Hacker Bob

Architecture briefing

# How Hacker Bob works

A simple explanation of the agents, pipeline, MCP memory, and evidence flow behind Bob.

Event slide deck Arrow keys or space to navigate
Hacker Bob

Scan this first

## Open Hacker Bob on GitHub.

Repo, install command, release notes, issues, and source code are all here.

github.com/vmihalis/hacker-bob

github.com/vmihalis/hacker-bob

Repository https://github.com/vmihalis/hacker-bob
Hacker Bob

First principle

Ethical hacking is hacking with permission.

Same technical curiosity. Different contract, boundaries, evidence handling, and disclosure path.

Set the frame Authorization changes everything
Hacker Bob

Rules of engagement

1 Get authorization

Only test targets, accounts, and methods that are explicitly allowed.

2 Stay in scope

Respect program limits, rate limits, data rules, and third-party boundaries.

3 Minimize harm

Collect the proof needed, redact sensitive data, and report responsibly.

Why this matters Bob should amplify discipline, not risk
Hacker Bob

Bug bounty basics

## Permission to hunt, with a rulebook.

A company publishes scope, rules, rewards, and a report form. You test only the allowed assets and submit reproducible evidence.

HackerOne Bugcrowd Intigriti YesWeHack huntr AI/ML
1

Read the scope before touching anything.

2

Test carefully and avoid real user harm.

3

Report proof that someone can reproduce.

4

Wait for triage, fix, and reward decisions.

Where to start Public programs, beginner-friendly scopes, and company security pages
Hacker Bob

Threat landscape: April 2026

The attack surface is moving faster than static playbooks.

This month alone: software supply chain compromise, stolen SaaS tokens, OAuth abuse, active zero-days, and critical infrastructure intrusion disclosures.

Research checked Apr 30, 2026 Selected public incidents, not a complete global census
Hacker Bob

Recent incidents: supply chain

Apr 29 SAP npm packages

Official SAP-related packages were compromised to steal developer and cloud credentials.

Apr 22 Bitwarden CLI

A malicious npm delivery path briefly distributed a backdoored CLI package.

Apr 7 Snowflake customers

Stolen third-party integration tokens drove data-theft attempts against customer accounts.

Pattern Trusted software paths became attack paths
Hacker Bob

Recent incidents: enterprise and data

Apr 20 Vercel

A third-party AI/OAuth integration became a route into internal systems and customer data exposure.

Apr 26 Itron

The utility technology firm disclosed unauthorized access to internal systems.

Apr 13 Booking / Basic-Fit

Public breach reports included reservation data exposure and a 1M-member fitness breach.

Pattern Identity, SaaS, and data access are primary targets
Hacker Bob

Recent incidents: exploitation

## Zero-days and exposed admin surfaces are still live fire.

April reporting included active exploitation around Fortinet EMS, Microsoft Defender, Windows Shell, LiteLLM, Qinglong, cPanel/WHM, and WordPress plugin backdoors.

Exposed management
Weak auth
Known exploited flaws
Credential theft
Data impact
Pattern Attackers combine old gaps with fast exploitation
Hacker Bob
AI

The big shift

SECURITY IS BECOMING AGENTIC

Attack and defense are moving from fixed scripts to systems that observe, decide, use tools, and adapt.

Transition slide This is why Bob's architecture matters
Hacker Bob

Agent-assisted attacks

The attacker loop is becoming agent-assisted.

Not just static scripts: operators now use AI to research, plan, generate lures, test infrastructure, triage data, and adapt faster.

Precise claim Human operators still steer many attacks, but agents compress time and skill
Hacker Bob

Why this changes defense

## Static scripts execute.

Agents decide what to try next.

1

Observe the target.

2

Choose the next test.

3

Call tools.

4

Adapt from results.

Bridge to Bob Ethical automation needs memory, scope, evidence, and human control
Hacker Bob

Sources checked Apr 30, 2026

### Incident pulse

- BleepingComputer security feed
- Wiz: SAP npm compromise
- Bitwarden: CLI incident statement
- TechCrunch: Vercel incident

### AI shift

- Microsoft: AI abuse accelerates
- Microsoft: agentic tradecraft
- AWS: AI-augmented FortiGate attacks
- NSA: joint threat advisory

Use this slide if challenged Claims are current as of Apr 30, 2026
Hacker Bob

The problem

Bug bounty hunting is not one task.

