# BugRater for developers and agents

> BugRater rates bug bounty and vulnerability disclosure programs from researcher reviews, and tracks what the platforms publish: payouts by severity, response targets, 90-day intake, structured scope, launches and accepted findings. Everything below is generated from the live configuration on October 22, 2026.

Agents: the MCP server at https://bugrater.com/mcp is the easiest way in, and needs no account. Before testing any asset, call `check_scope`; BugRater's copy of scope is dated, and the program's policy page is the authority.

## Authentication

- **Open:** No credentials.
- **Token:** Authorization: Bearer <token>. A personal agent token (bra_live_…) from /settings/agents, or an API key.
- **Attack Surface:** X-API-Key with an Attack Surface key, or pay per call with x402 (no account) when x402 is on.
- **MCP:** Optional Authorization: Bearer agent token; OAuth on /mcp/account.

## MCP server

The easiest way in for an agent. Streamable HTTP, protocol versions 2025-03-26 through 2026-07-28, no account needed for public data. Setup for each client: https://bugrater.com/agents. The tools are listed in full in https://bugrater.com/llms-full.txt.

### `POST /mcp`

MCP endpoint. Public tools without a token; member tools with one.

JSON-RPC 2.0. Anonymous callers get 40 tool calls a minute per address, token holders 120.

```sh
claude mcp add --transport http bugrater https://bugrater.com/mcp
```

### `POST /mcp/account`

The same server for a signed-in member. Without a token it answers 401 with OAuth metadata, so clients offer sign-in.

```sh
claude mcp add --transport http bugrater https://bugrater.com/mcp/account
```

## Open lookups

Small public checks that need no credentials at all.

### `GET /api/v1/cve/{cve}`

Is this CVE in the named program's own published advisories?

- `cve` (path, string, required): e.g. CVE-2026-12345
- `program` (query, string, required): Program slug to check the CVE against.

Returns:

- `verdict`: matched, mismatch (credited to another vendor), unknown, or malformed
- `vendors`: Vendors BugRater has it credited to
- `release`: The advisory, when matched

```sh
curl 'https://bugrater.com/api/v1/cve/CVE-2026-12345?program=gitlab'
```

### `GET /api/v1/researcher-credits`

Every published vendor-advisory credit for a researcher name.

- `name` (query, string, required): The name as advisories credit it.

Returns:

- `total`: credits, cves, vendors, first and latest date
- `byVendor`: Per-vendor counts
- `cves`: Up to 30 most recent CVEs
- `profile`: The BugRater member, when the name is a verified claim

```sh
curl 'https://bugrater.com/api/v1/researcher-credits?name=Jane%20Doe'
```

### `GET /api/v1/verify/{token}`

Verify a BugBadge attestation attached to a report.

- `token` (path, string, required): The 40-character attestation token.

Returns:

- `status`: valid, expired, revoked or badge_revoked
- `researcher`: username, profile and badge links
- `snapshot`: The track record at minting time
- `minted_for`: The program it was minted for; check it is yours
- `distinct_verifiers`: How widely the token has travelled

```sh
curl https://bugrater.com/api/v1/verify/0123456789abcdef0123456789abcdef01234567
```

### `GET /api/v1/keys/{username}`

A member's published end-to-end public key (P-256 JWK) and fingerprint, to encrypt collab content to them.

- `username` (path, string, required): BugRater username.

## Directory API

Programs, grades and reviews as JSON. Self-serve: create an agent token at https://bugrater.com/settings/agents and send it as a bearer token. 60 requests a minute.

### `GET /api/v1/programs`

Every program, best graded first.

- `limit` (query, integer): Rows to return, 1 to 100. Default 50.
- `offset` (query, integer): Rows to skip. Default 0.

Returns:

- `data[]`: slug, name, company, platform, type, bounty_low, bounty_high, grade, score, reviews, url
- `total, has_more`: For paging

```sh
curl -H 'Authorization: Bearer $BUGRATER_TOKEN' 'https://bugrater.com/api/v1/programs?limit=20'
```

### `GET /api/v1/programs/{slug}`

One program with its review metrics, reported practices and up to 100 reviews.

