Skip to main content
Glama
esektov12121-eng

HackerOne MCP Server

🎯 HackerOne MCP Server

Hey there! 👋 Welcome to the HackerOne MCP Server.

This tool seamlessly connects your favorite AI assistants (Claude Code, Claude Desktop, Cursor, Windsurf) directly to your HackerOne account.

Whether you want to search your past reports, manage draft report intents, check program scope rules & exclusions, analyze bounty payouts, draft vulnerability write-ups, or reply to triagers — your AI can now help you do it all right from your chat window! 🚀


⚡ Quick Start (60 Seconds)

1. Grab your HackerOne API Token

Head over to HackerOne > Settings > API Token and generate your token.

2. Build the project

git clone https://github.com/Sicks3c/hackerone-mcp-server.git
cd hackerone-mcp-server
npm install
npm run build

3. Add to your AI Client

🌐 Via Smithery.ai (Easiest)

npx -y @smithery/cli mcp add hackerone-mcp-server

💻 Claude Code (Local)

claude mcp add hackerone \
  -e H1_USERNAME="your-h1-username" \
  -e H1_API_TOKEN="your-h1-api-token" \
  -s user \
  -- node /path/to/hackerone-mcp-server/dist/index.js

🖥️ Claude Desktop

Add this to your claude_desktop_config.json:

{
  "mcpServers": {
    "hackerone": {
      "command": "node",
      "args": ["/path/to/hackerone-mcp-server/dist/index.js"],
      "env": {
        "H1_USERNAME": "your-h1-username",
        "H1_API_TOKEN": "your-h1-api-token"
      }
    }
  }
}

🖱️ Cursor / Windsurf

In your editor's MCP Settings, add a new server:

  • Type: stdio

  • Command: node /path/to/hackerone-mcp-server/dist/index.js

  • Env: Set H1_USERNAME and H1_API_TOKEN


Related MCP server: h1-brain

💡 Cool Things You Can Ask Your AI

Here are a few fun prompts to try out:

  • 🔍 Recon & Scope: "Show me the in-scope assets and scope exclusions for uber. What are their response times and accepted vulnerability types?"

  • 📝 Report Intents (Drafts): "Create a new report intent draft for program gitlab titled 'XSS in search endpoint'. Let's refine the write-up before submitting."

  • 💬 Triage Assistance: "The triager on report #123456 requested an updated PoC. Help me write a friendly technical response."

  • 💰 Check Stats & Payouts: "How much unpaid balance do I have on HackerOne right now, and show my payout history via PayPal?"

  • 📊 Analyze Patterns: "Analyze my report history — what severity gets resolved the fastest for me?"

  • 🔎 Hacktivity Research: "Search disclosed reports on github for IDOR vulnerabilities to see what they usually pay."


🧰 What's Included?

🛠️ Tools (Actions your AI can take)

Category

Tool

What it does

Reports

search_reports

Search your reports by keyword, program, severity, or state

get_report

View full report details (CVSS score, bounty, attachments)

get_report_with_conversation

View report details along with full triage conversation

get_report_activities

View timeline of comments, bounties, and status changes

submit_report

Submit a brand new report to a program

add_comment

Post a comment or reply to a triager

close_report

Withdraw or close a report

generate_report_template

Build a clean Markdown template for your report write-up

Report Intents (Drafts)

get_report_intents

List all draft report intents and AI processing job statuses

get_report_intent

Get details of a specific draft report intent

create_report_intent

Create a new draft report intent

update_report_intent

Update draft report intent title or write-up

delete_report_intent

Delete a draft report intent

submit_report_intent

Finalize and submit a draft intent as an official report

get_report_intent_attachments

List attachments for a draft report intent

delete_report_intent_attachment

Delete an attachment from a draft report intent

Programs

find_best_programs

Discover & rank the best programs by fast payouts, bounties, or open scope

list_programs

List all bug bounty programs you have access to

get_program_details

Check program policy, response metrics, and average pay times

get_program_scope

List all in-scope assets for a target program

get_scope_exclusions

List report categories specifically excluded from rewards

get_program_weaknesses

List accepted weakness/CWE categories for a program

Profile & Financials

get_hacker_profile

Check your reputation score, signal, impact, and rank

get_earnings

See your bounty earnings history

get_payouts

Check completed payouts history (PayPal, Wire, status)

get_balance

Check your current unpaid bounty balance

analyze_report_patterns

Get stats on your report severities, states, and top programs

Hacktivity

search_disclosed_reports

Search publicly disclosed hacktivity reports for research


📌 Resources (Instant context for your AI)

Your AI can instantly look up these hackerone:// URIs:

  • 👤 hackerone://profile — Your live reputation, signal, impact, and rank.

  • 💵 hackerone://balance — Your unpaid balance.

  • 📈 hackerone://earnings/recent — Your latest bounty payouts.

  • 📋 hackerone://reports/recent — Your 10 latest submitted reports.

  • 🔥 hackerone://hacktivity/trending — Top upvoted public reports on Hacktivity.


💬 Prompts (Guided workflows)

  • find-best-bounty-program: Automated strategy prompt to find & rank the highest-paying, fast-response target programs.

