HackerOne MCP Server
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@HackerOne MCP ServerShow me the in-scope assets and scope exclusions for uber."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
🎯 HackerOne MCP Server
Hey there! 👋 Welcome to the HackerOne MCP Server.
This tool seamlessly connects your favorite AI assistants (Claude Code, Claude Desktop, Cursor, Windsurf) directly to your HackerOne account.
Whether you want to search your past reports, manage draft report intents, check program scope rules & exclusions, analyze bounty payouts, draft vulnerability write-ups, or reply to triagers — your AI can now help you do it all right from your chat window! 🚀
⚡ Quick Start (60 Seconds)
1. Grab your HackerOne API Token
Head over to HackerOne > Settings > API Token and generate your token.
2. Build the project
git clone https://github.com/Sicks3c/hackerone-mcp-server.git
cd hackerone-mcp-server
npm install
npm run build3. Add to your AI Client
🌐 Via Smithery.ai (Easiest)
npx -y @smithery/cli mcp add hackerone-mcp-server💻 Claude Code (Local)
claude mcp add hackerone \
-e H1_USERNAME="your-h1-username" \
-e H1_API_TOKEN="your-h1-api-token" \
-s user \
-- node /path/to/hackerone-mcp-server/dist/index.js🖥️ Claude Desktop
Add this to your claude_desktop_config.json:
{
"mcpServers": {
"hackerone": {
"command": "node",
"args": ["/path/to/hackerone-mcp-server/dist/index.js"],
"env": {
"H1_USERNAME": "your-h1-username",
"H1_API_TOKEN": "your-h1-api-token"
}
}
}
}🖱️ Cursor / Windsurf
In your editor's MCP Settings, add a new server:
Type:
stdioCommand:
node /path/to/hackerone-mcp-server/dist/index.jsEnv: Set
H1_USERNAMEandH1_API_TOKEN
Related MCP server: h1-brain
💡 Cool Things You Can Ask Your AI
Here are a few fun prompts to try out:
🔍 Recon & Scope: "Show me the in-scope assets and scope exclusions for
uber. What are their response times and accepted vulnerability types?"📝 Report Intents (Drafts): "Create a new report intent draft for program
gitlabtitled 'XSS in search endpoint'. Let's refine the write-up before submitting."💬 Triage Assistance: "The triager on report #123456 requested an updated PoC. Help me write a friendly technical response."
💰 Check Stats & Payouts: "How much unpaid balance do I have on HackerOne right now, and show my payout history via PayPal?"
📊 Analyze Patterns: "Analyze my report history — what severity gets resolved the fastest for me?"
🔎 Hacktivity Research: "Search disclosed reports on
githubfor IDOR vulnerabilities to see what they usually pay."
🧰 What's Included?
🛠️ Tools (Actions your AI can take)
Category | Tool | What it does |
Reports |
| Search your reports by keyword, program, severity, or state |
| View full report details (CVSS score, bounty, attachments) | |
| View report details along with full triage conversation | |
| View timeline of comments, bounties, and status changes | |
| Submit a brand new report to a program | |
| Post a comment or reply to a triager | |
| Withdraw or close a report | |
| Build a clean Markdown template for your report write-up | |
Report Intents (Drafts) |
| List all draft report intents and AI processing job statuses |
| Get details of a specific draft report intent | |
| Create a new draft report intent | |
| Update draft report intent title or write-up | |
| Delete a draft report intent | |
| Finalize and submit a draft intent as an official report | |
| List attachments for a draft report intent | |
| Delete an attachment from a draft report intent | |
Programs |
| Discover & rank the best programs by fast payouts, bounties, or open scope |
| List all bug bounty programs you have access to | |
| Check program policy, response metrics, and average pay times | |
| List all in-scope assets for a target program | |
| List report categories specifically excluded from rewards | |
| List accepted weakness/CWE categories for a program | |
Profile & Financials |
| Check your reputation score, signal, impact, and rank |
| See your bounty earnings history | |
| Check completed payouts history (PayPal, Wire, status) | |
| Check your current unpaid bounty balance | |
| Get stats on your report severities, states, and top programs | |
Hacktivity |
| Search publicly disclosed hacktivity reports for research |
📌 Resources (Instant context for your AI)
Your AI can instantly look up these hackerone:// URIs:
👤
hackerone://profile— Your live reputation, signal, impact, and rank.💵
hackerone://balance— Your unpaid balance.📈
hackerone://earnings/recent— Your latest bounty payouts.📋
hackerone://reports/recent— Your 10 latest submitted reports.🔥
hackerone://hacktivity/trending— Top upvoted public reports on Hacktivity.
💬 Prompts (Guided workflows)
find-best-bounty-program: Automated strategy prompt to find & rank the highest-paying, fast-response target programs.draft-vulnerability-report: Step-by-step guide to draft a top-tier report.triage-response-assistant: Craft polite, effective replies to triagers.analyze-program-scope: Break down a program's assets to find high-yield targets.summarize-hunting-profile: Create a neat summary dashboard of your research stats.
