Hacker Bob

Hacker Bob

17 Common Vulnerabilities and Exposures (CVE) IDs credited across 9 projects, all produced by Bob. One was co-reported with AISLE; one credits Bob as an additional reporter. Review the linked receipts.

Hacker Bob is an open-source autonomous bug bounty hunter built around a local Model Context Protocol (MCP) runtime. Run it against authorized targets or in continuous integration (CI).

01 RUN · 02 PROOF · 03 SYSTEM · 04 CI · 05 SAFETY · 06 REFERENCE · 07 CONTRIBUTE

LOCAL MCP · AUTHORIZED TARGETS · EVIDENCE BEFORE REPORTING

01: Run Bob

Choose the project directory where you want to run Bob. Install into that project, not into this source checkout unless you are developing Bob itself.

1. Install

npm install --global hacker-bob@latest
hacker-bob install /path/to/your/project
cd /path/to/your/project

Watch a clean installation

The installation animation uses the equivalent global-CLI form against a disposable local workspace and filters the real output to its key milestones. It was generated with VHS (view source).

2. Verify the local MCP runtime

node -e "require('./mcp/server.js'); console.log('MCP ok')"

3. Restart your host and run Bob

Restart your host CLI from the same project directory, then run the matching command:

[!WARNING] Run Bob only against targets you own or are explicitly authorized to test. Replace `` with an approved domain, contract address, or repository path.

Host	Evaluate	Status	Update	Export
Claude Code	/bob-evaluate	/bob-status	/bob-update	/bob-export
Codex	$bob-evaluate	$bob-status	$bob-update	$bob-export
Kimi CLI	/skill:bob-evaluate	/skill:bob-status	/skill:bob-update	/skill:bob-export
Generic MCP host	Connect the generated .mcp.json, then follow .hacker-bob/generic-mcp/hacker-bob.md.	Use the host's MCP tool interface.	Re-run the shell updater.	Use the host's MCP tool interface.
Shell	-	hacker-bob doctor /path/to/your/project	hacker-bob update /path/to/your/project --adapter claude	-

Watch Bob verify the installation

Check a local installation and reduce the full doctor report to a quick readiness signal:

hacker-bob doctor ./project \
  --adapter claude \
  --json \
| jq '{
    ready: .ok,
    host: .adapters[0],
    passed: (
      .checks
      | map(select(.status == "ok"))
      | length
    )
  }'

The doctor demo above was generated with VHS from a real, isolated Hacker Bob install (view source). It checks only a disposable local workspace: no live target, recon, signup, or scan.

View the individual real terminal captures

Evaluation start against a controlled lab target

Full installation doctor

Fresh-session status

Receipt portfolio