  • draft-vulnerability-report: Step-by-step guide to draft a top-tier report.

  • triage-response-assistant: Craft polite, effective replies to triagers.

  • analyze-program-scope: Break down a program's assets to find high-yield targets.

  • summarize-hunting-profile: Create a neat summary dashboard of your research stats.


⚙️ Configuration Options

Setting

Required?

Default

Description

H1_USERNAME

Yes

Your HackerOne API Username

H1_API_TOKEN

Yes

Your HackerOne API Token

H1_BASE_URL

No

https://api.hackerone.com/v1

Base API URL

CACHE_TTL_MS

No

60000 (1 min)

Response caching speed booster

LOG_LEVEL

No

info

Verbosity (debug, info, warn, error)


🔒 Security & Privacy

  • 100% Local: Runs completely on your local machine using stdio transport.

  • Your Credentials Stay Yours: Your API keys are kept strictly in your local environment variables and never sent anywhere except directly to HackerOne's official API.


📜 License

MIT License — Feel free to use, modify, and share! Happy hunting! 🎯

Available Tools

28 tools
add_commentA

Add a comment to an existing HackerOne report. Use this to respond to triage questions or provide additional information.

ParametersJSON Schema
NameRequiredDescriptionDefault
messageYesComment text (supports markdown)
internalNoIf true, comment is only visible to the team (default false)
report_idYesThe HackerOne report ID

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. Only states 'add a comment' without disclosing behavioral traits like idempotency, rate limits, or constraints. Does not contradict annotations (none).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with clear front-loading of purpose. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema; description does not explain return values or error behavior. For a simple add operation, basic context is provided but insufficient for complex scenarios.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers all 3 parameters with descriptions. Description adds no additional meaning beyond schema; baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states verb 'add' and resource 'comment to existing HackerOne report', with usage context (respond to triage or provide info). Distinguishes from sibling tools as no other comment tool exists.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use: 'respond to triage questions or provide additional information'. Does not provide exclusions or alternatives, but context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_report_patternsA

Fetch your recent reports and analyze patterns: most common vulnerability types, severity distribution, resolution rates, and programs. Useful for understanding your hunting profile.

ParametersJSON Schema
NameRequiredDescriptionDefault
page_sizeNoNumber of reports to analyze (default 100)

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It says 'Fetch your recent reports' which implies a read operation, but does not explicitly state that the tool is read-only, non-destructive, or what permissions are needed. The description lacks details on side effects or data scope.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is only two sentences long, front-loads the action and key outputs, and contains no unnecessary words. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one optional parameter and no output schema, the description explains what patterns are analyzed but omits important context: what 'recent' means (time frame), whether results are paginated, and what the response format looks like. This leaves gaps for an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with a single optional parameter (page_size) that has a clear description in the schema. The tool description does not add any additional meaning or context about the parameter beyond the schema, so a score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool fetches recent reports and analyzes specific patterns (vulnerability types, severity, resolution rates, programs). It uses a specific verb ('analyze') and resource ('reports'), and the listed patterns distinguish it from sibling tools like search_reports or get_report that only fetch raw data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes 'Useful for understanding your hunting profile,' which implies a usage context but does not explicitly state when to use this tool over alternatives like search_reports. There is no mention of prerequisites or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

close_reportA

Withdraw/close one of your own HackerOne reports. Sends a close request with an optional message.

ParametersJSON Schema
NameRequiredDescriptionDefault
messageNoReason for closing (default: 'Withdrawing this report.')
report_idYesThe HackerOne report ID to close

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses that a close request is sent, but lacks details on side effects (e.g., immediate closure, pending state), required permissions, or response behavior. This is minimal for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence with no wasted words. It includes the core action and optional parameter, making it easy to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with 2 parameters and no output schema, the description covers purpose and main behavior. It could mention limitations (e.g., only works on own reports) but adequately supports basic usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with both parameters described. The description adds 'optional message' which aligns with the schema but does not provide additional meaning beyond what the schema already offers.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Withdraw/close'), the resource ('your own HackerOne reports'), and the mechanism ('Sends a close request with optional message'). It distinguishes from sibling tools like submit_report or add_comment by specifying the action of closing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for closing own reports but provides no explicit when-to-use or when-not-to-use guidance. No alternatives are mentioned, leaving the agent to infer context from sibling tool names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_report_intentA

Create a new draft report intent before submitting as a report.

ParametersJSON Schema
NameRequiredDescriptionDefault
titleNoDraft report title
descriptionNoDraft vulnerability write-up
program_handleNoProgram handle (e.g. 'uber')

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description fails to disclose behavioral traits such as mutability, side effects, or required permissions, relying solely on the verb 'Create' to imply creation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence with no redundancy or unnecessary information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple parameter set and presence of sibling tools, the description adequately conveys the purpose, though additional context about what a 'report intent' is would enhance completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameter descriptions in the schema already provide clear meaning; the tool description adds no additional value beyond the generic 'draft' context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Create'), resource ('report intent'), and context ('before submitting as a report'), effectively distinguishing from sibling tools like submit_report_intent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool's place in the workflow ('before submitting'), but lacks explicit guidance on when not to use it or alternative tools for different intents.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_report_intentB

Delete a draft report intent.