⚙️ Configuration Options
Setting | Required? | Default | Description |
| Yes | — | Your HackerOne API Username |
| Yes | — | Your HackerOne API Token |
| No |
| Base API URL |
| No |
| Response caching speed booster |
| No |
| Verbosity ( |
🔒 Security & Privacy
100% Local: Runs completely on your local machine using stdio transport.
Your Credentials Stay Yours: Your API keys are kept strictly in your local environment variables and never sent anywhere except directly to HackerOne's official API.
📜 License
MIT License — Feel free to use, modify, and share! Happy hunting! 🎯
Available Tools
28 toolsadd_commentA
Add a comment to an existing HackerOne report. Use this to respond to triage questions or provide additional information.
| Name | Required | Description | Default |
|---|---|---|---|
| message | Yes | Comment text (supports markdown) | |
| internal | No | If true, comment is only visible to the team (default false) | |
| report_id | Yes | The HackerOne report ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. Only states 'add a comment' without disclosing behavioral traits like idempotency, rate limits, or constraints. Does not contradict annotations (none).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with clear front-loading of purpose. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema; description does not explain return values or error behavior. For a simple add operation, basic context is provided but insufficient for complex scenarios.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers all 3 parameters with descriptions. Description adds no additional meaning beyond schema; baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states verb 'add' and resource 'comment to existing HackerOne report', with usage context (respond to triage or provide info). Distinguishes from sibling tools as no other comment tool exists.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use: 'respond to triage questions or provide additional information'. Does not provide exclusions or alternatives, but context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_report_patternsA
Fetch your recent reports and analyze patterns: most common vulnerability types, severity distribution, resolution rates, and programs. Useful for understanding your hunting profile.
| Name | Required | Description | Default |
|---|---|---|---|
| page_size | No | Number of reports to analyze (default 100) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It says 'Fetch your recent reports' which implies a read operation, but does not explicitly state that the tool is read-only, non-destructive, or what permissions are needed. The description lacks details on side effects or data scope.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is only two sentences long, front-loads the action and key outputs, and contains no unnecessary words. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one optional parameter and no output schema, the description explains what patterns are analyzed but omits important context: what 'recent' means (time frame), whether results are paginated, and what the response format looks like. This leaves gaps for an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with a single optional parameter (page_size) that has a clear description in the schema. The tool description does not add any additional meaning or context about the parameter beyond the schema, so a score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool fetches recent reports and analyzes specific patterns (vulnerability types, severity, resolution rates, programs). It uses a specific verb ('analyze') and resource ('reports'), and the listed patterns distinguish it from sibling tools like search_reports or get_report that only fetch raw data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes 'Useful for understanding your hunting profile,' which implies a usage context but does not explicitly state when to use this tool over alternatives like search_reports. There is no mention of prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
close_reportA
Withdraw/close one of your own HackerOne reports. Sends a close request with an optional message.
| Name | Required | Description | Default |
|---|---|---|---|
| message | No | Reason for closing (default: 'Withdrawing this report.') | |
| report_id | Yes | The HackerOne report ID to close |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses that a close request is sent, but lacks details on side effects (e.g., immediate closure, pending state), required permissions, or response behavior. This is minimal for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with no wasted words. It includes the core action and optional parameter, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with 2 parameters and no output schema, the description covers purpose and main behavior. It could mention limitations (e.g., only works on own reports) but adequately supports basic usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with both parameters described. The description adds 'optional message' which aligns with the schema but does not provide additional meaning beyond what the schema already offers.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Withdraw/close'), the resource ('your own HackerOne reports'), and the mechanism ('Sends a close request with optional message'). It distinguishes from sibling tools like submit_report or add_comment by specifying the action of closing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for closing own reports but provides no explicit when-to-use or when-not-to-use guidance. No alternatives are mentioned, leaving the agent to infer context from sibling tool names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_report_intentA
Create a new draft report intent before submitting as a report.
| Name | Required | Description | Default |
|---|---|---|---|
| title | No | Draft report title | |
| description | No | Draft vulnerability write-up | |
| program_handle | No | Program handle (e.g. 'uber') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description fails to disclose behavioral traits such as mutability, side effects, or required permissions, relying solely on the verb 'Create' to imply creation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with no redundancy or unnecessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple parameter set and presence of sibling tools, the description adequately conveys the purpose, though additional context about what a 'report intent' is would enhance completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameter descriptions in the schema already provide clear meaning; the tool description adds no additional value beyond the generic 'draft' context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Create'), resource ('report intent'), and context ('before submitting as a report'), effectively distinguishing from sibling tools like submit_report_intent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool's place in the workflow ('before submitting'), but lacks explicit guidance on when not to use it or alternative tools for different intents.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_report_intentB
Delete a draft report intent.
