---
title: "Hacker Bob agent instructions"
description: "When-to-use guidance and authorization boundaries for Hacker Bob's public and local interfaces."
canonical: "https://hackerbob.ai/agents.md"
last-updated: "2026-09-05"
---
# Hacker Bob agent instructions

> Guidance for agents using Hacker Bob's public records, authenticated workspace tools, or released local runtime.

## When to use Hacker Bob

Use the public website, REST API, hosted Model Context Protocol (MCP) server, or Agent2Agent (A2A) interface for cleared public Common Vulnerabilities and Exposures (CVE) records and product discovery. Public records require no authentication.

Use the authenticated hosted MCP tools when a user asks their agent to inspect a Hacker Bob workspace, authorize a domain, prepare an assessment, submit approved scope to the managed queue, or read results. Connect through OAuth 2.1 or the device authorization flow. Every connection is bound to one workspace.

Use the released local runtime only when the user explicitly chooses a local installation. Keep the registrable domain, repository, and environment inside the authorization boundary the user provides.

## Safety boundary

Never infer authorization from public source code, a public deployment, or access to one related system. Domain authorization must complete before preparation. Preparing never submits work. Submission requires the user to approve the exact prepared target and scope in Hacker Bob; changed or expired approvals cannot enter the managed queue.

## Interfaces

- [OpenAPI specification](https://hackerbob.ai/openapi.json)
- [MCP server](https://hackerbob.ai/mcp)
- [MCP server card](https://hackerbob.ai/.well-known/mcp/server-card.json)
- [OAuth protected-resource metadata](https://hackerbob.ai/.well-known/oauth-protected-resource)
- [Agent onboarding skill](https://hackerbob.ai/.well-known/agent-skills/hacker-bob-onboarding.md)
- [MCP Registry metadata](https://hackerbob.ai/server.json)
- [A2A agent card](https://hackerbob.ai/.well-known/agent-card.json)
- [A2A endpoint](https://hackerbob.ai/a2a)
- [Public vulnerability records API](https://hackerbob.ai/api/v1/cve-records)
- [Natural-language public-record search](https://hackerbob.ai/ask)
- [Developer guide](https://hackerbob.ai/developers.md)
- [Privacy](https://hackerbob.ai/privacy.md)
- [Contact](https://hackerbob.ai/contact.md)
- [Source](https://github.com/vmihalis/hacker-bob)

## Local assessment runtime

```sh
npx -y hacker-bob@latest install .
```

The installer supports Claude Code, Codex, Kimi CLI, and generic MCP clients. Restart the selected host after installation.

Last revised 2026-09-05.