ParametersJSON Schema
NameRequiredDescriptionDefault
report_intent_idYesThe report intent ID to delete

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It reveals the destructive nature but lacks details on whether deletion is soft/hard, effects on related data, or error conditions (e.g., non-draft intents).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no wasted words, but it is overly minimal, providing only the bare minimum. It could be expanded without losing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the operation (delete with one parameter) and no output schema, the description is somewhat complete but lacks critical context such as preconditions (draft state), behavior on failure, and return value. With no annotations, more context is needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema coverage is 100% with a clear description of 'report_intent_id'. The tool description does not add any additional semantic value beyond the schema, which is acceptable but not exemplary.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Delete a draft report intent' uses a specific verb ('Delete') and a specific resource ('draft report intent'), clearly distinguishing it from sibling tools like get_report_intent, create_report_intent, and update_report_intent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No usage guidelines are provided; the description does not state when to use this tool vs. alternatives like submit_report_intent, nor does it mention prerequisites (e.g., the intent must be in draft state, permissions required).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_report_intent_attachmentB

Delete an attachment from a draft report intent.

ParametersJSON Schema
NameRequiredDescriptionDefault
attachment_idYesThe attachment ID to delete
report_intent_idYesThe report intent ID

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It only restates the action without disclosing behavioral traits such as whether deletion is permanent, idempotent, or requires ownership. The description adds no behavioral context beyond the name.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, concise sentence that states the action and resource with no fluff. It is appropriately front-loaded but could benefit from additional context without sacrificing brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description is minimal. It does not explain return values, side effects, or constraints such as the report intent must be in draft state. The tool is simple, but the description lacks completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters. The description does not add additional meaning beyond what the schema provides, fitting the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly specifies the verb 'Delete' and the resource 'attachment from a draft report intent'. It distinguishes itself from sibling tools like 'delete_report_intent' which deletes the entire intent, and 'get_report_intent_attachments' which lists attachments.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is used when deleting an attachment from a draft report intent but provides no explicit guidance on when to use it versus alternatives, nor does it mention prerequisites or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_best_programsB

Discover and filter the best active bug bounty programs matching your criteria: bounty offers, fast payments, open submission, open scope, or keywords.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryNoKeyword to search in program name, handle, or policy (e.g. 'crypto', 'cloud', 'API')
max_resultsNoMaximum number of top matching programs to return (default: 25)
open_scope_onlyNoOnly return programs with wide open asset scopes
fast_payments_onlyNoOnly return programs offering fast bounty payouts
offers_bounties_onlyNoOnly return programs that pay bounties (default: true)
open_submission_onlyNoOnly return programs currently open for report submissions (default: true)

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears the full burden of disclosing behavioral traits. It does not mention whether the tool is read-only, what the output format is, whether results are paginated, or any rate limits. The description only lists filter inputs, lacking any behavioral context beyond the stated purpose.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that efficiently conveys the tool's purpose and primary filters. It omits mention of the 'max_results' parameter, but this is acceptable as it is a limiter rather than a filter criterion. The description is front-loaded and to the point with no redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of annotations and output schema, the description should explain what the tool returns (e.g., a list of program summaries). It does not describe the output format, order of results, or behavior when no matches are found. This leaves the agent with incomplete context for understanding the tool's full behavior and return value.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage with descriptions for all 6 parameters. The description adds minimal value beyond the schema, simply enumerating some filter criteria (e.g., 'open scope' maps to open_scope_only). It does not provide additional meaning such as examples or constraints that the schema lacks. According to guidelines, baseline is 3 when coverage is high.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: discovering and filtering active bug bounty programs. It identifies specific filtering criteria (bounty offers, fast payments, etc.) and uses an action verb 'Discover and filter', which distinguishes it from siblings like 'list_programs' (which likely lists all) and 'get_program_details' (which gets a specific program).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide usage guidelines, such as when to use this tool versus alternatives like 'list_programs' or 'get_program_details'. There is no mention of prerequisites, when not to use it, or explicit context. The implied usage is for discovering programs matching criteria, but without differentiation from sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

generate_report_templateA

Generate a structured Markdown template for drafting a vulnerability report. Helps format Summary, Steps to Reproduce, Impact, and Remediation.

ParametersJSON Schema
NameRequiredDescriptionDefault
titleYesReport title
impactYesImpact description explaining the risk
summaryYesExecutive summary of the vulnerability
remediationNoSuggested fix or mitigation guidance
target_assetYesTarget URL or asset identifier
steps_to_reproduceYesNumbered steps to reproduce the issue
vulnerability_typeYesVulnerability type or CWE (e.g. 'IDOR', 'SSRF')

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It indicates the tool generates a template (non-destructive, no side effects), but does not explicitly state it returns Markdown or does not modify data. Mostly transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the primary action. No filler, every word adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose and sections but does not explicitly specify the output format (Markdown string) or that remediation is optional. With no output schema, slightly more detail on the return value would help.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so each parameter has a description. The tool description adds value by grouping parameters into report sections (Summary, Steps, Impact, Remediation), providing context beyond individual definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates a structured Markdown template for vulnerability reports, listing key sections (Summary, Steps, Impact, Remediation). It distinguishes from sibling tools that handle actual report creation or submission.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for drafting a report but lacks explicit guidance on when to use vs. alternatives like create_report_intent or submit_report. No when-not or alternative references.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_balanceB