It is recon, auth, testing, chaining, verifying, collecting evidence, grading, and writing.

Start here Bob is built around the workflow
Hacker Bob

One sentence

Bob turns the hunt into a state machine with receipts.

Every phase leaves structured evidence behind.

Simple mental model State machine + artifacts
Hacker Bob

Architecture in three layers

1 Commands

The human starts, resumes, checks, and debugs Bob.

2 Orchestrator

The root skill chooses the next phase and starts agents.

3 MCP memory

The local server owns state, findings, evidence, and telemetry.

What to remember Human control, agent work, durable state
Hacker Bob

Layer 1

## Commands are the control panel.

The operator does not manage every file. They use simple Claude Code commands.

Common commands Claude Code

    /bob-hunt target.com
    /bob-hunt resume target.com
    /bob-status
    /bob-debug
    /bob-egress

User-facing surface Simple commands over a complex workflow
Hacker Bob
1

Read the current session state.

2

Decide the next phase.

3

Spawn the right specialist agent.

4

Wait for structured output.

Layer 2

## The orchestrator coordinates.

It does not do random target testing. It delegates work and keeps the run on rails.

Root skill: bob-hunt Coordinates, delegates, resumes
Hacker Bob

Layer 3

MCP is Bob's memory and rulebook.

The local `bountyagent` server validates tools, writes artifacts, enforces phase gates, and records telemetry.

state findings coverage evidence grade audit
Source of truth JSON and JSONL, not chat memory
Hacker Bob

Context strategy

Long hunts can drown the model.

Recon data, traffic, auth, findings, retries, dead ends, and evidence can quickly become too much for one chat to carry.

The challenge Too much context causes drift
Hacker Bob

Context strategy

Bob keeps memory outside the chat.

The chat coordinates. MCP stores. Agents receive only the slice they need.

compact briefs surface assignments artifact reads structured handoffs
The answer Use context like a budget
Hacker Bob

Context strategy

## Each agent gets a narrow slice.

Hunter One surface

Enough detail to test one target area well.

Verifier One claim set

Enough detail to replay and challenge findings.

Reporter Only survivors

Enough detail to write from verified evidence.

Strategic compression Less context per agent, better focus
Hacker Bob

Context strategy

## The hunter brief is curated.

Bob does not paste the whole session. It builds a compact brief from MCP state.

Example: hunter brief contents high level

    {
      "assigned_surface": "API-1",
      "auth_hint": "attacker + victim",
      "coverage_summary": "2 tested, 1 promising",
      "traffic_hints": ["/api/invoices/:id"],
      "dead_ends": ["/old-login"],
      "ranking_reason": "auth + object IDs"
    }

Important idea Briefs are generated from durable state
Hacker Bob
Example: state.json simplified

    {
      "target": "example.com",
      "phase": "HUNT",
      "hunt_wave": 2,
      "pending_wave": null,
      "auth_status": "attacker_and_victim",
      "total_findings": 1
    }

Context strategy

## State makes Bob resumable.

If the chat stops, Bob can read the session state and continue from the right place.

Key idea Progress lives on disk, not only in the conversation
Hacker Bob

The whole run

## Seven phases, one direction.

RECON Find surfaces
AUTH Get profiles
HUNT Test surfaces
CHAIN Combine impact
VERIFY Replay claims
GRADE Decide quality
REPORT Write result
FSM RECON -> AUTH -> HUNT -> CHAIN -> VERIFY -> GRADE -> REPORT
Hacker Bob
01

Pipeline step

RECON

Bob builds the map before anyone starts testing.

Phase 1 of 7 Output: attack_surface.json
Hacker Bob

Phase 1: RECON

## Bob first builds a map.

Recon finds attack surfaces and gives each one a stable ID.

Example: attack_surface.json simplified

    {
      "target": "example.com",
      "surfaces": [
        {
          "id": "API-1",
          "type": "api",
          "url": "https://api.example.com",
          "priority": "HIGH",
          "hints": ["auth", "object_ids"]
        }
      ]
    }

Output Surfaces hunters can be assigned to
Hacker Bob
02

Pipeline step

AUTH

Bob tries to get useful testing identities.

