but it omits permissions, rate limits, default filtering, and whether the pagination modes interact.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short fragments with no waste, and the pagination modes are front-loaded. But the terseness crosses into under-specification; 'Compare links, no code' is unclear enough that it doesn't earn its place as written.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An 11-parameter, zero-annotation, no-output-schema tool is described in one sentence. There is no information about filtering defaults, result shape, or the meaning of most parameters, which is not enough for an agent to call it correctly without guessing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 27% and the description covers just page and after_id. Nine other parameters (since, search, kinds, tags, platforms, program_id, page_size, include_targets, free_submission_only) are undocumented in both the schema and description, so there is no compensation for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

It names the resource (source-repository pushes) and implies a list operation, which is more specific than a bare noun. But 'Compare links, no code' is cryptic and it gives no differentiation from siblings like recent_target_changes or program_history, so an agent can't confidently pick it over them from the description alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use, when-not-to-use, or named alternative. The parenthetical '(page mode or after_id cursor)' hints at two retrieval modes but doesn't say which to choose or that they're mutually exclusive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

recent_target_changesD

Target changes (page mode or after_id cursor).

NameRequiredDescriptionDefault
pageNo
tagsNo
typeNo
sinceNoISO timestamp
searchNo
compactNodefault true
after_idNo
min_scoreNo
page_sizeNomax 100
platformsNo
program_idNo
competitionNo
include_removedNo
include_ineligibleNo
free_submission_onlyNo
include_out_of_scopeNo

TDQS

D1.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses only that pagination can use page mode or an after_id cursor, but says nothing about read-only nature, sorting, defaults, rate limits, or what data is returned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and front-loaded, but it is under-specified rather than concise. A single sentence cannot adequately convey the purpose and behavior of a tool with 16 filter parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 16-parameter tool with no annotations and no output schema, this description is almost completely inadequate. It omits filtering semantics, pagination defaults, inclusion flags, and return behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 16 parameters and only 19% schema description coverage, the description should compensate substantially. It mentions page and after_id, but leaves tags, type, since, search, compact, min_score, include_removed, include_ineligible, and others unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description restates the tool name ('Target changes') and adds only a parenthetical about pagination modes. It does not state what counts as a change, what scope is covered, or how it differs from siblings like list_targets, search_targets, or watchlist_new_targets.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It implies that page and after_id are alternative pagination mechanisms, which is a small usage hint. However, it gives no guidance on when to use this tool instead of list_targets, search_targets, recent_repo_pushes, or program_history.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_sweepB

Run the standing sweep report and return the markdown.

NameRequiredDescriptionDefault
sinceNoISO timestamp; default last sweep
writeNowrite SWEEP_<date>.md to the sweep directory (default false)

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full disclosure burden, and it does not say whether running the sweep costs money, hits external services, has rate limits, or whether the generated file is destructive/overwrites an existing SWEEP_<date>.md. It states only the return format, which the schema already implies via the write flag.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler. The action and the return value are both stated immediately.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has zero required params and no output schema, so a short description is defensible, but with no annotations the description should still cover the side effect of writing files and what a "sweep" covers. The core call is answerable; the surrounding context is not.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and both parameters document their own defaults and formats. The description adds nothing beyond them, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb ("run") plus a named artifact ("standing sweep report") and an explicit result ("return the markdown"). The domain term "standing sweep" is left undefined, so an agent that doesn't already know the product can't tell what the report actually contains, but the action itself is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to call this versus alternatives, no prerequisites, and no mention of the incremental behavior implied by the "since" default. Nothing says whether this should be run on-demand, on a schedule, or after data changes.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_targetsC

Search targets across all programs.

NameRequiredDescriptionDefault
qNo
pageNo
tagsNo
page_sizeNomax 500
platformsNo
match_modeNo
include_ineligibleNo
include_out_of_scopeNo

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full disclosure burden, yet it says nothing about pagination, matching behavior, eligibility/scope filtering, or result ordering. Only the phrase "across all programs" hints at scope; everything else an agent needs to predict behavior is absent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with zero filler, but the brevity is under-specification rather than efficiency. There is nothing to trim, but nothing substantive is delivered either.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An eight-parameter search tool with no annotations, no output schema, and near-zero schema documentation. The description supplies none of the missing context an agent needs to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Eight parameters with 13% schema description coverage (only page_size has "max 500"), and the description explains none of them. The meaning of q, match_mode, include_ineligible, include_out_of_scope, tags, and platforms is left entirely to guesswork.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Search targets") plus a scope ("across all programs"). It is distinguishable from find_program_by_target, but the description never contrasts itself with the very similar sibling list_targets.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, no prerequisites, no exclusions. The phrase "across all programs" weakly implies this is the cross-program variant versus list_targets, but the agent must infer that from the sibling name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

statusB

Database counts, last sync, collectors and their last successful run.