Get your current unpaid bounty balance on HackerOne.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description must fully disclose behavior. It implies a read operation but omits details like authentication needs, rate limits, or how the balance is returned (e.g., format, currency). The minimal info leaves room for misinterpretation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence with no wasted words. It is front-loaded and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters and no output schema, the description is adequate but not complete. It doesn't explain the return value, which may be needed for proper invocation (e.g., numeric value, currency).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, and schema coverage is effectively 100%. Per rules, 0 parameters yields a baseline of 4. The description adds no parameter info beyond the schema, which is acceptable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves the current unpaid bounty balance, using a specific verb and resource. It distinguishes from siblings like 'get_earnings' and 'get_payouts' by specifying 'unpaid', though it could be more explicit about the distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives. Siblings like 'get_earnings' and 'get_payouts' overlap, but the description doesn't inform the agent about selection criteria or exclude cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_earningsB

Get your bounty earnings history. Shows amounts, currency, dates, and which programs paid out.

ParametersJSON Schema
NameRequiredDescriptionDefault
page_sizeNoNumber of earnings to return (default 100)

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It implies a read-only operation and shows output fields, but does not disclose auth requirements, rate limits, or behavior with empty history. Adequate but not detailed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences front-load the purpose and output fields. No wasted words, efficient structure.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a single optional parameter and no output schema, the description covers the main intent and output adequately. Could mention default page_size (100) or that it returns current user's earnings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the only parameter (page_size). The description adds no extra meaning beyond the schema, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Get your bounty earnings history' with specific verb and resource. It mentions amounts, currency, dates, and programs, but does not explicitly differentiate from sibling tools like get_payouts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives such as get_payouts or get_balance. The description lacks context for selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_hacker_profileA

Get your HackerOne hacker profile: reputation, signal, impact, rank, and account info.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It does not specify behavioral traits such as whether the operation is read-only, idempotent, or requires specific permissions. The mention of fields is helpful but not sufficient for full transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that efficiently conveys the tool's purpose and key content. No extraneous words or redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless, simple retrieval tool, the description is mostly complete. However, it omits information about authentication requirements or that it returns the profile of the authenticated user, which would be helpful for operational context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters and schema description coverage is 100%, so the baseline is 4. The description adds no additional parameter information, which is acceptable given no parameters exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Get' and identifies the resource as 'your HackerOne hacker profile,' listing key fields (reputation, signal, impact, rank, account info). This clearly distinguishes it from sibling tools which deal with reports, intents, programs, and earnings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. Since no sibling tool retrieves the hacker profile, the usage is arguably implied, but the description lacks mention of prerequisites (e.g., authentication required) or context for when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_payoutsA

Get your payout history showing completed payout transactions, payment providers (e.g. PayPal, Wire), status, and dates.

ParametersJSON Schema
NameRequiredDescriptionDefault
page_sizeNoNumber of payouts to return (default 50)

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description should convey behavioral traits. It mentions 'completed payout transactions' implying a filter, but lacks details on authorization, rate limits, or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence that conveys the tool's purpose and output fields without extraneous words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a list tool with no output schema, the description reasonably covers returned data (transactions, providers, status, dates). However, it omits pagination behavior beyond the page_size parameter.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the only parameter (page_size). The description does not add new information beyond what the schema provides, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves payout history and lists specific data shown (transactions, providers, status, dates). This is distinct from sibling tools like get_earnings or get_balance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for viewing payout history but provides no explicit guidance on when to use this tool versus alternatives, nor any exclusion criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_program_detailsA

Get detailed info about a single program: policy, response times, metrics, bounty splitting, and submission state.

ParametersJSON Schema
NameRequiredDescriptionDefault
program_handleYesProgram handle (e.g. 'uber', 'github')

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses what data the tool returns (policy, response times, metrics, etc.) but does not mention whether the operation is read-only, if authentication is required, or error behavior (e.g., if the program handle is invalid). The description implies a safe read operation but lacks explicit behavioral details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is front-loaded with the action and resource, listing the key data points concisely. Every word adds value with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple retrieval tool with one parameter and no output schema, the description adequately lists what information is returned (policy, response times, metrics, bounty splitting, submission state). It is sufficient for an AI agent to understand what the tool provides, though it could mention any constraints like program availability.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with one parameter (program_handle). The schema description says 'Program handle (e.g. 'uber', 'github')', which adds example values. The tool description reinforces that the handle identifies a single program but does not add semantic depth beyond what the schema provides. Baseline score 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get' and the resource 'detailed info about a single program', listing specific data types like policy, response times, metrics, bounty splitting, and submission state. This clearly distinguishes it from sibling tools like list_programs (which lists all programs) and get_program_scope (which returns scope details).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for retrieving details of a specific program but provides no explicit guidance on when to use this tool versus alternatives like list_programs or get_program_scope. There are no when-not-to-use conditions or contextual comparisons.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_program_scopeA

Get the in-scope assets for a bug bounty program. Auto-paginates to return all scope items. Returns asset types, identifiers, bounty eligibility, and severity caps.