Phase 2 of 7 Goal: attacker and victim profiles
Hacker Bob

Phase 2: AUTH

Bob tries to get useful accounts.

Attacker and victim profiles let Bob test access control with contrast instead of guessing.

API signup Browser signup Manual capture Auth store
Why it matters IDOR and access-control testing need two identities
Hacker Bob

Network visibility

## Bob records how it touches the target.

HTTP scans go through MCP, which writes redacted audit metadata and egress information.

Example: http-audit.jsonl line simplified

    {
      "method": "GET",
      "url": "https://api.example.com/api/...",
      "status": 200,
      "auth_profile": "attacker",
      "egress_profile": "default"
    }

Important for operators Audited requests, redacted URLs, visible egress
Hacker Bob

Egress control

Bob does not silently rotate networks.

If reachability looks blocked or geofenced, Bob reports it and the operator chooses an egress profile.

/bob-egress operator choice no proxy URLs in audit
Boundary Routing is controlled by the human
Hacker Bob
03

Pipeline step

HUNT

Specialist agents test assigned surfaces in waves.

Phase 3 of 7 Output: findings, coverage, handoffs
Hacker Bob

Phase 3: HUNT

## Hunters work in waves.

One hunter gets one surface. That keeps parallel testing focused.

Start

### Assign surfaces

MCP writes wave assignments.

Run

### Spawn hunters

Agents test in background.

Merge

### Validate handoffs

MCP updates session state.

Wave rule Launch, wait, merge, then decide
Hacker Bob

JSON example

## A hunter leaves a handoff.

This tells Bob what happened to the assigned surface.

Example: handoff-w1-a2.json simplified

    {
      "wave": "w1",
      "agent": "a2",
      "surface_id": "API-1",
      "surface_status": "promising",
      "findings": ["F-1"],
      "lead_surface_ids": ["WEB-3"],
      "dead_ends": ["/old-login"]
    }

Why it matters Parallel agents become structured state
Hacker Bob
Example: coverage.jsonl line simplified

    {
      "surface_id": "API-1",
      "endpoint": "/api/invoices/123",
      "bug_class": "idor",
      "auth_profile": "attacker",
      "status": "tested",
      "notes": "Victim invoice blocked"
    }

JSON example

## Coverage prevents repeated guessing.

Bob records what was tested, blocked, promising, or needs auth.

Coverage is durable Hunters log meaningful tests through MCP
Hacker Bob

JSON example

## A finding is a claim with context.

It is not a report yet. It is a candidate that must survive chaining and verification.

Example: findings.jsonl line simplified

    {
      "id": "F-1",
      "title": "Invoice IDOR",
      "severity": "HIGH",
      "surface_id": "API-1",
      "auth": "attacker_vs_victim",
      "evidence": "Attacker can read victim invoice"
    }

Important distinction Finding does not mean reportable yet
Hacker Bob
04

Pipeline step

CHAIN

Bob checks whether separate signals combine into stronger impact.

Phase 4 of 7 Output: chain-attempts.jsonl
Hacker Bob

Phase 4: CHAIN

Bob asks: can this become worse?

The chain-builder tests whether findings, auth context, traffic, and handoff notes combine into stronger impact.

Output chain-attempts.jsonl
Hacker Bob
Example: chain-attempts.jsonl line simplified

    {
      "id": "C-1",
      "finding_ids": ["F-1", "F-2"],
      "hypothesis": "IDOR exposes billing data",
      "outcome": "confirmed",
      "impact": "Victim invoice and plan data readable"
    }

JSON example

## Every chain attempt is recorded.

Confirmed, denied, blocked, and not-applicable outcomes all matter.

Why it matters Bob records negative results too
Hacker Bob
05

Pipeline step

VERIFY

Bob tries to kill weak bugs before they reach the report.

Phase 5 of 7 Output: verification rounds
Hacker Bob

Phase 5: VERIFY

## Most weak bugs should die here.

Bob argues with itself before it writes anything report-like.

Findings
Brutalist review
Balanced review
Final replay
Reportable survivors
Verification flow Skeptical first, balanced second, final replay last
Hacker Bob

Verification system

## Three agents challenge the same findings.

1 Brutalist Try to kill it

Skeptical replay. Deny weak proof and downgrade loose severity.

