Retrieve explicit out-of-scope items for any HackerOne program by providing its handle, clarifying what assets are excluded from bug bounty testing.
What a program explicitly excludes from scope.
| Name | Required | Description | Default |
|---|---|---|---|
| program_handle | Yes | Program handle (e.g. 'uber') |
Changes observed during successful MCP inspections.
v1.0.0Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It does not explicitly state that this is a read-only list operation, what the response shape is, or whether empty results are possible. The nominal phrase 'what a program explicitly excludes' provides content semantics but not behavioral transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no filler or redundancy. It is front-loaded and easy to parse, though it is slightly under-specified as a noun phrase rather than a full imperative statement.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter list tool with full schema coverage, the description minimally conveys what the tool returns. However, it does not explicitly describe the return type, whether it returns a structured list, or how it relates to the program scope tools, leaving moderate gaps for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter program_handle is fully documented in the schema with a clear type and example ('uber'), and schema description coverage is 100%. The description adds no parameter-specific meaning, so it does not need to compensate; the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource as a program's explicit scope exclusions, and the word 'excludes' distinguishes it from scope-related siblings like hackerone_get_program_scope. It lacks an explicit verb such as 'list' or 'retrieve,' but the tool name and context make the action clear enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool versus alternatives such as hackerone_get_program_scope or hackerone_search_scopes. The description only implies a use case for retrieving exclusions, but provides no prerequisites, exclusions, or comparison to sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.