ParametersJSON Schema
NameRequiredDescriptionDefault
page_sizeNoMax scope items to return (default: all)
program_handleYesProgram handle (e.g. 'uber', 'ipc-h1c-aws-tokyo-2026')

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. Discloses auto-pagination behavior and return fields (asset types, identifiers, bounty, severity caps). This is good behavioral context for an agent considering pagination and data retrieval.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences: first states primary action, second adds key details (auto-pagination and return fields). No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, pagination behavior, and return data. Lacks details on pagination mechanism (e.g., cursor vs offset) and explicit read-only safety, but given no output schema and simple params, it is largely sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% (both parameters described in schema). Description adds 'auto-paginates' context but doesn't significantly enhance parameter understanding beyond schema defaults and examples.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it gets in-scope assets for a bug bounty program, differentiating from siblings like get_scope_exclusions (which gets excluded items) and list_programs (which lists programs). Specifies returned data: asset types, identifiers, bounty eligibility, severity caps.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives such as get_scope_exclusions or get_program_details. Does not mention prerequisites or context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_program_weaknessesA

Get the accepted vulnerability/weakness types for a program. Auto-paginates. Helps frame reports using the right CWE categories the program cares about.

ParametersJSON Schema
NameRequiredDescriptionDefault
page_sizeNoMax weaknesses to return (default: all)
program_handleYesProgram handle (e.g. 'uber', 'ipc-h1c-aws-tokyo-2026')

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses 'Auto-paginates' and implies a read-only operation. However, it does not cover error handling or edge cases, but the provided information is sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each adding value: purpose, pagination behavior, and usage context. Front-loaded and no fluff. Highly concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given two parameters and no output schema, the description covers the core functionality and usage context. It could mention the output format briefly, but it's mostly complete for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds 'Auto-paginates' and example values, but does not provide semantic meaning beyond what the schema already gives (e.g., 'default: all' is already in schema).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get' and the resource 'accepted vulnerability/weakness types for a program.' It also distinguishes from sibling tools (none are similar) and provides context with 'Auto-paginates.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use the tool: 'Helps frame reports using the right CWE categories the program cares about.' It does not explicitly state when not to use or provide alternatives, but the context is clear enough for an agent to decide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_reportA

Get the full details of a specific HackerOne report by ID. Returns title, vulnerability details, impact, severity, full CVSS vector/score, bounty amounts, attachments, timestamps, and program info.

ParametersJSON Schema
NameRequiredDescriptionDefault
report_idYesThe HackerOne report ID

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description bears full burden of behavioral disclosure. It enumerates the return fields (title, vulnerability details, impact, severity, CVSS, bounty, attachments, timestamps, program info), giving the agent a comprehensive expectation of outputs. The 'Get' verb implies a read-only, non-destructive operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description consists of two concise sentences: the first states the action and resource, the second lists return fields. It is efficient and front-loaded, with no redundant words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of an output schema, the description adequately details the return content. The tool is simple (one required param, no complex nesting), and the description covers essential behavioral aspects. Minor omissions like pagination or error handling do not significantly impair completeness for a fetch-by-ID tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% parameter coverage with a clear description for report_id ('The HackerOne report ID'). The description reinforces that the ID corresponds to a specific HackerOne report but adds no new semantic details beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses specific verb 'Get' and clearly identifies the resource as 'full details of a specific HackerOne report by ID'. It enumerates the return fields (title, vulnerability, severity, CVSS, bounty, etc.), making it distinct from sibling tools like search_reports (list) or get_report_intent (intent only).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool (when full report details are needed for a specific ID) but does not explicitly warn against alternatives or mention siblings. The context from sibling names provides some guidance, but the description itself lacks explicit when-not-to-use or alternative pointers.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_report_activitiesA

Get the activity timeline of a report: comments, state changes, bounty awards, and triage responses.

ParametersJSON Schema
NameRequiredDescriptionDefault
page_sizeNoNumber of activities to return (default 50)
report_idYesThe HackerOne report ID

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description bears the full burden. It adds behavioral context by specifying the types of activities returned (comments, state changes, etc.), which goes beyond the schema. However, it omits details like read-only nature, authentication requirements, rate limits, or pagination behavior. The description is adequate but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, well-structured sentence that conveys the core functionality and output types without extraneous words. Every element earns its place, making it easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description lists activity types but does not detail activity structure, pagination behavior, ordering, or default page_size. With no output schema, this leaves some gaps for an agent. It is minimally sufficient for a simple read operation, but richer context would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with both parameters (report_id, page_size) having descriptions. The tool description does not add further parameter-specific meaning or usage guidance. Baseline of 3 is appropriate; no extra value beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the tool retrieves an activity timeline of a report, listing specific activity types (comments, state changes, bounty awards, triage responses). This verb+resource combination is specific and distinguishes it from siblings like get_report (which retrieves the report itself) and get_report_with_conversation (likely focused on conversation).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for fetching activity timelines but does not provide explicit guidance on when to use versus alternatives (e.g., get_report_with_conversation). No exclusions or when-not-to-use advice is given. The context is clear enough for an agent to infer the primary use case, but lacks depth.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_report_intentA

Get details of a specific draft report intent by ID.