NameRequiredDescriptionDefault

No parameters

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full load, and it does disclose the concrete payload contents (counts, last sync timestamp, collectors and their last successful run), which is the main behavioral fact for a status endpoint. It says nothing about read-only semantics, freshness guarantees, cost, or whether the call can be slow — gaps that matter given zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single fragment sentence with no filler, and the most useful term (database counts, last sync) is front-loaded. It is slightly clipped to the point of being elliptical, but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter tool with no output schema and no annotations, the description partly substitutes for a return-value spec by naming the four data categories. It stops short of describing the shape or nesting of that response, and gives no invocation context, leaving the definition merely adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes no parameters, so there is nothing for the description to disambiguate; baseline 4 applies. The description appropriately spends its words on output scope rather than inventing parameter detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description is a noun phrase listing the data the tool surfaces (database counts, last sync, collector runs) rather than a verb+resource statement. It conveys the subject matter but leaves the agent to infer that this is a read-only system-health snapshot, and it does nothing to separate it from siblings like guide or program_history.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use, when-not-to-use, or named alternative among the 17 sibling tools. A health/diagnostics use case is only faintly implied by the listed contents, with nothing telling the agent to check freshness here before running program_history or recent_repo_pushes.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

watchlist_new_targetsC

New in-scope targets for a list of programs since a timestamp.

NameRequiredDescriptionDefault
sinceNoISO timestamp; default 7 days ago
program_idsYes

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden but supplies none: no statement that it is a read-only query, no auth/scope requirements, no pagination or result-size behavior, and no explanation of what 'in-scope' means or how 'since' bounds results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler, so it is appropriately sized given the intent. It is arguably too terse, but nothing in it is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations, no output schema, and half the parameters undocumented, the description is too thin. It should at least clarify what a 'target' is, what counts as 'new', and the shape of the return.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50%, and program_ids has an empty schema description. The description's 'list of programs' and 'since a timestamp' partially map to both params, but add little beyond the schema's own 'ISO timestamp; default 7 days ago' text and don't explain format or filtering semantics for program_ids.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The verb phrase 'new in-scope targets ... since a timestamp' conveys what is returned, but it doesn't clarify the 'watchlist' concept from the name or distinguish it from siblings like recent_target_changes, list_targets, and search_targets, which all touch targets.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use, when-not-to-use, or alternative-tool guidance is given. An agent cannot tell from the description whether to reach for this versus recent_target_changes or list_targets for a similar need.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 18 tool updatesv0.1.0
    • First observedexport_targets
    • First observedfind_program_by_target
    • First observedfind_programs
    • First observedget_program
    • First observedguide
    • First observedleads
    • First observedlist_filters
    • First observedlist_targets
    • First observedprogram_brief
    • First observedprogram_history
    • First observedprogram_payouts
    • First observedrankings
    • First observedrecent_repo_pushes
    • First observedrecent_target_changes
    • First observedrun_sweep
    • First observedsearch_targets
    • First observedstatus
    • First observedwatchlist_new_targets

TDQS

C2.5/5.0

Scored across 18 tools

Disambiguation4/5

Most tools target distinct resources and actions: program lookup, target listing/search, repository pushes, filters, and exports are clearly separated. Some overlap remains between find_programs and leads, between program_brief and program_payouts, and between recent_target_changes and watchlist_new_targets, but the guide tool and descriptions help disambiguate.

Naming Consistency3/5

All names use snake_case, but conventions are mixed: verb-led names (find_programs, get_program, list_targets, search_targets) coexist with noun-led or bare-noun names (guide, status, leads, rankings, program_brief, program_history). The names remain readable, but there is no single predictable verb_noun pattern.

Tool Count3/5

Eighteen tools is somewhat heavy for a program/target discovery server, with several meta or shortcut tools (guide, status, list_filters, leads) that could potentially be folded into others. It is not excessive for the domain's breadth, but it sits above the ideal 3–15 range.

Completeness4/5

The surface covers discovery, detailed program summaries, target listing/search, history, change feeds, rankings, filters, exports, and sweeps, so core read-only workflows are well supported. Minor gaps exist around watchlist management (only watchlist_new_targets is present, with no list/add/remove operations) and direct target-detail lookup.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    C
    maintenance
    AI-powered bug bounty hunting platform that integrates security tools (OWASP ZAP, Caido, Burp Suite) for automated reconnaissance, vulnerability testing, JavaScript analysis, and finding management with PostgreSQL storage.
    47
    49
    MIT
  • A
    license
    A
    quality
    F
    maintenance
    Provides Claude Code with access to a comprehensive bug bounty knowledge base including techniques, payloads, wordlists, and real-world reports through 14 tools for searching, retrieving payloads, and assessing report quality.
    14
    21
    GPL 3.0
  • F
    license
    Not graded
    quality
    D
    maintenance
    Wraps multiple bug bounty platform APIs (HackerOne, Bugcrowd, etc.) behind a uniform MCP tool surface, enabling LLM agents to query programs, scope, and briefs across platforms through a single interface.
    -
  • A
    license
    A
    quality
    D
    maintenance
    Enables AI agents to find and query real-time GitHub coding bounties with built-in scam filtering, supporting listing, matching, and detailed bounty retrieval.
    4
    17 npm
    Apache 2.0