h1-brain

概述

h1-brain是一个MCP服务器，将AI助手与Hackerone的漏洞赏金平台连接起来。它将您的个人漏洞赏金历史、程序范围和报告详情同步到本地SQLite数据库，提供搜索和分析过去工作的工具。该服务器包含一个包含3,600多个来自Hackerone社区的公开披露的获奖赏金报告的预构建数据库。其主要工具`hack(handle)`通过组合API中的新范围、您的过往发现、公开披露、弱点模式和 suggested 攻击向量来生成全面的攻击简报。

试试问 AI

装完之后，这里有 6 个你可以让 AI 做的事：

• hackhack(handle)

  Generates a full hacking session briefing with scope, past findings, public reports, and attack vectors

  试试:Generate a hacking briefing for program exampleCorp试试:Attack plan for handle=acme-corp试试:Hack target: tech-company-prod
• search_reportssearch_reports(query, program, weakness, severity, limit)

  Search your personal rewarded reports by various criteria

  试试:Find my reports with XSS vulnerabilities试试:Show me high severity reports from exampleCorp试试:Search for SQLi reports with bounty > $1000
• get_reportget_report(report_id)

  Retrieve full details of your specific reward report

  试试:Get report ID 12345 details试试:Show me the full report for 98765试试:Retrieve report with ID 54321
• get_report_summaryget_report_summary()

  Get summary of all your reports grouped by program

  试试:Show my report summary试试:How much have I earned total?试试:List all my programs and report counts
• search_programssearch_programs(query, bounty_only, limit)

  Search your accessible programs on HackerOne

  试试:Show all my programs with bounties试试:Find programs matching tech试试:List programs with active bounties
• search_scopessearch_scopes(program, asset, bounty_only, limit)

  Search in-scope assets across your programs

  试试:Show bounty-eligible assets for exampleCorp试试:Find scope assets with hostname api试试:List all assets in program with handle=acme
• fetch_attachmentfetch_attachment(report_id, attachment_id?)

  Get fresh download URLs for report attachments

  试试:Get attachments for report 12345试试:Download attachment 678 from report 54321试试:Fetch all attachments from report 98765
• search_disclosed_reportssearch_disclosed_reports(query, program, weakness, limit)

  Search public disclosed reports across all programs

  试试:Find public reports about XSS in banking试试:Show disclosed reports for acme-corp试试:Search public reports for SSRF vulnerabilities
• get_disclosed_reportget_disclosed_report(report_id)

  Retrieve full details of a specific public disclosed report

  试试:Get public report 11111 details试试:Show me the full disclosed report 22222试试:Retrieve public disclosure 33333
• fetch_rewarded_reportsfetch_rewarded_reports()

  Sync all your bounty-awarded reports from HackerOne API

  试试:Update all my bounty reports试试:Fetch latest rewarded reports试试:Sync my reports from HackerOne
• fetch_programsfetch_programs()

  Sync all your accessible programs from HackerOne API

  试试:Update my program list试试:Fetch all my programs试试:Sync available programs from HackerOne
• fetch_program_scopesfetch_program_scopes(handle)

  Sync program scopes from HackerOne API (auto-called by hack)

  试试:Update scopes for program exampleCorp试试:Fetch scope for handle=acme试试:Get latest scope for tech-company

可对比工具

安装

git clone https://github.com/PatrikFehrenbach/h1-brain.git
cd h1-brain
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt

{
  "mcpServers": {
    "h1-brain": {
      "command": "/path/to/h1-brain/venv/bin/python",
      "args": ["/path/to/h1-brain/server.py"],
      "env": {
        "H1_USERNAME": "your_hackerone_username",
        "H1_API_TOKEN": "your_api_token"
      }
    }
  }
}

FAQ

h1-brain从HackerOne访问哪些数据？

h1-brain访问您的获奖报告、您有权访问的程序和程序范围。它还包含一个包含3,600多个公开披露的获奖报告的预构建数据库。

使用此工具需要HackerOne账户吗？

是的，您需要一个具有API访问权限的HackerOne账户来同步您的个人数据。公共报告数据库随服务器一起提供。

h1-brain 对比