Hacker Bob public records

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Read-only public CVE records, capability metadata, and agent instructions from Hacker Bob.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "Hacker Bob public records": {
      "url": "https://hackerbob.ai/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (22)

• list_public_cve_records read-only

  List cleared public Hacker Bob Common Vulnerabilities and Exposures records with cursor pagination and optional project or publication-status filters.

  Parameters:

  • limit — integer — Maximum records to return. Defaults to 20.
  • cursor — string — Opaque cursor returned by a previous list call.
  • status — string — Publication status to include.
  • project — string — Exact open-source project name to include.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• get_public_cve_record read-only

  Return one cleared Hacker Bob CVE record by identifier, including its open-source project, publication status, and upstream public record URL when available.

  Parameters:

  • recordId (required) — string — CVE identifier such as CVE-2026-47747.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• search_public_cve_records read-only

  Search cleared public Hacker Bob CVE records by CVE identifier, open-source project name, or publication status without contacting any assessment target.

  Parameters:

  • query (required) — string — Text to match against CVE identifiers, project names, and publication status.
  • limit — integer — Maximum matching records to return. Defaults to 20.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• get_capabilities read-only

  Return current public boundaries and, when authenticated, workspace-specific tool reachability, scopes, and role requirements.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• get_my_account read-only

  Return the authenticated account and the workspace bound to this agent connection.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• list_workspaces read-only

  List active Hacker Bob workspaces available to the authenticated account. The connection remains bound to its approved workspace.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• get_workspace read-only

  Return the approved workspace and current membership role.

  Parameters:

  • workspaceSlug (required) — string — Workspace slug selected during agent authorization.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• list_assets read-only

  List workspace assets and current ownership-authorization state without contacting a target.

  Parameters:

  • workspaceSlug (required) — string — Workspace slug selected during agent authorization.
  • includeArchived — boolean — Include archived assets. Defaults to false.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• get_asset read-only

  Return one workspace asset and its current authorization state.

  Parameters:

  • workspaceSlug (required) — string — Workspace slug selected during agent authorization.
  • assetId (required) — string

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• begin_domain_authorization

  Create a DNS TXT or HTTPS-file challenge proving control of a domain. This does not run an assessment.

  Parameters:

  • workspaceSlug (required) — string — Workspace slug selected during agent authorization.
  • domain (required) — string — Domain name only; no scheme, path, port, credentials, or wildcard.
  • method (required) — string
  • idempotencyKey (required) — string
  • label — string

  Hints: read-only no · destructive no · idempotent yes · open-world no

• check_domain_authorization

  Check the previously issued DNS or HTTPS proof and update the asset authorization state.

  Parameters:

  • workspaceSlug (required) — string — Workspace slug selected during agent authorization.
  • authorizationId (required) — string
  • idempotencyKey (required) — string

  Hints: read-only no · destructive no · idempotent yes · open-world yes

• list_assessments read-only

  List assessments and current run states in the approved workspace.

  Parameters:

  • workspaceSlug (required) — string — Workspace slug selected during agent authorization.
  • includeArchived — boolean

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• get_assessment read-only

  Return one assessment, its verified asset, current run state, and any pending human approval.

  Parameters:

  • workspaceSlug (required) — string — Workspace slug selected during agent authorization.
  • assessmentId (required) — string

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• prepare_assessment

  Create an immutable assessment for a verified stored asset and return a browser approval URL. This never contacts the target.

  Parameters:

  • workspaceSlug (required) — string — Workspace slug selected during agent authorization.
  • assetId (required) — string
  • depth (required) — string
  • coverage (required) — object
  • interactionPolicy (required) — string
  • idempotencyKey (required) — string
  • boundaries — string

  Hints: read-only no · destructive no · idempotent yes · open-world no

• launch_assessment destructive

  Consume a recent human approval and submit the immutable assessment to Hacker Bob's managed queue. The target is resolved only from the stored verified asset.

  Parameters:

  • workspaceSlug (required) — string — Workspace slug selected during agent authorization.
  • assessmentId (required) — string
  • idempotencyKey (required) — string

  Hints: read-only no · destructive yes · idempotent yes · open-world yes

• cancel_assessment destructive

  Cancel an eligible queued or running assessment and reconcile any refundable reserved credit.

  Parameters:

  • workspaceSlug (required) — string — Workspace slug selected during agent authorization.
  • assessmentId (required) — string
  • idempotencyKey (required) — string

  Hints: read-only no · destructive yes · idempotent yes · open-world no

• list_findings read-only

  List workspace findings with optional lifecycle and severity filters.

  Parameters:

  • workspaceSlug (required) — string — Workspace slug selected during agent authorization.
  • status — string
  • assetId — string
  • severity — string

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• get_finding read-only

  Return one finding with evidence-safe lifecycle history and related asset metadata.

  Parameters:

  • workspaceSlug (required) — string — Workspace slug selected during agent authorization.
  • findingId (required) — string

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• list_reports read-only

  List non-revoked reports released to the approved workspace.

  Parameters:

  • workspaceSlug (required) — string — Workspace slug selected during agent authorization.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• get_report read-only

  Return one released, non-revoked workspace report. Pending review material and access credentials are never returned.

  Parameters:

  • workspaceSlug (required) — string — Workspace slug selected during agent authorization.
  • reportId (required) — string

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• get_credit_summary read-only

  Return available, reserved, and used assessment credits for the approved workspace.

  Parameters:

  • workspaceSlug (required) — string — Workspace slug selected during agent authorization.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• list_audit_events read-only

  List recent workspace audit events with optional actor, action, and time filters.

  Parameters:

  • workspaceSlug (required) — string — Workspace slug selected during agent authorization.
  • toAt — number
  • actor — string
  • action — string
  • fromAt — number

  Hints: read-only yes · destructive no · idempotent yes · open-world no

Publisher website Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.