2 Balanced Catch mistakes

Review brutalist decisions for false negatives and over-corrections.

3 Final replay Fresh proof only

Re-run reportable survivors with fresh requests before evidence collection.

Artifacts brutalist.json -> balanced.json -> verified-final.json
Hacker Bob

JSON example

## Final verification decides survivors.

Only final reportable findings move into evidence collection.

Example: verified-final.json simplified

    {
      "round": "final",
      "results": [
        {
          "finding_id": "F-1",
          "status": "confirmed",
          "reportable": true,
          "confidence": "high"
        }
      ]
    }

Gate No final reportable finding, no evidence requirement
Hacker Bob

Evidence

A report needs receipts.

Bob collects bounded, redacted evidence packs for final reportable findings.

redacted bounded per finding required before grade
Output evidence-packs.json
Hacker Bob
Example: evidence-packs.json simplified

    {
      "packs": [
        {
          "finding_id": "F-1",
          "sample_count": 3,
          "redacted": true,
          "summary": "3 victim invoices readable"
        }
      ]
    }

JSON example

## Evidence is separate from the finding.

That keeps the report grounded in replayable proof, not just agent notes.

Safety Secrets and auth material are redacted
Hacker Bob
06

Pipeline step

GRADE

Bob decides whether the result is ready, needs more work, or should be skipped.

Phase 6 of 7 Output: grade.json
Hacker Bob

Phase 6: GRADE

## Bob makes a quality decision.

The verdict is simple: submit, hold, or skip.

SUBMIT
Ready

Verified, evidenced, and worth reporting.

HOLD
Needs more work

Return to hunting with feedback.

SKIP
Not reportable

Close out with durable reasoning.

Output grade.json
Hacker Bob

JSON example

## The grade explains the decision.

Bob does not just say yes or no. It records why.

Example: grade.json simplified

    {
      "verdict": "SUBMIT",
      "total_score": 82,
      "finding_ids": ["F-1"],
      "reason": "Confirmed IDOR with evidence"
    }

Decision artifact Used by the report writer
Hacker Bob
07

Pipeline step

REPORT

Bob writes the final output from verified, evidenced, graded data.

Phase 7 of 7 Output: report.md
Hacker Bob

Phase 7: REPORT

The report is the last step, not the first draft.

It is built from final verification, evidence packs, chain attempts, and grade verdict.

Output report.md
Hacker Bob

Why Bob stays coherent

## Guardrails are built into the workflow.

Hooks Write guard

Agents cannot directly edit MCP-owned state files.

Gates Phase rules

Bob cannot skip required artifacts and evidence.

Telemetry Debug trail

Status and debug commands show what got stuck.

Reliability model Constraints make autonomy inspectable
Hacker Bob

Operational visibility

## Bob can explain where it is stuck.

Status and debug commands read telemetry and artifacts instead of guessing from chat history.

/bob-status Where are we?

Phase, wave, findings, evidence, grade, and next command.

/bob-debug What went wrong?

Stale waves, missing handoffs, failed tools, policy stalls, and report trust.

Debug model Telemetry first, artifacts second
Hacker Bob

Important boundary

## Bob automates work. The human owns authorization.

Bob can send requests, use accounts, and prepare reports. The operator decides scope and submission.

### Bob handles

- Workflow
- Agents
- Evidence
- Reports

### Operator owns

- Authorization
- Scope rules
- Data handling
- Submission

Event wording Authorized testing only
Hacker Bob

Set expectations

Bob is not magic authorization.

It is disciplined automation for targets, accounts, and methods the operator is allowed to test.

not auto-submit not scope approval not a replacement for judgment
Clear boundary Human judgment stays in the loop
Hacker Bob

How it is installed

## Bob installs into one Claude Code project.

The package copies commands, agents, hooks, settings, and the local MCP runtime.

Install and run high level

    npx -y hacker-bob-cc@latest install /path/to/project
    hacker-bob doctor /path/to/project

    # inside Claude Code
    /bob-hunt target.com

Canonical package hacker-bob-cc
Hacker Bob

Recap

6

things to remember

Pipeline Context budget MCP memory Agents Evidence gates Human control

github.com/vmihalis/hacker-bob

Closing slide Scan for the repo and install notes
Arrow keys, space, F for fullscreen