- `slug` (path, string, required): Program slug, as in /programs/{slug}.

Returns:

- `data.metrics`: would_submit_again_pct, would_recommend_pct, avg_skill, median_first_response, sentiment
- `data.reported_practices`: Practice flag counts
- `data.reviews[]`: Review text, ratings, outcomes; anonymous authors are null

### `GET /api/v1/rankings`

Graded programs ranked on one board.

- `board` (query, string): graded (default), triage, payers or cves.
- `limit` (query, integer): Rows to return, 1 to 100. Default 50.
- `offset` (query, integer): Rows to skip. Default 0.

### `GET /api/v1/stats`

Site-wide totals and the grade distribution.

### `GET /api/v1/reviews/{id}`

One approved review.

- `id` (path, integer, required): Review id.

## Attack Surface API

Enumerated subdomains, HTTP probes and exposure signals per program, priced per call. Pay with an Attack Surface subscription key (https://bugrater.com/attack-surface). Paying per call with x402 is switched off for now, so every call needs a key. Full field lists: https://bugrater.com/attack-surface/api-docs.

### `GET /api/v1/surface/programs`

The board: every rated program with its rating, surge and crowd read. Price: $0.50 per call.

- `sort` (query, string): score (default), surge, velocity or hunters.
- `page` (query, integer): Default 1.
- `limit` (query, integer): Default 50.

### `GET /api/v1/surface/movers`

What is heating up, and what is under-hunted while still active. Price: $0.50 per call.

### `GET /api/v1/surface/signals`

The freshest high-value signals across every program. Price: $0.50 per call.

- `type` (query, string): A signal type, e.g. staging_env, exposed_config, login_page or admin_panel. An unknown type is a free 400 that lists the valid ones.
- `severity` (query, string): info, low, medium or high.
- `page` (query, integer): Default 1.
- `limit` (query, integer): Default 50.

### `GET /api/v1/surface/programs/{id}`

One program: rating and drivers, market read, enumeration depth. Price: $0.75 per call.

- `id` (path, integer, required): Attack Surface program id, from /api/v1/surface/programs.

### `GET /api/v1/surface/programs/{id}/subdomains`

Enumerated subdomains with DNS, liveness and attached signals. Price: $1.00 per call.

- `id` (path, integer, required): Attack Surface program id, from /api/v1/surface/programs.

```sh
curl -i https://bugrater.com/api/v1/surface/programs/42/subdomains -H 'X-API-Key: bsk_live_…'
```

### `GET /api/v1/surface/programs/{id}/probes`

HTTP probes: status, title, server, tech fingerprint, TLS issuer. Price: $0.50 per call.

- `id` (path, integer, required): Attack Surface program id, from /api/v1/surface/programs.

### `GET /api/v1/surface/programs/{id}/signals`

Exposure signals on one program, highest severity first. Price: $0.75 per call.

- `id` (path, integer, required): Attack Surface program id, from /api/v1/surface/programs.

### `GET /api/v1/surface/programs/{id}/velocity`

Daily intake series. Price: $0.50 per call.

- `id` (path, integer, required): Attack Surface program id, from /api/v1/surface/programs.
- `days` (query, integer): Window, default 90.

### `GET /api/v1/surface/programs/{id}/full`

Everything for one program in a single call. Price: $2.00 per call.

- `id` (path, integer, required): Attack Surface program id, from /api/v1/surface/programs.

## Sign-in for MCP clients

OAuth 2.1 as the MCP authorization spec profiles it: dynamic client registration, public clients, PKCE S256. Clients discover all of it from the 401 on /mcp/account.

### `GET /.well-known/oauth-protected-resource`

Protected resource metadata (RFC 9728). Also at /mcp and /mcp/account suffixes.

### `GET /.well-known/oauth-authorization-server`

Authorization server metadata (RFC 8414).

### `POST /agents/oauth/register`

Dynamic client registration (RFC 7591). Public clients only.

