{
  "_meta": {
    "view": "agent",
    "description": "Machine-readable index of Hacker Bob's public records, authenticated MCP workspace workflow, NLWeb, and local runtime.",
    "lastModified": "2026-09-05",
    "schemaVersion": "1.0",
    "contentType": "application/json"
  },
  "name": "Hacker Bob",
  "headline": "17 Common Vulnerabilities and Exposures (CVE) IDs across 9 open-source projects.",
  "summary": "Hacker Bob is an autonomous offensive-security agent for authorized targets. Private beta assessments are operator-supervised and human-reviewed.",
  "authentication": "oauth2-or-device-for-workspace-tools",
  "auth": {
    "type": "oauth2-or-device",
    "required": false,
    "requiredFor": "workspace tools",
    "protectedResourceMetadata": "https://hackerbob.ai/.well-known/oauth-protected-resource",
    "deviceAuthorizationStart": "https://hackerbob.ai/api/agent/device/start",
    "documentation": "https://hackerbob.ai/.well-known/agent-skills/hacker-bob-onboarding.md",
    "note": "Public record tools need no credential. Authenticated credentials are bound to one Hacker Bob workspace."
  },
  "readOnly": false,
  "capabilities": [
    "list_public_cve_records",
    "get_public_cve_record",
    "search_public_cve_records",
    "get_capabilities",
    "get_my_account",
    "list_workspaces",
    "get_workspace",
    "list_assets",
    "get_asset",
    "begin_domain_authorization",
    "check_domain_authorization",
    "list_assessments",
    "get_assessment",
    "prepare_assessment",
    "launch_assessment",
    "cancel_assessment",
    "list_findings",
    "get_finding",
    "list_reports",
    "get_report",
    "get_credit_summary",
    "list_audit_events"
  ],
  "endpoints": {
    "health": "https://hackerbob.ai/api/v1/health",
    "capabilities": "https://hackerbob.ai/api/v1/capabilities",
    "sandbox": "https://hackerbob.ai/api/v1/sandbox",
    "records": "https://hackerbob.ai/api/v1/cve-records",
    "search": "https://hackerbob.ai/ask",
    "mcp": "https://hackerbob.ai/mcp",
    "a2a": "https://hackerbob.ai/a2a",
    "oauthProtectedResource": "https://hackerbob.ai/.well-known/oauth-protected-resource",
    "deviceAuthorizationStart": "https://hackerbob.ai/api/agent/device/start",
    "onboardingSkill": "https://hackerbob.ai/.well-known/agent-skills/hacker-bob-onboarding.md"
  },
  "examples": {
    "listRecords": "https://hackerbob.ai/api/v1/cve-records?limit=5",
    "getRecord": "https://hackerbob.ai/api/v1/cve-records/CVE-2026-47747",
    "searchRecords": "https://hackerbob.ai/ask?query=netatalk"
  },
  "boundary": {
    "publicRecordsApi": true,
    "hostedMcp": true,
    "authenticatedWorkspaceTools": true,
    "remoteAssessmentPreparation": true,
    "exactHumanApprovalRequiredBeforeLaunch": true,
    "arbitraryTargetArguments": false,
    "runtimeCredentialExposure": false,
    "note": "Agents operate only on asset IDs inside one bound workspace. Domain proof and exact per-run human approval are enforced server-side."
  },
  "navigation": {
    "api": "https://hackerbob.ai/api/v1",
    "openapi": "https://hackerbob.ai/openapi.json",
    "mcp": "https://hackerbob.ai/mcp",
    "mcpDiscovery": "https://hackerbob.ai/.well-known/mcp",
    "apiCatalog": "https://hackerbob.ai/.well-known/api-catalog",
    "mcpRegistryMetadata": "https://hackerbob.ai/server.json",
    "mcpRegistry": "https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.bobnetsec%2Fhacker-bob-public-records",
    "nlweb": "https://hackerbob.ai/ask",
    "receipts": "https://hackerbob.ai/receipts.json",
    "about": "https://hackerbob.ai/about.md",
    "developers": "https://hackerbob.ai/developers.md",
    "apiReference": "https://hackerbob.ai/api-reference.md",
    "apiPolicy": "https://hackerbob.ai/api-policy.md",
    "privacy": "https://hackerbob.ai/privacy.md",
    "contact": "https://hackerbob.ai/contact.md",
    "instructions": "https://hackerbob.ai/agents.md",
    "a2a": "https://hackerbob.ai/a2a",
    "a2aAgentCard": "https://hackerbob.ai/.well-known/agent-card.json",
    "plugin": "https://hackerbob.ai/plugin.json",
    "schemaMap": "https://hackerbob.ai/schemamap.xml",
    "schemaFeed": "https://hackerbob.ai/feeds/schema-org.jsonl",
    "sdk": "https://hackerbob.ai/sdk/hacker-bob.mjs",
    "docsLlms": "https://hackerbob.ai/docs/llms.txt",
    "apiLlms": "https://hackerbob.ai/api/llms.txt",
    "developersLlms": "https://hackerbob.ai/developers/llms.txt",
    "sandbox": "https://hackerbob.ai/api/v1/sandbox",
    "source": "https://github.com/vmihalis/hacker-bob",
    "npm": "https://www.npmjs.com/package/hacker-bob"
  },
  "hosted": {
    "transport": "streamable-http",
    "endpoint": "https://hackerbob.ai/mcp",
    "authentication": "none",
    "readOnly": true
  },
  "a2a": {
    "protocolBinding": "JSONRPC",
    "protocolVersion": "1.0",
    "endpoint": "https://hackerbob.ai/a2a",
    "authentication": "none",
    "readOnly": true
  },
  "webmcp": {
    "enabled": true,
    "script": "https://hackerbob.ai/webmcp.js",
    "api": "document.modelContext or navigator.modelContext"
  },
  "tools": [
    {
      "name": "list_public_cve_records",
      "description": "List cleared public Hacker Bob Common Vulnerabilities and Exposures records with cursor pagination and optional project or publication-status filters."