| Name | Required | Description | Default |
|---|---|---|---|
| report_intent_id | Yes | The report intent ID to delete |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden. It reveals the destructive nature but lacks details on whether deletion is soft/hard, effects on related data, or error conditions (e.g., non-draft intents).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no wasted words, but it is overly minimal, providing only the bare minimum. It could be expanded without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the operation (delete with one parameter) and no output schema, the description is somewhat complete but lacks critical context such as preconditions (draft state), behavior on failure, and return value. With no annotations, more context is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema coverage is 100% with a clear description of 'report_intent_id'. The tool description does not add any additional semantic value beyond the schema, which is acceptable but not exemplary.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Delete a draft report intent' uses a specific verb ('Delete') and a specific resource ('draft report intent'), clearly distinguishing it from sibling tools like get_report_intent, create_report_intent, and update_report_intent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No usage guidelines are provided; the description does not state when to use this tool vs. alternatives like submit_report_intent, nor does it mention prerequisites (e.g., the intent must be in draft state, permissions required).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_report_intent_attachmentB
Delete an attachment from a draft report intent.
| Name | Required | Description | Default |
|---|---|---|---|
| attachment_id | Yes | The attachment ID to delete | |
| report_intent_id | Yes | The report intent ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It only restates the action without disclosing behavioral traits such as whether deletion is permanent, idempotent, or requires ownership. The description adds no behavioral context beyond the name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, concise sentence that states the action and resource with no fluff. It is appropriately front-loaded but could benefit from additional context without sacrificing brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description is minimal. It does not explain return values, side effects, or constraints such as the report intent must be in draft state. The tool is simple, but the description lacks completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters. The description does not add additional meaning beyond what the schema provides, fitting the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly specifies the verb 'Delete' and the resource 'attachment from a draft report intent'. It distinguishes itself from sibling tools like 'delete_report_intent' which deletes the entire intent, and 'get_report_intent_attachments' which lists attachments.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used when deleting an attachment from a draft report intent but provides no explicit guidance on when to use it versus alternatives, nor does it mention prerequisites or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_best_programsB
Discover and filter the best active bug bounty programs matching your criteria: bounty offers, fast payments, open submission, open scope, or keywords.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Keyword to search in program name, handle, or policy (e.g. 'crypto', 'cloud', 'API') | |
| max_results | No | Maximum number of top matching programs to return (default: 25) | |
| open_scope_only | No | Only return programs with wide open asset scopes | |
| fast_payments_only | No | Only return programs offering fast bounty payouts | |
| offers_bounties_only | No | Only return programs that pay bounties (default: true) | |
| open_submission_only | No | Only return programs currently open for report submissions (default: true) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears the full burden of disclosing behavioral traits. It does not mention whether the tool is read-only, what the output format is, whether results are paginated, or any rate limits. The description only lists filter inputs, lacking any behavioral context beyond the stated purpose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that efficiently conveys the tool's purpose and primary filters. It omits mention of the 'max_results' parameter, but this is acceptable as it is a limiter rather than a filter criterion. The description is front-loaded and to the point with no redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of annotations and output schema, the description should explain what the tool returns (e.g., a list of program summaries). It does not describe the output format, order of results, or behavior when no matches are found. This leaves the agent with incomplete context for understanding the tool's full behavior and return value.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with descriptions for all 6 parameters. The description adds minimal value beyond the schema, simply enumerating some filter criteria (e.g., 'open scope' maps to open_scope_only). It does not provide additional meaning such as examples or constraints that the schema lacks. According to guidelines, baseline is 3 when coverage is high.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: discovering and filtering active bug bounty programs. It identifies specific filtering criteria (bounty offers, fast payments, etc.) and uses an action verb 'Discover and filter', which distinguishes it from siblings like 'list_programs' (which likely lists all) and 'get_program_details' (which gets a specific program).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide usage guidelines, such as when to use this tool versus alternatives like 'list_programs' or 'get_program_details'. There is no mention of prerequisites, when not to use it, or explicit context. The implied usage is for discovering programs matching criteria, but without differentiation from sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_report_templateA
Generate a structured Markdown template for drafting a vulnerability report. Helps format Summary, Steps to Reproduce, Impact, and Remediation.
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | Report title | |
| impact | Yes | Impact description explaining the risk | |
| summary | Yes | Executive summary of the vulnerability | |
| remediation | No | Suggested fix or mitigation guidance | |
| target_asset | Yes | Target URL or asset identifier | |
| steps_to_reproduce | Yes | Numbered steps to reproduce the issue | |
| vulnerability_type | Yes | Vulnerability type or CWE (e.g. 'IDOR', 'SSRF') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It indicates the tool generates a template (non-destructive, no side effects), but does not explicitly state it returns Markdown or does not modify data. Mostly transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the primary action. No filler, every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose and sections but does not explicitly specify the output format (Markdown string) or that remediation is optional. With no output schema, slightly more detail on the return value would help.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so each parameter has a description. The tool description adds value by grouping parameters into report sections (Summary, Steps, Impact, Remediation), providing context beyond individual definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool generates a structured Markdown template for vulnerability reports, listing key sections (Summary, Steps, Impact, Remediation). It distinguishes from sibling tools that handle actual report creation or submission.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for drafting a report but lacks explicit guidance on when to use vs. alternatives like create_report_intent or submit_report. No when-not or alternative references.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_balanceB
Get your current unpaid bounty balance on HackerOne.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description must fully disclose behavior. It implies a read operation but omits details like authentication needs, rate limits, or how the balance is returned (e.g., format, currency). The minimal info leaves room for misinterpretation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no wasted words. It is front-loaded and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters and no output schema, the description is adequate but not complete. It doesn't explain the return value, which may be needed for proper invocation (e.g., numeric value, currency).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, and schema coverage is effectively 100%. Per rules, 0 parameters yields a baseline of 4. The description adds no parameter info beyond the schema, which is acceptable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves the current unpaid bounty balance, using a specific verb and resource. It distinguishes from siblings like 'get_earnings' and 'get_payouts' by specifying 'unpaid', though it could be more explicit about the distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives. Siblings like 'get_earnings' and 'get_payouts' overlap, but the description doesn't inform the agent about selection criteria or exclude cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_earningsB
Get your bounty earnings history. Shows amounts, currency, dates, and which programs paid out.
