# Bug Bounty Programs

> bug-bounty-programs

- name: io.github.pipeworx-io/bug-bounty-programs
- version: 0.1.1
- connection class: R0 (autonomous)
- trust: 95/100
- quality: –/100 (not scored)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.pipeworx-io%2Fbug-bounty-programs
- tools: https://api.protogrid.dev/v1/servers/io.github.pipeworx-io%2Fbug-bounty-programs/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "bug-bounty-programs": {
      "type": "http",
      "url": "https://gateway.pipeworx.io/bug-bounty-programs/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 99
- freshness: 100
- provenance: 85
- drivers: +repository +namespace-matches-repo +website -thin-description +reachable +uptime-98% +updated-0d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality –/100 (not scored)

Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package.

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-03-26; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: n/a (weight 30)

- n/a `tools.descriptions`, `tools.description_length`, `tools.schemas`, `tools.annotations`, `tools.directory_hints`, `tools.token_cost`, `tools.api_dump`: tool list unknown (behind auth, not probed, or empty)

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool list unknown

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: unknown
- tools last changed: 2026-10-13T06:22:15.371Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.pipeworx-io/bug-bounty-programs.svg)](https://protogrid.dev/servers/io.github.pipeworx-io/bug-bounty-programs)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-13 `polymarket_edges` removed
  - Scan top Polymarket markets and return opportunities where Pipeworx data disagrees with market price. Built for "what should I bet on today" — agents discover opportunities without paging hundreds of markets. FIVE MODEL FAMILIES grouped into three response segments under by_segment: (1) MODEL_DRIVEN — crypto_price (lognormal barrier from 90d FRED log-returns) and news_momentum (GDELT 7d/21d article-volume ratio, soft signal w/ halved Kelly). (2) STRUCTURAL_ARBITRAGE — partition_overround on mutually-exclusive events; per-leg favorite-longshot bias correction with per-sport α (tennis 1.02, soccer 1.10, MMA 1.15, default 1.0); placeholder-slug filter drops will-person-X / will-team-Y / will-manager-Z / will-someone-else- backstops; partitions with >20% placeholder fraction skipped entirely. (3) CONCENTRATED_LONGSHOT — basket trade when one leg ≥75% AND ≥2 longshots ≤8% AND portfolio return ≥25:1; rare-by-design (gates relaxed Run 8 from prior 85%/5%/50:1). EVERY OPPORTUNITY carries edge_pp_net (net of slippage AND Polymarket's own taker fee — fees_pp_applied itemises the fee component; see fees.ts for the published per-category schedule), kelly_fraction + kelly_fraction_half (capped at 0.25), market.liquidity, market.spread_pp, market.volume, plus a 24h-move warning ("Market moved X.Xpp in 24h") when the recent move alone exceeds the edge — your edge may already be in the price. TRADEABLE-EDGE KNOBS: min_liquidity / max_spread_pp drop opportunities where edge isn't realizable; min_partition_leg_kelly filters partitions by best per-leg Kelly. RESPONSE TOP-LEVEL: by_segment{model_driven,structural_arbitrage,concentrated_longshot}, fed_candidates/fed_note (Fed bets surface here, excluded from ranking — 1m-T vs EFFR signal is unreliable at meeting-month horizons without paid OIS/SOFR-futures data), and _diagnostics{concentrated_longshot:{...funnel counters},category_counts,filter_skips} so callers can see WHY a segment is empty (top-N stale, all candidates failed gates, knob dropped them). Cached 1h at the KV level keyed on all knobs.
- 2026-10-13 `company_facts` removed
  - TYPED, DETERMINISTIC financial facts for a US public company for an EXPLICITLY NAMED reporting period — "Apple revenue for fiscal 2023", "Walmart net income FY2026 Q3", "Microsoft cash at the end of fiscal 2024". PREFER OVER entity_profile / get_company_financials whenever the period matters: those answer "the most recent figures" and will happily hand back FY2025 when you asked about FY2019, and neither separates a discrete quarter from a year-to-date figure. This one refuses instead — it NEVER substitutes the latest period for the period requested, NEVER returns 0 for missing data, NEVER lets a 9-month YTD number answer a quarterly question, and NEVER converts a currency. Every answer carries the exact us-gaap concept it came from, what that concept MEASURES (NetIncomeLoss excludes non-controlling interests, ProfitLoss includes them — not synonyms), the accession number and a link to the filing on sec.gov, the restatement trail of any superseded figures, and a contract + derivation version to pin against. Fiscal periods are the FILER'S OWN, anchored on their fiscal-year end, so Walmart's year ending 2026-01-31 is FY2026 and Apple's ending 2025-09-27 is FY2025. Attributes in v1: revenue, net_income, cash. Every non-answer is a named status — `unavailable` (the filer did not report it for that period; the periods that DO exist are listed, without values), `unsupported` (outside what v1 covers — a non-us-gaap filer, an unknown attribute, a non-USD unit), `ambiguous` (the company name matched two filers equally well; both are named), `conflicting` (two filings the same day disagree; both are returned and neither is picked), `partial` (a value with no accession behind it). Source: SEC EDGAR, XBRL financial facts, one publisher read once — see `corroboration`. Same response is served at POST https://gateway.pipeworx.io/v1/facts for non-MCP callers.
- 2026-10-13 `subscribe` removed