### `GET /agents/oauth/authorize`

Authorization endpoint. The member signs in and consents.

### `POST /agents/oauth/token`

Code exchange with code_verifier. Returns a 90-day bearer token.

## Paying with x402

x402 pay-per-call is not switched on for this deployment yet; Attack Surface calls need a subscription key.

1. Call a paid endpoint with no key. It answers 402 Payment Required with a PAYMENT-REQUIRED header (x402 v2, base64 JSON) and the v1 offer in the body.
2. Sign an EIP-3009 USDC authorisation for exactly the amount in accepts[0], to its payTo.
3. Repeat the request with PAYMENT-SIGNATURE (v2) or X-PAYMENT (v1). BugRater verifies it, settles it on chain through the facilitator, and answers 200 with PAYMENT-RESPONSE carrying the transaction.
4. Each authorisation buys one response. A replay is refused, and nothing is delivered unless settlement succeeds.
5. Over MCP, the attack_surface tool does the same: its first answer is the PaymentRequired object, and the retry carries the payment in _meta["x402/payment"]. The settlement comes back in result._meta["x402/payment-response"].

## Limits and errors

- Every error is JSON with `ok: false` and an `error` sentence that says what to change.
- 400 bad filter, 404 not found and an empty answer are never charged. 401 missing or invalid credentials; 402 payment required; 429 rate limited, with Retry-After.
- MCP tool failures come back as tool results with `isError: true`, written for the model to act on.

## Where the data comes from

Reviews and grades are BugRater's, from researchers, graded only once three distinct researchers have reviewed a program. Scope, payouts, intake and response targets are the platforms' own published figures, copied on the date each answer gives. Accepted findings come from the platforms' public feeds, which are samples. CVE credits come from published vendor advisories.

## More

- Connect an agent: https://bugrater.com/agents
- OpenAPI: https://bugrater.com/openapi.json
- Short index: https://bugrater.com/llms.txt
- Terms: https://bugrater.com/terms
- Privacy: https://bugrater.com/privacy

## MCP tools

Member tools need an agent token or OAuth sign-in, except that attack_surface can also be paid per call with x402.

### find_programs

Search BugRater's directory of bug bounty and vulnerability disclosure programs across HackerOne, Bugcrowd, Intigriti, YesWeHack, Immunefi, Code4rena, Sherlock, Cantina and independent programs. Filter by name, platform, type, bounties, submissions, category (web3, web, mobile, ai, open-source, cve, ...), scope asset type (SOURCE_CODE, URL, WILDCARD, SMART_CONTRACT, ...), minimum bounty, launch recency, KYC requirements, company sector, and whether a composite attack-surface score exists. Sort by grade, reviews, name, newest, or composite score. Each result includes the researcher grade, categories, scope-type distribution and advertised max bounty. Use get_program on a slug for the full picture.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "query": {
            "type": "string",
            "description": "Program name, company, or platform handle. Substring match."
        },
        "platform": {
            "type": "string",
            "enum": [
                "hackerone",
                "bugcrowd",
                "intigriti",
                "yeswehack",
                "immunefi",
                "code4rena",
                "sherlock",
                "cantina",
                "independent",
                "other"
            ]
        },
        "type": {
            "type": "string",
            "enum": [
                "bug_bounty",
                "vdp"
            ],
            "description": "bug_bounty pays; vdp is disclosure only."
        },
        "pays_bounties": {
            "type": "boolean",
            "description": "Only programs the platform marks as paying."
        },
        "open_only": {
            "type": "boolean",
            "description": "Only programs taking submissions now."
        },
        "category": {
            "type": "string",
            "enum": [
                "web3",
                "web",
                "mobile",
                "firmware",
                "desktop",
                "open-source",
                "cloud",
                "ai",
                "cve",
                "easy-cve"
            ],
            "description": "Program category."
        },
        "scope_type": {
            "type": "string",
            "description": "Asset type in scope: SOURCE_CODE, URL, WILDCARD, SMART_CONTRACT, CIDR, etc."
        },
        "min_bounty": {
            "type": "integer",
            "minimum": 1,
            "description": "Minimum advertised top reward in USD."
        },
        "launched_days": {
            "type": "integer",
            "minimum": 1,
            "maximum": 365,
            "description": "Launched within this many days."
        },
        "kyc": {
            "type": "boolean",
            "description": "If false, exclude programs requiring ID verification."
        },
        "sector": {
            "type": "string",
            "description": "Company sector substring, e.g. \"finance\", \"healthcare\"."
        },
        "has_surface_score": {
            "type": "boolean",
            "description": "Only programs with a composite attack-surface score."
        },
        "sort": {
            "type": "string",
            "enum": [
                "best_rated",
                "most_reviewed",
                "newest",
                "name",
                "score"
            ],
            "default": "best_rated",
            "description": "score sorts by composite attack-surface score (programs without one sort last)."
        },
        "limit": {
            "type": "integer",
            "minimum": 1,
            "maximum": 25,
            "default": 10
        },
        "page": {
            "type": "integer",
            "minimum": 1,
            "default": 1
        }
    },
    "additionalProperties": false
}
```

### get_program

Everything BugRater knows about one program: identity and links; the researcher grade with its factors, reported practices and how submitted reports were closed; the platform's own published metrics (average bounty by severity with sample sizes, 90-day intake, response targets, response efficiency, barriers like ID verification, 30-day change); a scope summary; and the latest public accepted findings. Call get_scope or check_scope for asset-level scope.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "program": {
            "type": "string",
            "description": "Program slug as BugRater shows it (e.g. \"gitlab\"), a BugRater program URL, or the platform handle. A name works too; an ambiguous one returns the closest slugs to pick from."
        }
    },
    "required": [
        "program"
    ],
    "additionalProperties": false
}
```

