Targets MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| H1_USERNAME | Yes | The HackerOne API identifier (username). | |
| H1_API_TOKEN | Yes | The HackerOne API token. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| hackerone_search_reportsC | Search and list your HackerOne reports. Filter by keyword, program, severity, or state. |
| hackerone_get_reportB | Full details of one of your reports: title, vuln info, impact, severity, CVSS, bounty, attachments, program. |
| hackerone_get_report_with_conversationA | A report with its full triage conversation. Shows what triage asked and what led to resolution. |
| hackerone_get_report_activitiesA | Activity timeline of a report: comments, state changes, bounty awards, triage responses. |
| hackerone_analyze_report_patternsA | Analyze your recent reports: severity/state distribution, top programs and weakness types. |
| hackerone_list_programsB | List bug bounty programs you can access. Auto-paginates. |
| hackerone_search_programsB | Search programs by handle/name, optionally bounty-only. Live, no cache. |
| hackerone_get_program_detailsA | Full program data in categories: identity, timeline (open date), bounty, metrics (response times), trust, my_stats, policy, scope_summary. Pass sections for only what you need. |
| hackerone_get_program_scopeA | In-scope assets of a program. Auto-paginates. Shows types, bounty eligibility, severity caps. |
| hackerone_search_scopesA | Search in-scope assets by program and/or asset substring, optionally bounty-only. Asset without program matches program names first (empty = no match, pass program_handle). |
| hackerone_list_scope_exclusionsC | What a program explicitly excludes from scope. |
| hackerone_get_program_weaknessesB | Accepted weakness/CWE types of a program. Auto-paginates. |
| hackerone_list_hacker_invitationsB | Private-invite programs for an account (program-owner API; 403 on plain hacker token). |
| hackerone_get_earningsC | Your bounty earnings history: amounts, currency, dates, programs. |
| hackerone_list_payoutsC | Your payout transactions (provider, status, amounts). |
| hackerone_get_balanceB | Your current unpaid bounty balance. |
| hackerone_get_hacker_profileB | Your profile: username, reputation/signal/impact plus stats computed from your own reports. |
| hackerone_search_disclosed_reportsA | Search public hacktivity. Program filter is exact match. Keyword matches title/weakness/program/reporter, but most items are undisclosed (no titles) so keyword is often empty — browse or filter by program instead. |
| hackerone_hack_briefA | Attack briefing for a program, all live: bounty scope, your past findings, untouched assets, suggested vectors, public disclosures sample. |
| hackerone_download_attachmentA | Download a report attachment to tools/hackerone/downloads/ (25MB cap). Returns the file path. |
| hackerone_program_balanceC | Program bounty wallet (program-owner API). |
| hackerone_program_bounty_tableC | Program bounty table (program-owner API). |
| hackerone_program_audit_logC | Program audit log (program-owner API). |
| hackerone_list_program_membersC | Program team members (program-owner API). |
| hackerone_api_getA | Raw GET to any HackerOne API path (e.g. /hackers/programs). Read-only by design; use only when no purpose-built tool exists. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 25 tools
Each tool maps to a specific HackerOne resource/action (report details vs conversation vs activity vs earnings), so misselection risk is low. The only mild ambiguity is the catch-all hackerone_api_get, which overlaps with any existing endpoint, though the description explicitly reserves it for gaps.
All tools use the hackerone_ prefix and snake_case, with a dominant verb_noun pattern (get_, list_, search_, download_). A few program-owner tools (program_balance, program_bounty_table, program_audit_log) and hack_brief break the verb-first pattern, but the convention is still highly predictable.
At 25 tools this is at the heavy end of the 16-25 range. Each tool appears purposeful, but the surface is large and could overwhelm an agent selecting from it.
The read/analysis side is thorough: reports, programs, scope, earnings, payouts, and admin tools are covered. However, write actions are missing — there is no way to create/update reports, reply in conversations, or otherwise mutate state, and hackerone_api_get is read-only, leaving some workflows dead-ended.