---
title: "Hacker Bob"
description: "Autonomous offensive-security testing with public Common Vulnerabilities and Exposures receipts and an Apache-2.0 runtime."
canonical: "https://hackerbob.ai/index.md"
last-updated: "2026-09-05"
---
# Hacker Bob

> 17 Common Vulnerabilities and Exposures (CVE) IDs across 9 open-source projects.

Hacker Bob is an autonomous offensive-security agent for authorized targets. Private beta assessments are operator-supervised and human-reviewed.

Every public record is linked on the receipts wall. Two privately assigned IDs have no public record and remain unlinked.

## Start here

- [Public CVE receipts](https://hackerbob.ai/cves)
- [About Hacker Bob](https://hackerbob.ai/about)
- [Developer guide](https://hackerbob.ai/developers)
- [Source](https://github.com/vmihalis/hacker-bob)
- [npm package](https://www.npmjs.com/package/hacker-bob)

## Public and local execution boundaries

hackerbob.ai exposes a public, read-only application programming interface (API) and hosted Model Context Protocol (MCP) server for cleared public records and capability metadata. Neither interface can start assessments, interact with targets, spend credits, or access private workspaces. The assessment runtime remains a local installation.

## Install locally

```sh
npx -y hacker-bob@latest install .
```

Run Hacker Bob only against systems the operator owns or has explicit permission to test.

## Machine-readable surfaces

- [OpenAPI 3.1 specification](https://hackerbob.ai/openapi.json)
- [Hosted public-records MCP server](https://hackerbob.ai/mcp)
- [MCP discovery manifest](https://hackerbob.ai/.well-known/mcp)
- [A2A agent card](https://hackerbob.ai/.well-known/agent-card.json)
- [API catalog](https://hackerbob.ai/.well-known/api-catalog)
- [MCP Registry metadata](https://hackerbob.ai/server.json)
- [Official MCP Registry query](https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.bobnetsec%2Fhacker-bob-public-records)
- [Short agent guide](https://hackerbob.ai/llms.txt)
- [Full agent guide](https://hackerbob.ai/llms-full.txt)
- [Public receipt data](https://hackerbob.ai/receipts.json)
- [Agent resource catalog](https://hackerbob.ai/.well-known/ai-catalog.json)
- [Agent Plugin manifest](https://hackerbob.ai/plugin.json)
- [Schema Map](https://hackerbob.ai/schemamap.xml)
- [Public records JavaScript SDK](https://hackerbob.ai/sdk/hacker-bob.mjs)
- [API-scoped agent guide](https://hackerbob.ai/api/llms.txt)

Last revised 2026-09-05.