HackerOne MCP Server

Instructions

Implementation Reference

• src/h1client.ts:208-229 (handler)

  The function `getReportActivities` performs the core logic, fetching and transforming report activity data.

  export async function getReportActivities(
    reportId: string,
    _pageSize = 50
  ) {
    // Activities are included in the report response under relationships
    const data = await h1Fetch(`/hackers/reports/${reportId}`);
    const activities = data.data?.relationships?.activities?.data ?? [];
  
    return activities.map((a: any) => ({
      id: a.id,
      type: a.type,
      message: a.attributes.message,
      created_at: a.attributes.created_at,
      internal: a.attributes.internal,
      automated_response: a.attributes.automated_response,
      actor_type: a.relationships?.actor?.data?.type ?? null,
      actor:
        a.relationships?.actor?.data?.attributes?.username ??
        a.relationships?.actor?.data?.attributes?.name ??
        null,
    }));
  }

• src/index.ts:142-165 (registration)

  The `get_report_activities` tool is registered using `server.tool` and calls the handler.

  // ── Tool: get_report_activities ────────────────────────────────────
  server.tool(
    "get_report_activities",
    "Get the activity timeline of a report: comments, state changes, bounty awards, and triage responses.",
    {
      report_id: z.string().describe("The HackerOne report ID"),
      page_size: z
        .number()
        .min(1)
        .max(100)
        .optional()
        .describe("Number of activities to return (default 50)"),
    },
    async ({ report_id, page_size }) => {
      try {
        const activities = await getReportActivities(report_id, page_size);
        return {
          content: [
            {
              type: "text" as const,
              text: JSON.stringify(activities, null, 2),
            },
          ],
        };