ParametersJSON Schema
NameRequiredDescriptionDefault
report_intent_idYesThe report intent ID

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It says 'Get details' but does not disclose what is returned, whether read-only, or any behavioral traits like authentication needs or rate limits. Minimal transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded, no superfluous words. Efficiently communicates purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity tool (1 param, no output schema), the description is somewhat complete but fails to specify what 'details' includes. Could mention return fields or structure.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the one parameter 'report_intent_id'. The description adds no additional meaning beyond the schema's 'The report intent ID'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get', the resource 'draft report intent', and the scope 'by ID'. It distinguishes this tool from sibling tools like 'get_report_intents' (list) and 'create_report_intent'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use or when not to use this tool versus alternatives. The description implies a specific retrieval operation but lacks exclusions or context for selection among many siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_report_intent_attachmentsB

List all attachments associated with a draft report intent.

ParametersJSON Schema
NameRequiredDescriptionDefault
report_intent_idYesThe report intent ID

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility. It fails to disclose whether this is a read-only operation, required permissions, rate limits, or details about the return format (e.g., attachments metadata vs. file URLs). The simple statement 'List all attachments' is insufficient for behavioral transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence with no extraneous words. It is front-loaded with the verb 'List' and the key resource, making it efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (one parameter, no output schema), but the description lacks details about what the tool returns (e.g., attachment IDs, file names, metadata). It correctly scopes to 'draft report intent' but could be more complete by indicating the output structure.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with one parameter (report_intent_id) described in the schema as 'The report intent ID'. The description adds no additional meaning beyond the schema, such as formatting or validation constraints. Baseline of 3 applies due to full schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'list' and resource 'attachments' with a specific scope 'draft report intent'. It distinguishes from sibling tools like delete_report_intent_attachment because it lists all attachments rather than deleting. However, it could be more precise by specifying that it returns metadata or identifiers.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives (e.g., delete_report_intent_attachment). There is no mention of prerequisites, typical workflow, or conditions that warrant listing attachments.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_report_intentsB

List all draft report intents and AI assistant processing job statuses.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must reveal behavioral traits. It implies a read-only operation ('list') but provides no details about side effects, permissions, or data freshness. The statement is adequate but lacks depth.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is front-loaded and to the point. It could be slightly expanded to include more detail without losing conciseness, but it currently has no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description should explain the return value structure. It mentions 'draft report intents' and 'AI assistant processing job statuses' but does not describe the fields or format of each item. This is a gap in completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters, so the schema coverage is 100%. The description does not need to add parameter semantics, and it correctly handles this by focusing on the output.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists draft report intents and AI assistant processing job statuses, using a specific verb ('list') and resource ('report intents', 'job statuses'). It distinguishes from the singular sibling 'get_report_intent' but could be more explicit about the scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus siblings such as 'get_report_intent', 'search_reports', or 'get_report'. The description does not mention alternatives or conditions for use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_report_with_conversationA

Get a report with its full triage conversation. Useful for understanding what questions triage asked, how you responded, and what led to resolution. Great for learning what works.

ParametersJSON Schema
NameRequiredDescriptionDefault
report_idYesThe HackerOne report ID

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It describes the read operation but does not disclose response format, pagination, or any limitations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two efficient sentences front-load the purpose with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Lacks output schema but the tool is simple with one parameter; the description adequately explains the value returned (report with conversation).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single parameter report_id, so the description adds no additional meaning beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get' and the resource 'report with its full triage conversation', distinguishing it from siblings like get_report which likely lacks conversation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explains the tool is useful for understanding triage conversation and learning, but does not explicitly mention when to avoid using it or compare with alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_scope_exclusionsA

Get report categories that are specifically excluded from rewards for a program.

ParametersJSON Schema
NameRequiredDescriptionDefault
program_handleYesProgram handle (e.g. 'uber', 'gitlab')

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden for behavioral disclosure. It only states the basic function without revealing side effects, output format, or error conditions (e.g., what happens for invalid program_handle).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence with no extraneous words. Every word adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no output schema) and lack of complex behavior, the description is minimally adequate. However, it could be improved by clarifying the difference from get_program_scope or indicating that the result is a list of categories.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the one parameter (program_handle) already has a description. The tool description adds no extra meaning beyond the schema, so a baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the action ('Get'), the resource ('report categories'), and the specific context ('excluded from rewards for a program'). It distinguishes from sibling tools like get_program_scope, which likely retrieves all scope items.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide explicit guidance on when to use this tool versus alternatives. While the purpose is clear, the agent could benefit from noting that this tool retrieves exclusions, not inclusions, but no such direction is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_programsA

List bug bounty programs you have access to on HackerOne. Auto-paginates to return all programs.