### get_scope

The program's structured scope as the platform publishes it: one entry per asset with its type, whether it is in scope, whether it is bounty-eligible, the maximum severity and any instruction. Assets the platform stopped listing are hidden unless include_dropped is set. For a yes/no on specific targets use check_scope.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "program": {
            "type": "string",
            "description": "Program slug as BugRater shows it (e.g. \"gitlab\"), a BugRater program URL, or the platform handle. A name works too; an ambiguous one returns the closest slugs to pick from."
        },
        "asset_type": {
            "type": "string",
            "description": "Only this platform asset type, e.g. URL, WILDCARD, CIDR, SOURCE_CODE, GOOGLE_PLAY_APP_ID, APPLE_STORE_APP_ID, SMART_CONTRACT."
        },
        "include_out_of_scope": {
            "type": "boolean",
            "default": true
        },
        "include_dropped": {
            "type": "boolean",
            "default": false
        },
        "limit": {
            "type": "integer",
            "minimum": 1,
            "maximum": 300,
            "default": 100
        }
    },
    "required": [
        "program"
    ],
    "additionalProperties": false
}
```

### check_scope

Before testing anything, ask whether each target is covered by the program's scope. Takes hosts, URLs, IPs, app ids or repository URLs and returns one verdict per target: in_scope, out_of_scope, partial (only a path on that host is listed), unclear (the apex of a *.wildcard, or a wildcard that could reach another domain), dropped (listed once, gone now), not_listed, unparseable (a URL whose host parsers disagree on, such as one with userinfo or a backslash), or no_scope_data. Paths are normalised before comparing. An out-of-scope entry that is at least as specific as an in-scope one wins, so "*.example.com in, admin.example.com out" is answered correctly. Only in_scope means go.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "program": {
            "type": "string",
            "description": "Program slug as BugRater shows it (e.g. \"gitlab\"), a BugRater program URL, or the platform handle. A name works too; an ambiguous one returns the closest slugs to pick from."
        },
        "targets": {
            "type": "array",
            "items": {
                "type": "string"
            },
            "minItems": 1,
            "maxItems": 50,
            "description": "Up to 50 targets, e.g. [\"api.example.com\", \"https://example.com/admin\", \"10.0.0.5\", \"com.example.app\"]."
        }
    },
    "required": [
        "program",
        "targets"
    ],
    "additionalProperties": false
}
```