| Name | Required | Description | Default |
|---|---|---|---|
| page_size | No | Number of earnings to return (default 100) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It implies a read-only operation and shows output fields, but does not disclose auth requirements, rate limits, or behavior with empty history. Adequate but not detailed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences front-load the purpose and output fields. No wasted words, efficient structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a single optional parameter and no output schema, the description covers the main intent and output adequately. Could mention default page_size (100) or that it returns current user's earnings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the only parameter (page_size). The description adds no extra meaning beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get your bounty earnings history' with specific verb and resource. It mentions amounts, currency, dates, and programs, but does not explicitly differentiate from sibling tools like get_payouts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives such as get_payouts or get_balance. The description lacks context for selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_hacker_profileA
Get your HackerOne hacker profile: reputation, signal, impact, rank, and account info.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It does not specify behavioral traits such as whether the operation is read-only, idempotent, or requires specific permissions. The mention of fields is helpful but not sufficient for full transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that efficiently conveys the tool's purpose and key content. No extraneous words or redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless, simple retrieval tool, the description is mostly complete. However, it omits information about authentication requirements or that it returns the profile of the authenticated user, which would be helpful for operational context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters and schema description coverage is 100%, so the baseline is 4. The description adds no additional parameter information, which is acceptable given no parameters exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Get' and identifies the resource as 'your HackerOne hacker profile,' listing key fields (reputation, signal, impact, rank, account info). This clearly distinguishes it from sibling tools which deal with reports, intents, programs, and earnings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. Since no sibling tool retrieves the hacker profile, the usage is arguably implied, but the description lacks mention of prerequisites (e.g., authentication required) or context for when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_payoutsA
Get your payout history showing completed payout transactions, payment providers (e.g. PayPal, Wire), status, and dates.
| Name | Required | Description | Default |
|---|---|---|---|
| page_size | No | Number of payouts to return (default 50) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description should convey behavioral traits. It mentions 'completed payout transactions' implying a filter, but lacks details on authorization, rate limits, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that conveys the tool's purpose and output fields without extraneous words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a list tool with no output schema, the description reasonably covers returned data (transactions, providers, status, dates). However, it omits pagination behavior beyond the page_size parameter.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the only parameter (page_size). The description does not add new information beyond what the schema provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves payout history and lists specific data shown (transactions, providers, status, dates). This is distinct from sibling tools like get_earnings or get_balance.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for viewing payout history but provides no explicit guidance on when to use this tool versus alternatives, nor any exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_program_detailsA
Get detailed info about a single program: policy, response times, metrics, bounty splitting, and submission state.
| Name | Required | Description | Default |
|---|---|---|---|
| program_handle | Yes | Program handle (e.g. 'uber', 'github') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses what data the tool returns (policy, response times, metrics, etc.) but does not mention whether the operation is read-only, if authentication is required, or error behavior (e.g., if the program handle is invalid). The description implies a safe read operation but lacks explicit behavioral details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded with the action and resource, listing the key data points concisely. Every word adds value with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple retrieval tool with one parameter and no output schema, the description adequately lists what information is returned (policy, response times, metrics, bounty splitting, submission state). It is sufficient for an AI agent to understand what the tool provides, though it could mention any constraints like program availability.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with one parameter (program_handle). The schema description says 'Program handle (e.g. 'uber', 'github')', which adds example values. The tool description reinforces that the handle identifies a single program but does not add semantic depth beyond what the schema provides. Baseline score 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and the resource 'detailed info about a single program', listing specific data types like policy, response times, metrics, bounty splitting, and submission state. This clearly distinguishes it from sibling tools like list_programs (which lists all programs) and get_program_scope (which returns scope details).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving details of a specific program but provides no explicit guidance on when to use this tool versus alternatives like list_programs or get_program_scope. There are no when-not-to-use conditions or contextual comparisons.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_program_scopeA
Get the in-scope assets for a bug bounty program. Auto-paginates to return all scope items. Returns asset types, identifiers, bounty eligibility, and severity caps.