ParametersJSON Schema
NameRequiredDescriptionDefault
page_sizeNoMax programs to return (default: all)

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description notes auto-pagination behavior but lacks details on idempotency, rate limits, or data freshness. Without annotations, the description does not fully disclose behavioral traits beyond the basic listing operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short, front-loaded sentences with zero waste. Every word contributes to understanding the tool's core functionality.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description explains what the tool does but omits the return format (e.g., list of program names/IDs) and any authentication or permission prerequisites. Given no output schema, this is a moderate gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers 100% of parameters with a description for page_size. The tool description adds auto-pagination context but does not elaborate on how page_size interacts with that behavior, so it adds minimal value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'List bug bounty programs you have access to on HackerOne' using a specific verb and resource, and it distinguishes from sibling tools like get_program_details by focusing on listing all accessible programs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use for retrieving all programs via 'auto-paginates to return all programs', but does not explicitly state when to use this tool versus alternatives like get_program_details for individual program info.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_disclosed_reportsA

Search publicly disclosed HackerOne reports (hacktivity). Useful for learning what gets paid, finding prior art, and understanding what a program considers valid.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryNoKeyword to filter results (e.g. 'SSRF', 'IDOR')
programNoProgram handle to filter by (e.g. 'uber')
page_sizeNoNumber of results (default 25)

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must disclose behavior. It states read-only search on public data, but doesn't mention pagination, rate limits, or auth needs. The schema's page_size implies pagination, but description adds no behavioral context beyond scope.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: first defines action/scope, second explains utility. No fluff, front-loaded with key info.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple search tool with no output schema, description covers purpose and use cases. Missing details like result format or ordering, but adequate given complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for all parameters. The description adds no extra meaning beyond the schema, e.g., it doesn't clarify date filters or search behavior. Baseline 3 is appropriate since schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool searches publicly disclosed HackerOne reports (hacktivity), with a specific verb and resource. It differentiates from sibling tools like search_reports (likely private) by emphasizing public scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description explains utility: learning what gets paid, finding prior art, understanding program validity. This gives clear context for when to use, but lacks explicit when-not-to-use or alternatives, though distinction from siblings is implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_reportsB

Search and list your HackerOne reports. Filter by keyword, program, severity, or state. Great for finding past reports to reference when drafting new ones.

ParametersJSON Schema
NameRequiredDescriptionDefault
sortNoSort field (e.g. 'reports.created_at' or '-reports.created_at' for desc)
queryNoKeyword search (e.g. 'SSRF', 'OAuth', 'PassRole', 'S3')
stateNoFilter by report state
programNoProgram handle to filter by (e.g. 'uber', 'amazon')
severityNoFilter by severity rating
page_sizeNoResults per page (default 25)
page_numberNoPage number for pagination

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavior. It states it searches and lists reports but does not mention authentication requirements, rate limits, data scope (only user's reports?), pagination behavior, or response format. Critical details are missing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences that front-load the action and filters. No unnecessary words. It efficiently communicates the core functionality.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 7 parameters, no output schema, and no annotations, the description is too minimal. It does not explain how parameters combine, default behavior for pagination/sorting, or return value structure. More context is needed for an agent to use this tool effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with each parameter described. The description adds value by listing the main filters (keyword, program, severity, state) but does not provide any additional semantics beyond what the schema already offers. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it searches and lists HackerOne reports, with specific filters (keyword, program, severity, state). This distinguishes it from siblings like get_report (single report) and search_disclosed_reports (disclosed only), though these distinctions are not explicitly mentioned.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a use case ('finding past reports to reference when drafting new ones'), implying when to use it. However, it does not give explicit guidance on when not to use it or how it compares to alternatives like search_disclosed_reports or get_report.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

submit_reportA

Submit a new vulnerability report to a HackerOne program. Returns the new report ID and URL. Use get_program_scope and get_program_weaknesses first to get the right scope/weakness IDs.

ParametersJSON Schema
NameRequiredDescriptionDefault
titleYesReport title
impactNoImpact statement — what an attacker can achieve
weakness_idNoWeakness/CWE ID from get_program_weaknesses (the numeric id field)
program_handleYesProgram handle to submit to (e.g. 'uber')
severity_ratingNoSuggested severity rating
structured_scope_idNoScope asset ID from get_program_scope (the numeric id field)
vulnerability_informationYesFull vulnerability details in markdown — steps to reproduce, root cause, and proof of concept

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden for behavioral disclosure. It states that the tool submits (a write operation) and returns ID/URL, but does not mention permissions, rate limits, or whether submission creates a draft vs. final report. The description is adequate but could provide more context about side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description consists of two concise sentences: the first states purpose and return, the second gives prerequisite guidance. No redundant information, and the key point is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool complexity (7 parameters, no output schema) and the presence of many sibling tools, the description effectively covers purpose, return values, and prerequisite steps. It does not explain error handling or idempotency, but the information provided is sufficient for a typical submission scenario.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds value by linking weakess_id and structured_scope_id to get_program_weaknesses and get_program_scope, but otherwise does not provide additional parameter semantics beyond the schema's own descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'Submit a new vulnerability report to a HackerOne program' and specifies the return value 'Returns the new report ID and URL'. This distinguishes it from sibling tools focused on report intents, searches, or other operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly instructs to 'Use get_program_scope and get_program_weaknesses first to get the right scope/weakness IDs', providing clear preconditions and referencing specific sibling tools. This guides the agent on when to use this tool and what prerequisite steps are needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

submit_report_intentB

Finalize and submit a draft report intent as an official vulnerability report.

