bountyoperator/bounty-operator

**Find the hole in your report before the triager does.**
Bounty Operator argues against your bug bounty report before you submit it.
Give it the draft and the code it cites. It checks every claim against the
code, the way a triager will, and you get one verdict: submit,
rewrite-then-submit, prove-first, hold-duplicate or drop. It runs on
your own model: in the browser, in your coding agent over MCP, or from the
command line.
Start a free review at bountyoperator.com
- **Every claim tied to file and line.** Findings cite input-1/src/Vault.sol:142-158.
A reference to a file or line you did not supply is flagged. Each review
downloads as a packet with a SHA-256 manifest of exactly what was reviewed.
- **The triager's objection first.** Each finding carries its strongest
counterargument, whether the source resolves it, and the one missing artifact
that would settle it.
- **Your model and your key. Nothing is stored.** OpenRouter, Anthropic, OpenAI,
Gemini, xAI, DeepSeek, Mistral, Groq, Infron, OrcaRouter or Bounty Operator with your own key. A hosted review
passes your files and your key through bountyoperator.com to that provider.
Source files, keys and review text are never stored.
Quick start
Browser
Open bountyoperator.com and run the built-in
example. No account, no API key.
Hosted model API
Use the cyber-model API pilot from
Chat Completions clients at https://bountyoperator.com/v1. Sign in, add
prepaid credit, and create an expiring key with its own spending limit.
The live catalog lists the model, exact revision, rates and limits. The monthly
Operator plan includes US$2 API credit per paid month; you can also buy prepaid
credit without a subscription. Auto top-ups are off by default and require opt-in.
Deployment and payment verification: hosted API operations.
MCP
Run reviews from Claude Code, Codex, Cursor or any MCP client. The remote
endpoint needs nothing installed.
Claude Code:
Codex:
Cursor, in ~/.cursor/mcp.json:
The local server reads files by path and keeps review preparation on your
machine. It needs Node 22 or later:
The package is coming to npm as bounty-operator-mcp. Until then the tarball
above is the install, and its SHA-256 is at
bountyoperator.com/dl/SHA256SUMS.txt.
The remote endpoint has five tools and the local server six.
list_profiles, prepare_review and build_packet need no account, and
neither does the local server's run_gauntlet_plan. prepare_review takes
the three core profiles and your agent's own model writes the review. A
connection token from the account panel adds run_review and account.
run_review runs any profile as a hosted review and is the only way to run a
hosted one: prepare_review refuses it with hosted_profile. Token setup for
each client: bountyoperator.com/mcp and
mcp/README.md.
CLI
Python 3.10 or newer. No dependencies.
Hand agent-pack.md to your AI agent with the scope, the known issues and the
current commit. The CLI reference covers the other commands.
Review profiles
Pick one profile per review. Each returns the same structure: verdict, findings
with references, counterarguments, evidence gaps, and what was checked and found
safe.
| Profile | What you get | Runs |
| --- | --- | --- |
| **Code security review** | Findings in any language, each with the path from entry point to impact in concrete values. | Core |
| **Solidity review** | Entry points, invariants, and the accounting, access-control and external-call paths that break them. | Core |
| **Challenge a draft report** | Every claim in your draft checked against the code. Claims the source does not support are listed. | Core |
| **Scope and impact fit** | The asset, the revision, the exclusions and the impact row, clause by clause. | Hosted |
| **Design intent and actors** | Who performs each step, and whether the project meant the behaviour. | Hosted |
| **Prior-art overlap** | Your finding compared with the audits and known issues you supply: same root cause, or only the same symptom. | Hosted |
| **Proof review** | Whether the proof shows the impact and not only the defect. | Hosted |
| **Severity calibration** | One level, graded on the programme's own severity table. | Hosted |