| Name | Required | Description | Default |
|---|---|---|---|
| page_size | No | Max scope items to return (default: all) | |
| program_handle | Yes | Program handle (e.g. 'uber', 'ipc-h1c-aws-tokyo-2026') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. Discloses auto-pagination behavior and return fields (asset types, identifiers, bounty, severity caps). This is good behavioral context for an agent considering pagination and data retrieval.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences: first states primary action, second adds key details (auto-pagination and return fields). No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, pagination behavior, and return data. Lacks details on pagination mechanism (e.g., cursor vs offset) and explicit read-only safety, but given no output schema and simple params, it is largely sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (both parameters described in schema). Description adds 'auto-paginates' context but doesn't significantly enhance parameter understanding beyond schema defaults and examples.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it gets in-scope assets for a bug bounty program, differentiating from siblings like get_scope_exclusions (which gets excluded items) and list_programs (which lists programs). Specifies returned data: asset types, identifiers, bounty eligibility, severity caps.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives such as get_scope_exclusions or get_program_details. Does not mention prerequisites or context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_program_weaknessesA
Get the accepted vulnerability/weakness types for a program. Auto-paginates. Helps frame reports using the right CWE categories the program cares about.
| Name | Required | Description | Default |
|---|---|---|---|
| page_size | No | Max weaknesses to return (default: all) | |
| program_handle | Yes | Program handle (e.g. 'uber', 'ipc-h1c-aws-tokyo-2026') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses 'Auto-paginates' and implies a read-only operation. However, it does not cover error handling or edge cases, but the provided information is sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each adding value: purpose, pagination behavior, and usage context. Front-loaded and no fluff. Highly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given two parameters and no output schema, the description covers the core functionality and usage context. It could mention the output format briefly, but it's mostly complete for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds 'Auto-paginates' and example values, but does not provide semantic meaning beyond what the schema already gives (e.g., 'default: all' is already in schema).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and the resource 'accepted vulnerability/weakness types for a program.' It also distinguishes from sibling tools (none are similar) and provides context with 'Auto-paginates.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use the tool: 'Helps frame reports using the right CWE categories the program cares about.' It does not explicitly state when not to use or provide alternatives, but the context is clear enough for an agent to decide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_reportA
Get the full details of a specific HackerOne report by ID. Returns title, vulnerability details, impact, severity, full CVSS vector/score, bounty amounts, attachments, timestamps, and program info.
| Name | Required | Description | Default |
|---|---|---|---|
| report_id | Yes | The HackerOne report ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description bears full burden of behavioral disclosure. It enumerates the return fields (title, vulnerability details, impact, severity, CVSS, bounty, attachments, timestamps, program info), giving the agent a comprehensive expectation of outputs. The 'Get' verb implies a read-only, non-destructive operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description consists of two concise sentences: the first states the action and resource, the second lists return fields. It is efficient and front-loaded, with no redundant words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of an output schema, the description adequately details the return content. The tool is simple (one required param, no complex nesting), and the description covers essential behavioral aspects. Minor omissions like pagination or error handling do not significantly impair completeness for a fetch-by-ID tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides 100% parameter coverage with a clear description for report_id ('The HackerOne report ID'). The description reinforces that the ID corresponds to a specific HackerOne report but adds no new semantic details beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific verb 'Get' and clearly identifies the resource as 'full details of a specific HackerOne report by ID'. It enumerates the return fields (title, vulnerability, severity, CVSS, bounty, etc.), making it distinct from sibling tools like search_reports (list) or get_report_intent (intent only).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (when full report details are needed for a specific ID) but does not explicitly warn against alternatives or mention siblings. The context from sibling names provides some guidance, but the description itself lacks explicit when-not-to-use or alternative pointers.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_report_activitiesA
Get the activity timeline of a report: comments, state changes, bounty awards, and triage responses.
| Name | Required | Description | Default |
|---|---|---|---|
| page_size | No | Number of activities to return (default 50) | |
| report_id | Yes | The HackerOne report ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description bears the full burden. It adds behavioral context by specifying the types of activities returned (comments, state changes, etc.), which goes beyond the schema. However, it omits details like read-only nature, authentication requirements, rate limits, or pagination behavior. The description is adequate but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, well-structured sentence that conveys the core functionality and output types without extraneous words. Every element earns its place, making it easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description lists activity types but does not detail activity structure, pagination behavior, ordering, or default page_size. With no output schema, this leaves some gaps for an agent. It is minimally sufficient for a simple read operation, but richer context would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with both parameters (report_id, page_size) having descriptions. The tool description does not add further parameter-specific meaning or usage guidance. Baseline of 3 is appropriate; no extra value beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool retrieves an activity timeline of a report, listing specific activity types (comments, state changes, bounty awards, triage responses). This verb+resource combination is specific and distinguishes it from siblings like get_report (which retrieves the report itself) and get_report_with_conversation (likely focused on conversation).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for fetching activity timelines but does not provide explicit guidance on when to use versus alternatives (e.g., get_report_with_conversation). No exclusions or when-not-to-use advice is given. The context is clear enough for an agent to infer the primary use case, but lacks depth.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_report_intentA
Get details of a specific draft report intent by ID.