### get_reviews

What researchers who worked the program said: ratings (overall, triage, communication, payout), whether they would submit again, first-response time, reports submitted and resolved, practices they reported, and the review text. Anonymous reviewers stay anonymous.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "program": {
            "type": "string",
            "description": "Program slug as BugRater shows it (e.g. \"gitlab\"), a BugRater program URL, or the platform handle. A name works too; an ambiguous one returns the closest slugs to pick from."
        },
        "limit": {
            "type": "integer",
            "minimum": 1,
            "maximum": 20,
            "default": 5
        },
        "page": {
            "type": "integer",
            "minimum": 1,
            "default": 1
        }
    },
    "required": [
        "program"
    ],
    "additionalProperties": false
}
```

### program_activity

Recent public accepted or disclosed findings on one program, as the platforms' own feeds publish them: severity, target, award, researcher and date. No report content. Useful to see what pays here and to avoid well-trodden ground.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "program": {
            "type": "string",
            "description": "Program slug as BugRater shows it (e.g. \"gitlab\"), a BugRater program URL, or the platform handle. A name works too; an ambiguous one returns the closest slugs to pick from."
        },
        "limit": {
            "type": "integer",
            "minimum": 1,
            "maximum": 50,
            "default": 15
        }
    },
    "required": [
        "program"
    ],
    "additionalProperties": false
}
```

### hunting_brief

What changed across the platforms in the last 7, 14 or 30 days: newly launched or newly paying programs, the most active programs, movers up and down, programs going quiet, and the biggest awards. Refreshed every 15 minutes.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "days": {
            "type": "integer",
            "enum": [
                7,
                14,
                30
            ],
            "default": 7
        },
        "limit": {
            "type": "integer",
            "minimum": 1,
            "maximum": 10,
            "default": 5,
            "description": "Rows per list."
        }
    },
    "additionalProperties": false
}
```

### crowding

How many hunters are already on a program, measured as 90-day reports per in-scope asset from the platform's own figures. Views: uncrowded (most room per asset), crowded, surging (intake rising fast now), launches (just opened), recognition (share of hunters who get thanked). HackerOne programs only.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "view": {
            "type": "string",
            "enum": [
                "uncrowded",
                "crowded",
                "surging",
                "launches",
                "recognition"
            ],
            "default": "uncrowded"
        },
        "limit": {
            "type": "integer",
            "minimum": 1,
            "maximum": 25,
            "default": 10
        }
    },
    "additionalProperties": false
}
```

### get_researcher

Look up a security researcher by BugRater username, HackerOne handle, or the name a vendor advisory credits. Returns whichever exist: the BugRater member profile with BugScore and verified platform accounts, the public HackerOne snapshot (reputation, signal, impact, percentiles), and CVE credits from published vendor advisories.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "name": {
            "type": "string",
            "description": "Username, HackerOne handle, or credited name. A leading @ is ignored."
        }
    },
    "required": [
        "name"
    ],
    "additionalProperties": false
}
```

### lookup_cve

Who published vendor advisories credit for a CVE, in which release, for which component. With a program, also says whether the CVE belongs to that program's vendor, which catches a CVE claimed against the wrong company. BugRater indexes a limited set of vendors, so "not in index" is not evidence of anything.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "cve": {
            "type": "string",
            "description": "e.g. CVE-2026-12345"
        },
        "program": {
            "type": "string",
            "description": "Program slug as BugRater shows it (e.g. \"gitlab\"), a BugRater program URL, or the platform handle. A name works too; an ambiguous one returns the closest slugs to pick from."
        }
    },
    "required": [
        "cve"
    ],
    "additionalProperties": false
}
```

### verify_badge

Check a BugBadge attestation a researcher attached to a report: whether it is valid, expired or revoked, who it belongs to, the track-record snapshot it carries, which program it was minted for, and how widely the token has travelled. Each check is counted as a verification, as the web page counts it.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "token": {
            "type": "string",
            "description": "The 40-character token, or the whole /v/... link."
        }
    },
    "required": [
        "token"
    ],
    "additionalProperties": false
}
```

### whoami

The member this agent token acts for, its limits, Attack Surface subscription and balance, and how many projects and cards they have.

Input schema:

```json
{
    "type": "object",
    "additionalProperties": false
}
```

### read_project_log

Without a project: the member's collab projects (ref, title, target, role, entry count). With one: that project's append-only research log, oldest first, paged with since_id. Entries on an end-to-end encrypted project come back as ciphertext; BugRater cannot read them.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "project": {
            "type": "string",
            "description": "Project ref, e.g. CR-AB12-CD34."
        },
        "since_id": {
            "type": "integer",
            "minimum": 0,
            "description": "Only entries after this id."
        },
        "limit": {
            "type": "integer",
            "minimum": 1,
            "maximum": 100,
            "default": 50
        }
    },
    "additionalProperties": false
}
```

### log_research

Append one entry to a collab project's research log, attributed to this member. The log is evidence of who did what, used when collaborators split credit, and it cannot be edited or deleted: a correction is a new entry with supersedes_id. Write what was done and found in one honest line, never the exploit itself; to commit to a file such as a PoC without uploading it, pass its SHA-256 as content_hash. Read the log first and do not repeat work already in it. Encrypted projects accept only enc_summary/enc_detail/enc_key_id produced with the project key from the agent brief.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "project": {
            "type": "string",
            "description": "Project ref, e.g. CR-AB12-CD34."
        },
        "kind": {
            "type": "string",
            "enum": [
                "recon",
                "finding",
                "escalation",
                "poc",
                "writeup",
                "submission",
                "milestone",
                "note"
            ]
        },
        "summary": {
            "type": "string",
            "maxLength": 300,
            "description": "One line."
        },
        "detail": {
            "type": "string",
            "maxLength": 500
        },
        "content_hash": {
            "type": "string",
            "pattern": "^[a-fA-F0-9]{64}$",
            "description": "SHA-256 of an artefact you are committing to."
        },
        "hash_label": {
            "type": "string",
            "maxLength": 160,
            "description": "What the hash is of, e.g. \"poc.py\"."
        },
        "supersedes_id": {
            "type": "integer",
            "minimum": 1,
            "description": "Your own earlier entry this one corrects."
        },
        "enc_summary": {
            "type": "string",
            "description": "Encrypted projects only: BRE1.<iv>.<ciphertext>."
        },
        "enc_detail": {
            "type": "string",
            "description": "Encrypted projects only."
        },
        "enc_key_id": {
            "type": "string",
            "description": "Encrypted projects only: the project's current key id."
        }
    },
    "required": [
        "project",
        "kind"
    ],
    "additionalProperties": false
}
```

### get_card

Without a ref: the member's cards (portable, versioned agent context: CLAUDE.md-style context, prompts, playbooks, settings). With a ref: the latest version's full content, to follow as instructions for the task it describes. Cards are prose and declarative settings only; they never contain code to run.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "ref": {
            "type": "string",
            "description": "Card ref, e.g. CARD-ABC123."
        }
    },
    "additionalProperties": false
}
```

### watch_drops

Events that cleared your target pools in the last N days: new programme launches, scope additions, code releases. Each event carries six scoring factors (money, fresh, substance, competition, cve) and the pools it matched, with score and reasons. Requires the fresh-code watch permission.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "days": {
            "type": "integer",
            "minimum": 1,
            "maximum": 30,
            "default": 7
        },
        "pool": {
            "type": "integer",
            "description": "Filter to one pool by id. Omit for all pools."
        }
    },
    "additionalProperties": false
}
```

### watch_strengths

Your bug-class profile built from your hunt log and contest findings: which classes you find, where those classes historically appear in the corpus, and the open events whose likely classes fit you best (where_next). Requires the fresh-code watch permission.

Input schema:

```json
{
    "type": "object",
    "properties": [],
    "additionalProperties": false
}
```

### watch_pools

Your target pools and the vocabulary for creating them: goal presets, event kinds, rule kinds, categories. Each pool carries its weights, score floor, bounty floor, KYC and open-submissions gates, event kinds and filter rules. Requires the fresh-code watch permission.

Input schema:

```json
{
    "type": "object",
    "properties": [],
    "additionalProperties": false
}
```

### watch_hunts

Your hunt log: targets you hunted, outcomes, hours and findings. Strengths are built from this, so log hunts to improve the recommendations from watch_strengths and watch_drops. Requires the fresh-code watch permission.

Input schema:

```json
{
    "type": "object",
    "properties": [],
    "additionalProperties": false
}
```

### recommend_targets

Rank programmes by a goal (bounty, cve, fresh, underhunted) using the composite attack-surface scores, weighted per goal. Optionally filter by category, scope asset type, platform, minimum bounty and KYC. Returns the top programmes with score breakdowns and a short reason why each ranks. Free for members; does not draw from the Surface API balance.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "goal": {
            "type": "string",
            "enum": [
                "bounty",
                "cve",
                "fresh",
                "underhunted"
            ],
            "default": "bounty",
            "description": "bounty: maximize payout. cve: maximize CVE credit. fresh: intercept new code. underhunted: minimum competition."
        },
        "category": {
            "type": "string",
            "enum": [
                "web3",
                "web",
                "mobile",
                "firmware",
                "desktop",
                "open-source",
                "cloud",
                "ai",
                "cve",
                "easy-cve"
            ]
        },
        "scope_type": {
            "type": "string",
            "description": "Asset type: SOURCE_CODE, URL, WILDCARD, SMART_CONTRACT, etc."
        },
        "platform": {
            "type": "string",
            "enum": [
                "hackerone",
                "bugcrowd",
                "intigriti",
                "yeswehack",
                "immunefi",
                "code4rena",
                "sherlock",
                "cantina",
                "independent",
                "other"
            ]
        },
        "min_bounty": {
            "type": "integer",
            "minimum": 1,
            "description": "Minimum advertised top reward in USD."
        },
        "kyc_ok": {
            "type": "boolean",
            "default": true,
            "description": "If false, exclude programmes requiring ID verification."
        },
        "limit": {
            "type": "integer",
            "minimum": 1,
            "maximum": 10,
            "default": 5
        }
    },
    "additionalProperties": false
}
```

### pre_submit_check

Before filing a vulnerability report: is the programme likely to pay, how fast will it triage, are there kill rules in the reviews, is this class/asset already well-trodden, and is the timing good? Takes the programme slug, the severity, and optionally a vuln class and target asset. Returns a go/caution/skip recommendation with payout estimate, triage forecast, kill-rule warnings, crowding and timing signals.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "program": {
            "type": "string",
            "description": "Program slug as BugRater shows it (e.g. \"gitlab\"), a BugRater program URL, or the platform handle. A name works too; an ambiguous one returns the closest slugs to pick from."
        },
        "severity": {
            "type": "string",
            "enum": [
                "critical",
                "high",
                "medium",
                "low"
            ]
        },
        "vuln_class": {
            "type": "string",
            "description": "Vulnerability class, e.g. \"xss\", \"sqli\", \"idor\"."
        },
        "target": {
            "type": "string",
            "description": "The specific asset being tested, for a scope check."
        }
    },
    "required": [
        "program",
        "severity"
    ],
    "additionalProperties": false
}
```

### submission_forecast

Before writing a report: what usually happens to this kind of finding on this programme? Takes a programme, a severity, and optionally a vuln class, target asset, and a one-line title. Returns the programme's historical outcome distribution (accepted vs duplicate vs informative vs rejected), ranked close reasons, the accept/reject rate for that vuln class on this programme, crowding and timing signals, and a risk verdict (submit / caution / rethink) with the specific kill patterns most likely to close this report. Complements pre_submit_check (which answers "will they pay and how fast") with "will this specific class of finding survive triage here".

Input schema:

