Bizone Bug Bounty
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| BIZONE_SESSIONID | No | The sessionid cookie value from bugbounty.bi.zone. Optional; without a cookie only public programs are visible. | |
| BIZONE_SESSIONID_FILE | No | Path to a file (readable only by the owner) containing the sessionid cookie value. Optional; without a cookie only public programs are visible. | |
| BIZONE_SESSIONID_DPAPI_FILE | No | Windows only: path to a DPAPI-protected file containing the sessionid cookie value, created via scripts/protect-session.ps1. Optional; without a cookie only public programs are visible. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_programsA | List and search bug bounty programs (companies) on BI.ZONE Bug Bounty. Returns slug, name, report counts, payouts, active scope size and max critical reward. Use the returned |
| get_programA | Full profile of one bug bounty program: description, site, payout ranges per severity, statistics (reports, resolved, paid, 90-day numbers), average answer time, program rules (markdown) and a scope summary. Accepts a slug, part of the name, or a https://bugbounty.bi.zone/companies//... URL. |
| get_program_scopeA | Structured scope of a BI.ZONE program: every in-scope and out-of-scope asset with its severity, target/notes (often a URL or domain), eligibility and archive status. This is the authoritative list to check before testing a target. |
| search_scopeA | Search every scope asset on BI.ZONE Bug Bounty by domain, product name or description (e.g. 'kaspersky.com', 'vpn', 'mobile app'). Returns which program owns each asset and whether it is in scope. Useful to find every program that covers a given domain. |
| get_meA | Profile of the account configured via BIZONE_SESSIONID / BIZONE_COOKIE: username, reputation, resolved reports, rewards and verification state. Reports themselves are never exposed. |
| top_hackersA | BI.ZONE researcher leaderboard. Without |
| get_researcherA | Full public profile of a BI.ZONE researcher: global rank, reputation, reports and rewards, average signal/impact, achievements (badges) and a breakdown of payouts by program. Accepts a username ('Santry') or a profile URL (https://bugbounty.bi.zone/profile/Santry/hackactivity). |
| list_reportsA | Browse bug bounty reports of other researchers: who reported, on which program, when and the payout. Filter by program, researcher, price range and date. Use it to study what gets paid on a program. Reports of the configured account itself are never returned. |
| get_reportA | Details of one BI.ZONE report by id: researcher, program, asset, payout, visibility and dates. Private/internal reports expose only metadata unless the MCP server is configured with a session cookie. |
| program_statsA | Aggregated statistics computed from all visible reports of a program: totals and averages of payouts, reports and money per year, per asset severity, plus the top researchers on that program. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 10 tools
Most tools have clearly distinct purposes: program lookup, scope lookup, cross-program asset search, report browsing, researcher profiles, and statistics are separated. There is some overlap because get_program includes scope and statistics summaries, while get_program_scope and program_stats expose those areas in dedicated detail.
Most tool names follow a predictable verb_noun pattern such as list_programs, get_program, get_report, and search_scope. The main deviations are noun-phrase tools like top_hackers and program_stats, plus the colloquial get_me, but the set remains readable.
Ten tools is well-scoped for a read-only bug bounty intelligence server. Each tool maps to a meaningful resource area such as programs, scopes, reports, researchers, or statistics.
The surface covers program discovery, scope checking, report inspection, researcher profiles, leaderboards, and aggregate statistics, with no obvious dead ends for research workflows. Minor gaps remain around write/comment/report-submission operations and richer report interactions, likely intentional for a read-only server.