| Name | Required | Description | Default |
|---|---|---|---|
| report_intent_id | Yes | The report intent ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It says 'Get details' but does not disclose what is returned, whether read-only, or any behavioral traits like authentication needs or rate limits. Minimal transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded, no superfluous words. Efficiently communicates purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity tool (1 param, no output schema), the description is somewhat complete but fails to specify what 'details' includes. Could mention return fields or structure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the one parameter 'report_intent_id'. The description adds no additional meaning beyond the schema's 'The report intent ID'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get', the resource 'draft report intent', and the scope 'by ID'. It distinguishes this tool from sibling tools like 'get_report_intents' (list) and 'create_report_intent'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use or when not to use this tool versus alternatives. The description implies a specific retrieval operation but lacks exclusions or context for selection among many siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_report_intent_attachmentsB
List all attachments associated with a draft report intent.
| Name | Required | Description | Default |
|---|---|---|---|
| report_intent_id | Yes | The report intent ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears full responsibility. It fails to disclose whether this is a read-only operation, required permissions, rate limits, or details about the return format (e.g., attachments metadata vs. file URLs). The simple statement 'List all attachments' is insufficient for behavioral transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no extraneous words. It is front-loaded with the verb 'List' and the key resource, making it efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple (one parameter, no output schema), but the description lacks details about what the tool returns (e.g., attachment IDs, file names, metadata). It correctly scopes to 'draft report intent' but could be more complete by indicating the output structure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with one parameter (report_intent_id) described in the schema as 'The report intent ID'. The description adds no additional meaning beyond the schema, such as formatting or validation constraints. Baseline of 3 applies due to full schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'list' and resource 'attachments' with a specific scope 'draft report intent'. It distinguishes from sibling tools like delete_report_intent_attachment because it lists all attachments rather than deleting. However, it could be more precise by specifying that it returns metadata or identifiers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives (e.g., delete_report_intent_attachment). There is no mention of prerequisites, typical workflow, or conditions that warrant listing attachments.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_report_intentsB
List all draft report intents and AI assistant processing job statuses.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must reveal behavioral traits. It implies a read-only operation ('list') but provides no details about side effects, permissions, or data freshness. The statement is adequate but lacks depth.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded and to the point. It could be slightly expanded to include more detail without losing conciseness, but it currently has no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description should explain the return value structure. It mentions 'draft report intents' and 'AI assistant processing job statuses' but does not describe the fields or format of each item. This is a gap in completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so the schema coverage is 100%. The description does not need to add parameter semantics, and it correctly handles this by focusing on the output.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists draft report intents and AI assistant processing job statuses, using a specific verb ('list') and resource ('report intents', 'job statuses'). It distinguishes from the singular sibling 'get_report_intent' but could be more explicit about the scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus siblings such as 'get_report_intent', 'search_reports', or 'get_report'. The description does not mention alternatives or conditions for use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_report_with_conversationA
Get a report with its full triage conversation. Useful for understanding what questions triage asked, how you responded, and what led to resolution. Great for learning what works.
| Name | Required | Description | Default |
|---|---|---|---|
| report_id | Yes | The HackerOne report ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It describes the read operation but does not disclose response format, pagination, or any limitations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two efficient sentences front-load the purpose with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Lacks output schema but the tool is simple with one parameter; the description adequately explains the value returned (report with conversation).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single parameter report_id, so the description adds no additional meaning beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and the resource 'report with its full triage conversation', distinguishing it from siblings like get_report which likely lacks conversation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explains the tool is useful for understanding triage conversation and learning, but does not explicitly mention when to avoid using it or compare with alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_scope_exclusionsA
Get report categories that are specifically excluded from rewards for a program.
| Name | Required | Description | Default |
|---|---|---|---|
| program_handle | Yes | Program handle (e.g. 'uber', 'gitlab') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden for behavioral disclosure. It only states the basic function without revealing side effects, output format, or error conditions (e.g., what happens for invalid program_handle).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no extraneous words. Every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema) and lack of complex behavior, the description is minimally adequate. However, it could be improved by clarifying the difference from get_program_scope or indicating that the result is a list of categories.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the one parameter (program_handle) already has a description. The tool description adds no extra meaning beyond the schema, so a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the action ('Get'), the resource ('report categories'), and the specific context ('excluded from rewards for a program'). It distinguishes from sibling tools like get_program_scope, which likely retrieves all scope items.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide explicit guidance on when to use this tool versus alternatives. While the purpose is clear, the agent could benefit from noting that this tool retrieves exclusions, not inclusions, but no such direction is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_programsA
List bug bounty programs you have access to on HackerOne. Auto-paginates to return all programs.