ParametersJSON Schema
NameRequiredDescriptionDefault
report_intent_idYesThe report intent ID to submit

TDQS

B3.1/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility for behavioral disclosure. It only states 'Finalize and submit' without explaining consequences (e.g., irreversibility, side effects, permission requirements). This is insufficient for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence with no unnecessary words. It front-loads the key action and resource.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one required parameter, no output schema), the description is minimally adequate. However, it lacks context about the lifecycle of a report intent (e.g., must be in 'draft' status) and what happens after submission (e.g., no return value described).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already describes the single parameter ('report_intent_id') with a basic explanation, achieving 100% coverage. The description adds no additional semantic context beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Finalize and submit') and the resource ('draft report intent' to 'official vulnerability report'). It distinguishes this tool from siblings like 'submit_report' by specifying the input is a report intent, not a full report.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage (when you have a draft report intent) but does not explicitly state when to use this tool versus alternatives such as 'submit_report' or 'create_report_intent'. No guidance on prerequisites or conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_report_intentB

Update title or description of a draft report intent.

ParametersJSON Schema
NameRequiredDescriptionDefault
titleNoUpdated draft title
descriptionNoUpdated draft description
report_intent_idYesThe report intent ID

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It states the action (update) but does not mention behavioral traits such as whether the intent must be a draft, if updates are restricted to certain fields, or what happens after update (e.g., auto-save or confirmation).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence with no wasted words. It is appropriately sized for a simple update tool, though a bit more context could be added without harming conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (3 string parameters, no output schema, no annotations), the description covers the core action but misses usage context and behavioral details. It is adequate but not comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The tool description merely echoes the parameter names and does not add additional meaning beyond the schema's own descriptions ('Updated draft title', etc.).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description specifies the verb 'Update' and the resource 'draft report intent', and lists the updatable fields (title or description). This clearly distinguishes it from sibling tools like create_report_intent, delete_report_intent, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide when or when not to use the tool, nor does it mention alternatives or prerequisites. For instance, it fails to note that the intent must be in draft status or that for final reports another tool should be used.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 28 tool updatesv1.0.0
    • First observedadd_comment
    • First observedanalyze_report_patterns
    • First observedclose_report
    • First observedcreate_report_intent
    • First observeddelete_report_intent
    • First observeddelete_report_intent_attachment
    • First observedfind_best_programs
    • First observedgenerate_report_template
    • First observedget_balance
    • First observedget_earnings
    • First observedget_hacker_profile
    • First observedget_payouts
    • First observedget_program_details
    • First observedget_program_scope
    • First observedget_program_weaknesses
    • First observedget_report
    • First observedget_report_activities
    • First observedget_report_intent
    • First observedget_report_intent_attachments
    • First observedget_report_intents
    • First observedget_report_with_conversation
    • First observedget_scope_exclusions
    • First observedlist_programs
    • First observedsearch_disclosed_reports
    • First observedsearch_reports
    • First observedsubmit_report
    • First observedsubmit_report_intent
    • First observedupdate_report_intent

TDQS

A3.8/5.0
Disambiguation5/5

Each tool targets a distinct aspect of the HackerOne platform: draft intents, final reports, programs, profile/earnings, and analysis. Even within reports, tools differentiate by detail level (basic, conversation, activities, search) without overlap.

Naming Consistency5/5

All tools follow a consistent verb_noun pattern in snake_case (e.g., get_report_intent, create_report_intent, submit_report). The naming is predictable and descriptive, with no mixing of styles.

Tool Count4/5

28 tools cover the full hacker workflow: draft lifecycle, report management, program research, and earnings. While slightly above average, each tool serves a unique purpose and the set is well-scoped.

Completeness5/5

The tool surface is remarkably complete for a hacker's needs: CRUD for report intents, full report interaction (submit, close, comment, search, activities), program exploration (scope, weaknesses, exclusions), and financial tracking (earnings, payouts, balance). Only minor optional features missing (e.g., editing submitted reports).

Maintenance

ActivitySlowing
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • F
    license
    A
    quality
    D
    maintenance
    Provides read-only access to HackerOne reports, program scopes, and bounty earnings through the HackerOne API. It enables users to analyze hunting patterns, check asset eligibility, and retrieve report details or triage conversations via natural language.
    9
    41
    -
  • A
    license
    Not graded
    quality
    C
    maintenance
    Connects AI assistants to HackerOne to pull bug bounty history, program scopes, and report details into a local SQLite database, exposing tools for searching, analyzing, and generating attack briefings using both personal and public disclosed reports.
    351
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Connects AI assistants to HackerOne bug bounty history, program scopes, and public disclosed reports for searching, analyzing, and generating attack briefings.
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Connects AI assistants to Intigriti by syncing programs, scopes, and rules of engagement, then provides tools to search and generate actionable attack briefings.
    2
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/esektov12121-eng/HackerOne-MCP'

If you have feedback or need assistance with the MCP directory API, please join our Discord server