```json
{
    "type": "object",
    "properties": {
        "program": {
            "type": "string",
            "description": "Program slug as BugRater shows it (e.g. \"gitlab\"), a BugRater program URL, or the platform handle. A name works too; an ambiguous one returns the closest slugs to pick from."
        },
        "severity": {
            "type": "string",
            "enum": [
                "critical",
                "high",
                "medium",
                "low"
            ]
        },
        "vuln_class": {
            "type": "string",
            "description": "Vulnerability class, e.g. \"xss\", \"sqli\", \"idor\", \"info_disclosure\", \"authn\". Use Outcomes::VULN_CLASSES keys."
        },
        "target": {
            "type": "string",
            "description": "The specific asset being reported on, for a scope check."
        },
        "title": {
            "type": "string",
            "description": "One-line finding title for pattern matching against known reject reasons."
        }
    },
    "required": [
        "program",
        "severity"
    ],
    "additionalProperties": false
}
```

### surface_board

Ranked programmes by composite attack-surface score: bounty, crowding, response quality, freshness, surface area, momentum. Each row carries score drivers, market data (surge %, reports/day, crowd density) and surface counts (domains, subdomains, signals). Costs $0.50. Call surface_me first to check your balance.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "sort": {
            "type": "string",
            "enum": [
                "score",
                "surge",
                "velocity",
                "hunters"
            ],
            "default": "score"
        },
        "limit": {
            "type": "integer",
            "minimum": 1,
            "maximum": 50,
            "default": 15
        }
    },
    "additionalProperties": false
}
```

### surface_movers

Programmes heating up (surge >= 6%, velocity >= 1/day) and under-hunted (hunters < 400, velocity >= 1.5/day). Costs $0.50. Call surface_me first to check your balance.

Input schema:

```json
{
    "type": "object",
    "properties": [],
    "additionalProperties": false
}
```

### surface_signals

Security signals across all programmes: exposed admin panels, staging environments, subdomain takeover candidates and similar. Filter by severity or signal type. Costs $0.50. Call surface_me first to check your balance.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "severity": {
            "type": "string",
            "enum": [
                "info",
                "low",
                "medium",
                "high"
            ]
        },
        "type": {
            "type": "string",
            "description": "Signal type filter."
        },
        "limit": {
            "type": "integer",
            "minimum": 1,
            "maximum": 50,
            "default": 20
        }
    },
    "additionalProperties": false
}
```

### surface_me

Your Attack Surface subscription status, API balance, and 30-day usage. Free. Call this before any metered surface tool to check your balance.

Input schema:

```json
{
    "type": "object",
    "properties": [],
    "additionalProperties": false
}
```

### attack_surface

BugRater's enumerated attack surface for a program, at the same prices as the REST API: summary (score, domains, counts) $0.75, subdomains $1.00, probes (HTTP status, title, server, tech, TLS) $0.50, signals (exposed panels, takeovers and similar) $0.75. A member with an Attack Surface subscription is billed to their balance. Anyone else can pay per call in USDC with x402: the first call answers with the price as an x402 PaymentRequired object, and the paid retry carries the signed payment in _meta["x402/payment"]. Nothing is charged when there is nothing to return. Check scope before touching any host this returns.

Input schema:

```json
{
    "type": "object",
    "properties": {
        "program": {
            "type": "string",
            "description": "Program slug as BugRater shows it (e.g. \"gitlab\"), a BugRater program URL, or the platform handle. A name works too; an ambiguous one returns the closest slugs to pick from."
        },
        "view": {
            "type": "string",
            "enum": [
                "summary",
                "subdomains",
                "probes",
                "signals"
            ],
            "default": "summary"
        },
        "limit": {
            "type": "integer",
            "minimum": 1,
            "maximum": 500,
            "default": 100
        }
    },
    "required": [
        "program"
    ],
    "additionalProperties": false
}
```

## MCP prompts

- `choose_target`: Shortlist programs worth hunting on now, from pay, crowding, responsiveness and reviews.
- `program_dossier`: Everything worth knowing about one program before you start, with where to begin.
- `pre_test_check`: Check a list of targets against scope before touching any of them.

Signed in, each of the member's cards is also offered as a prompt named card-<ref>.