| Name | Required | Description | Default |
|---|---|---|---|
| page_size | No | Max programs to return (default: all) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description notes auto-pagination behavior but lacks details on idempotency, rate limits, or data freshness. Without annotations, the description does not fully disclose behavioral traits beyond the basic listing operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short, front-loaded sentences with zero waste. Every word contributes to understanding the tool's core functionality.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description explains what the tool does but omits the return format (e.g., list of program names/IDs) and any authentication or permission prerequisites. Given no output schema, this is a moderate gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 100% of parameters with a description for page_size. The tool description adds auto-pagination context but does not elaborate on how page_size interacts with that behavior, so it adds minimal value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List bug bounty programs you have access to on HackerOne' using a specific verb and resource, and it distinguishes from sibling tools like get_program_details by focusing on listing all accessible programs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for retrieving all programs via 'auto-paginates to return all programs', but does not explicitly state when to use this tool versus alternatives like get_program_details for individual program info.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_disclosed_reportsA
Search publicly disclosed HackerOne reports (hacktivity). Useful for learning what gets paid, finding prior art, and understanding what a program considers valid.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Keyword to filter results (e.g. 'SSRF', 'IDOR') | |
| program | No | Program handle to filter by (e.g. 'uber') | |
| page_size | No | Number of results (default 25) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must disclose behavior. It states read-only search on public data, but doesn't mention pagination, rate limits, or auth needs. The schema's page_size implies pagination, but description adds no behavioral context beyond scope.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences: first defines action/scope, second explains utility. No fluff, front-loaded with key info.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple search tool with no output schema, description covers purpose and use cases. Missing details like result format or ordering, but adequate given complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for all parameters. The description adds no extra meaning beyond the schema, e.g., it doesn't clarify date filters or search behavior. Baseline 3 is appropriate since schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool searches publicly disclosed HackerOne reports (hacktivity), with a specific verb and resource. It differentiates from sibling tools like search_reports (likely private) by emphasizing public scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Description explains utility: learning what gets paid, finding prior art, understanding program validity. This gives clear context for when to use, but lacks explicit when-not-to-use or alternatives, though distinction from siblings is implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_reportsB
Search and list your HackerOne reports. Filter by keyword, program, severity, or state. Great for finding past reports to reference when drafting new ones.
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | Sort field (e.g. 'reports.created_at' or '-reports.created_at' for desc) | |
| query | No | Keyword search (e.g. 'SSRF', 'OAuth', 'PassRole', 'S3') | |
| state | No | Filter by report state | |
| program | No | Program handle to filter by (e.g. 'uber', 'amazon') | |
| severity | No | Filter by severity rating | |
| page_size | No | Results per page (default 25) | |
| page_number | No | Page number for pagination |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavior. It states it searches and lists reports but does not mention authentication requirements, rate limits, data scope (only user's reports?), pagination behavior, or response format. Critical details are missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences that front-load the action and filters. No unnecessary words. It efficiently communicates the core functionality.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 7 parameters, no output schema, and no annotations, the description is too minimal. It does not explain how parameters combine, default behavior for pagination/sorting, or return value structure. More context is needed for an agent to use this tool effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with each parameter described. The description adds value by listing the main filters (keyword, program, severity, state) but does not provide any additional semantics beyond what the schema already offers. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it searches and lists HackerOne reports, with specific filters (keyword, program, severity, state). This distinguishes it from siblings like get_report (single report) and search_disclosed_reports (disclosed only), though these distinctions are not explicitly mentioned.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a use case ('finding past reports to reference when drafting new ones'), implying when to use it. However, it does not give explicit guidance on when not to use it or how it compares to alternatives like search_disclosed_reports or get_report.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
submit_reportA
Submit a new vulnerability report to a HackerOne program. Returns the new report ID and URL. Use get_program_scope and get_program_weaknesses first to get the right scope/weakness IDs.
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | Report title | |
| impact | No | Impact statement — what an attacker can achieve | |
| weakness_id | No | Weakness/CWE ID from get_program_weaknesses (the numeric id field) | |
| program_handle | Yes | Program handle to submit to (e.g. 'uber') | |
| severity_rating | No | Suggested severity rating | |
| structured_scope_id | No | Scope asset ID from get_program_scope (the numeric id field) | |
| vulnerability_information | Yes | Full vulnerability details in markdown — steps to reproduce, root cause, and proof of concept |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. It states that the tool submits (a write operation) and returns ID/URL, but does not mention permissions, rate limits, or whether submission creates a draft vs. final report. The description is adequate but could provide more context about side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description consists of two concise sentences: the first states purpose and return, the second gives prerequisite guidance. No redundant information, and the key point is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool complexity (7 parameters, no output schema) and the presence of many sibling tools, the description effectively covers purpose, return values, and prerequisite steps. It does not explain error handling or idempotency, but the information provided is sufficient for a typical submission scenario.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds value by linking weakess_id and structured_scope_id to get_program_weaknesses and get_program_scope, but otherwise does not provide additional parameter semantics beyond the schema's own descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'Submit a new vulnerability report to a HackerOne program' and specifies the return value 'Returns the new report ID and URL'. This distinguishes it from sibling tools focused on report intents, searches, or other operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly instructs to 'Use get_program_scope and get_program_weaknesses first to get the right scope/weakness IDs', providing clear preconditions and referencing specific sibling tools. This guides the agent on when to use this tool and what prerequisite steps are needed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
submit_report_intentB
Finalize and submit a draft report intent as an official vulnerability report.
