HackerOne MCP Server

Instructions

Implementation Reference

• src/index.ts:208-265 (handler)

  The handler for the analyze_report_patterns tool, which fetches reports, performs aggregation of severity, state, program, and weakness data, and returns the analysis.

  server.tool(
    "analyze_report_patterns",
    "Fetch your recent reports and analyze patterns: most common vulnerability types, severity distribution, resolution rates, and programs. Useful for understanding your hunting profile.",
    {
      page_size: z
        .number()
        .min(10)
        .max(100)
        .optional()
        .describe("Number of reports to analyze (default 100)"),
    },
    async ({ page_size }) => {
      try {
        const reports = await searchReports({
          page_size: page_size ?? 100,
          sort: "-reports.created_at",
        });
  
        const severityCounts: Record<string, number> = {};
        const stateCounts: Record<string, number> = {};
        const programCounts: Record<string, number> = {};
        const weaknessCounts: Record<string, number> = {};
  
        for (const r of reports) {
          severityCounts[r.severity ?? "unknown"] =
            (severityCounts[r.severity ?? "unknown"] ?? 0) + 1;
          stateCounts[r.state ?? "unknown"] =
            (stateCounts[r.state ?? "unknown"] ?? 0) + 1;
          if (r.program)
            programCounts[r.program] = (programCounts[r.program] ?? 0) + 1;
          if (r.weakness)
            weaknessCounts[r.weakness] = (weaknessCounts[r.weakness] ?? 0) + 1;
        }
  
        const analysis = {
          total_reports_analyzed: reports.length,
          severity_distribution: severityCounts,
          state_distribution: stateCounts,
          top_programs: Object.entries(programCounts)
            .sort(([, a], [, b]) => b - a)
            .slice(0, 10)
            .map(([prog, count]) => ({ program: prog, count })),
          top_weakness_types: Object.entries(weaknessCounts)
            .sort(([, a], [, b]) => b - a)
            .slice(0, 10)
            .map(([weakness, count]) => ({ weakness, count })),
        };
  
        return {
          content: [
            {
              type: "text" as const,
              text: JSON.stringify(analysis, null, 2),
            },
          ],
        };
      } catch (err: any) {
        return {