  - Create a proactive monitoring subscription to a live-data event stream. Returns the new subscription id. Requires a Pipeworx OAuth account (anonymous + BYO cannot persist subscriptions). Supported types: "sec_8k" (8-K filings matching ticker + item codes — e.g. items:["5.02"] = officer change), "polymarket_edge" (Polymarket↔Kalshi cross-venue mispricings — params:{topic:"fed"}), "fred_series" (new FRED observations — params:{series_id:"UNRATE"}), "patent_grant" (new USPTO grants for an applicant), "clinical_trial" (new/updated ClinicalTrials.gov studies), "form_d" (new SEC Form D fundraise notices — params:{state?, industry?, min_amount?, exemption?}, all optional), "news_keyword" (GDELT keyword news alerts, metadata+link only — params:{query, lang?, domains?}), "job_post" (new public job-board postings — params:{ats?, board_token?} or {domain?}, plus optional title_query/location_query), "tool_diff" (re-runs any read-only tool on a schedule and fires on change — params:{tool, args?, fields[], schedule}), "new_entity" (new business registrations from a state business-entity registry — params:{state:"CO", name_query?, entity_type?}). Delivery channels: feed (always on — pull via recent_alerts or GET registry.pipeworx.io/alerts.json), and optionally email (set delivery:{email:"you@x.com"}) or sms (delivery:{sms:"+15551234567"} — phone must be verified at /account first; 10/day cap).
- 2026-10-13 `deep_research` removed
  - ACCOUNT REQUIRED (free — sign in via GitHub at https://pipeworx.io/signup; depth:"thorough" needs a paid plan). If you are not signed in, use ask_pipeworx instead — it works on every tier. Grounded multi-source research across Pipeworx's 1769 STRUCTURED data sources (SEC filings, FRED/BLS economics, FDA, USPTO patents, markets, science, government records, etc.) in ONE call — this is NOT open-web search. Decomposes your question into focused facets, routes each to the right one of 6,717 tools IN PARALLEL, and returns a findings packet: verbatim evidence + confidence + source + fetched_at + a stable pipeworx:// citation per finding, with explicit gaps[] for facets the data couldn't answer (never invented). Best for broad/multi-part questions over structured data ("compare X and Y's regulatory + financial exposure", "research the filings + market picture for ACME"). For a single lookup use ask_pipeworx (one LLM call, not many). For BREAKING or colloquial CURRENT-NEWS / "what's the world saying about X" topics, prefer ask_pipeworx — it routes to live news APIs and the *-news-feeds packs; deep_research returns mostly empty gaps[] when the topic isn't in the structured catalog. Second-hop iteration: depth:"standard" re-angles unanswered gaps (gap recovery); depth:"thorough" additionally chases the best leads from the first pass — so multi-step questions resolve in one call. Every finding carries a `hop` field and a citation_uri — a resolvable pipeworx:// record URI, present only when the source emits one that resources/read can actually serve, so a citation you get back is always fetchable. "standard" and "thorough" also return contradictions[] flagging findings that disagree. Large records are semantically excerpted to the passages relevant to each facet (not head-truncated), so answers deep in a long filing/series aren't missed. Expect 15-60s (thorough with its follow-up + contradiction pass: up to ~90s).
- 2026-10-13 `bounty_new_programs` removed
  - Bug-bounty programs launched in the last N days, by real launch date. Currently HackerOne only — the only one of the three platforms that publishes a `launched_at` field without a login; Bugcrowd and YesWeHack expose no launch-date field at all (confirmed by enumerating their public endpoints), and are named, not silently merged in.
- 2026-10-13 `bounty_program` removed
  - One bug-bounty program by platform + handle: bounty range, status, and scope assets where the platform publishes them without a login. YesWeHack returns a full severity x asset-value reward table; HackerOne returns real scope but no numeric reward table (not exposed publicly); Bugcrowd returns neither (login-walled) and says so.
- 2026-10-13 `bounty_programs_search` removed
  - Search public bug-bounty program directories on Bugcrowd, YesWeHack and HackerOne — program name, cash bounty range, and status (open/paused/disabled), each sourced from that platform's own public, unauthenticated directory. has_wildcard checks real scope asset identifiers on YesWeHack and HackerOne (Bugcrowd's scope is behind a researcher login and is reported as such, not silently empty).
- 2026-10-13 `recall` removed
  - Retrieve a value previously saved via remember, or list all saved keys (omit the key argument). Use to look up context the agent stored earlier — the user's target ticker, an address, prior research notes — without re-deriving it from scratch. Scoped to your identifier (anonymous IP, BYO key hash, or account ID). Pair with remember to save, forget to delete.
- 2026-10-13 `remember` removed
  - Save data the agent will need to reuse later — across this conversation or across sessions. Use when you discover something worth carrying forward (a resolved ticker, a target address, a user preference, a research subject) so you don't have to look it up again. Stored as a key-value pair scoped by your identifier. Authenticated users get persistent memory; anonymous sessions retain memory for 24 hours. Pair with recall to retrieve later, forget to delete.
- 2026-10-13 `scan_competitor_ai_presence` removed
  - Compare AI visibility across multiple entities side-by-side. Probes each entity (your brand + N competitors) with ai_visibility_check, ranks by score, surfaces which is most/least recognized. Useful for competitive AI-marketing audits: "does Claude know about us as well as our competitors?". Returns ranked list with score, confidence, signal density per entity.

Full history: https://api.protogrid.dev/v1/servers/io.github.pipeworx-io%2Fbug-bounty-programs/changes

## Remotes

- https://gateway.pipeworx.io/bug-bounty-programs/mcp (streamable-http, auth none, reachable true, uptime30d 0.9777778)

## Packages

_none_

## Tools (0)

_none observed_