| Name | Required | Description | Default |
|---|---|---|---|
| report_intent_id | Yes | The report intent ID to submit |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears full responsibility for behavioral disclosure. It only states 'Finalize and submit' without explaining consequences (e.g., irreversibility, side effects, permission requirements). This is insufficient for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no unnecessary words. It front-loads the key action and resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one required parameter, no output schema), the description is minimally adequate. However, it lacks context about the lifecycle of a report intent (e.g., must be in 'draft' status) and what happens after submission (e.g., no return value described).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes the single parameter ('report_intent_id') with a basic explanation, achieving 100% coverage. The description adds no additional semantic context beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Finalize and submit') and the resource ('draft report intent' to 'official vulnerability report'). It distinguishes this tool from siblings like 'submit_report' by specifying the input is a report intent, not a full report.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage (when you have a draft report intent) but does not explicitly state when to use this tool versus alternatives such as 'submit_report' or 'create_report_intent'. No guidance on prerequisites or conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_report_intentB
Update title or description of a draft report intent.
| Name | Required | Description | Default |
|---|---|---|---|
| title | No | Updated draft title | |
| description | No | Updated draft description | |
| report_intent_id | Yes | The report intent ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It states the action (update) but does not mention behavioral traits such as whether the intent must be a draft, if updates are restricted to certain fields, or what happens after update (e.g., auto-save or confirmation).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no wasted words. It is appropriately sized for a simple update tool, though a bit more context could be added without harming conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (3 string parameters, no output schema, no annotations), the description covers the core action but misses usage context and behavioral details. It is adequate but not comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The tool description merely echoes the parameter names and does not add additional meaning beyond the schema's own descriptions ('Updated draft title', etc.).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies the verb 'Update' and the resource 'draft report intent', and lists the updatable fields (title or description). This clearly distinguishes it from sibling tools like create_report_intent, delete_report_intent, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide when or when not to use the tool, nor does it mention alternatives or prerequisites. For instance, it fails to note that the intent must be in draft status or that for final reports another tool should be used.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
28 tool updates
v1.0.0- First observed
add_comment - First observed
analyze_report_patterns - First observed
close_report - First observed
create_report_intent - First observed
delete_report_intent - First observed
delete_report_intent_attachment - First observed
find_best_programs - First observed
generate_report_template - First observed
get_balance - First observed
get_earnings - First observed
get_hacker_profile - First observed
get_payouts - First observed
get_program_details - First observed
get_program_scope - First observed
get_program_weaknesses - First observed
get_report - First observed
get_report_activities - First observed
get_report_intent - First observed
get_report_intent_attachments - First observed
get_report_intents - First observed
get_report_with_conversation - First observed
get_scope_exclusions - First observed
list_programs - First observed
search_disclosed_reports - First observed
search_reports - First observed
submit_report - First observed
submit_report_intent - First observed
update_report_intent
TDQS
Each tool targets a distinct aspect of the HackerOne platform: draft intents, final reports, programs, profile/earnings, and analysis. Even within reports, tools differentiate by detail level (basic, conversation, activities, search) without overlap.
All tools follow a consistent verb_noun pattern in snake_case (e.g., get_report_intent, create_report_intent, submit_report). The naming is predictable and descriptive, with no mixing of styles.
28 tools cover the full hacker workflow: draft lifecycle, report management, program research, and earnings. While slightly above average, each tool serves a unique purpose and the set is well-scoped.
The tool surface is remarkably complete for a hacker's needs: CRUD for report intents, full report interaction (submit, close, comment, search, activities), program exploration (scope, weaknesses, exclusions), and financial tracking (earnings, payouts, balance). Only minor optional features missing (e.g., editing submitted reports).
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets.
Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.
- mcpOAuthcom.vibgrate
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
Real-time CVE, exploit, and vulnerability intelligence for AI assistants (350K+ CVEs, 115K+ PoCs)
Related MCP Servers
- FlicenseAqualityDmaintenanceProvides read-only access to HackerOne reports, program scopes, and bounty earnings through the HackerOne API. It enables users to analyze hunting patterns, check asset eligibility, and retrieve report details or triage conversations via natural language.941-
- AlicenseNot gradedqualityCmaintenanceConnects AI assistants to HackerOne to pull bug bounty history, program scopes, and report details into a local SQLite database, exposing tools for searching, analyzing, and generating attack briefings using both personal and public disclosed reports.351MIT
- AlicenseNot gradedqualityCmaintenanceConnects AI assistants to HackerOne bug bounty history, program scopes, and public disclosed reports for searching, analyzing, and generating attack briefings.MIT
- AlicenseNot gradedqualityCmaintenanceConnects AI assistants to Intigriti by syncing programs, scopes, and rules of engagement, then provides tools to search and generate actionable attack briefings.2MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/esektov12121-eng/HackerOne-MCP'
If you have feedback or need assistance with the MCP directory API, please join our Discord server