    },
    {
      "name": "get_public_cve_record",
      "description": "Return one cleared Hacker Bob CVE record by identifier, including its open-source project, publication status, and upstream public record URL when available."
    },
    {
      "name": "search_public_cve_records",
      "description": "Search cleared public Hacker Bob CVE records by CVE identifier, open-source project name, or publication status without contacting any assessment target."
    },
    {
      "name": "get_capabilities",
      "description": "Return current public boundaries and, when authenticated, workspace-specific tool reachability, scopes, and role requirements."
    },
    {
      "name": "get_my_account",
      "description": "Return the authenticated account and the workspace bound to this agent connection."
    },
    {
      "name": "list_workspaces",
      "description": "List active Hacker Bob workspaces available to the authenticated account. The connection remains bound to its approved workspace."
    },
    {
      "name": "get_workspace",
      "description": "Return the approved workspace and current membership role."
    },
    {
      "name": "list_assets",
      "description": "List workspace assets and current ownership-authorization state without contacting a target."
    },
    {
      "name": "get_asset",
      "description": "Return one workspace asset and its current authorization state."
    },
    {
      "name": "begin_domain_authorization",
      "description": "Create a DNS TXT or HTTPS-file challenge proving control of a domain. This does not run an assessment."
    },
    {
      "name": "check_domain_authorization",
      "description": "Check the previously issued DNS or HTTPS proof and update the asset authorization state."
    },
    {
      "name": "list_assessments",
      "description": "List assessments and current run states in the approved workspace."
    },
    {
      "name": "get_assessment",
      "description": "Return one assessment, its verified asset, current run state, and any pending human approval."
    },
    {
      "name": "prepare_assessment",
      "description": "Create an immutable assessment for a verified stored asset and return a browser approval URL. This never contacts the target."
    },
    {
      "name": "launch_assessment",
      "description": "Consume a recent human approval and submit the immutable assessment to Hacker Bob's managed queue. The target is resolved only from the stored verified asset."
    },
    {
      "name": "cancel_assessment",
      "description": "Cancel an eligible queued or running assessment and reconcile any refundable reserved credit."
    },
    {
      "name": "list_findings",
      "description": "List workspace findings with optional lifecycle and severity filters."
    },
    {
      "name": "get_finding",
      "description": "Return one finding with evidence-safe lifecycle history and related asset metadata."
    },
    {
      "name": "list_reports",
      "description": "List non-revoked reports released to the approved workspace."
    },
    {
      "name": "get_report",
      "description": "Return one released, non-revoked workspace report. Pending review material and access credentials are never returned."
    },
    {
      "name": "get_credit_summary",
      "description": "Return available, reserved, and used assessment credits for the approved workspace."
    },
    {
      "name": "list_audit_events",
      "description": "List recent workspace audit events with optional actor, action, and time filters."
    }
  ],
  "resources": [
    {
      "uri": "hackerbob://public/cve-records",
      "name": "public-cve-records",
      "title": "Hacker Bob public CVE records",
      "description": "Complete machine-readable index of cleared public CVE records and assigned IDs without public records.",
      "mimeType": "application/json"
    },
    {
      "uri": "hackerbob://public/capabilities",
      "name": "public-capabilities",
      "title": "Hacker Bob public capabilities",
      "description": "Read-only public API and MCP capabilities plus the explicit no-assessment-execution boundary.",
      "mimeType": "application/json"
    },
    {
      "uri": "hackerbob://docs/agent-instructions",
      "name": "agent-instructions",
      "title": "Hacker Bob agent instructions",
      "description": "When-to-use instructions and authorization boundaries for public records and the local runtime.",
      "mimeType": "text/markdown"
    }
  ],
  "install": {
    "transport": "local-stdio",
    "command": "npx -y hacker-bob@latest install .",
    "authorizationRequired": true
  }
}