MCP server for interacting with the Bugcrowd API to manage security programs, reports, submissions, and related resources
Severe quality gaps across all 43 tools. All tools lack input parameter descriptions, the rubric requires every parameter to have a description explaining what it controls. Query parameters are documented only as generic 'Query parameters for filtering X' with no detail on valid fields, formats, or constraints. Data parameters are bare dicts with no schema. No output schemas documented. Descriptions are minimal (10-30 chars) and do not explain WHEN to use each tool or what it returns. No error handling guidance. No tool annotations (readOnlyHint, destructiveHint). Tools are directly exposed API wrappers with no agent-friendly abstraction.
Delete an access invitation by ID.
Delete a customer asset by ID.
Delete an external issue by ID.
Delete a report by ID.
Delete a submission by ID.
Get a specific access invitation by ID.
List all access invitations.
All 43 tools lack input parameter descriptions. Query parameters documented only as generic 'Query parameters for filtering X' with no detail on valid field names, formats, or constraints. Data parameters are bare dicts with no schema.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields (e.g., IDs for chaining). Responses are raw API JSON with no guidance on structure or field meanings.
Tool descriptions are 10-30 characters and lack context. No explanation of WHEN to use each tool, what it returns, or how it differs from similar tools. Descriptions do not state whether tools modify state (create/update/delete).
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 30 | 2026-07-28+ | v2 |
List all authentication logs.
List all authorization logs.
Get a specific customer asset by ID.
List all customer assets.
Get a specific disclosure request by ID.
List all disclosure requests.
Get a specific external issue by ID.
List all external issues.
Get a specific monetary reward by ID.
List all monetary rewards.
Get a specific organization by ID.
List all organizations.
Get a specific payment by ID.
List all payments.
Get a specific program by ID.
List all programs.
Get a specific report by ID.
List all reports.
Get a specific submission by ID.
List all submission activities.
Get a specific submission activity by ID.
Get a specific submission comment by ID.
List all submission comments.
List all submissions.
List all target groups.
Update a customer asset by ID.
Update an external issue by ID.
Update an organization by ID.
Update a report by ID.
Update a submission by ID.
Create a new access invitation.
Create a new customer asset.
Create a new disclosure request.
Create a new external issue.
Create a new report.
Create a new submission.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) present. LLMs cannot distinguish safe reads from destructive operations. Agents may retry delete operations, causing data loss.
No error handling guidance. Tools will fail silently or return raw HTTP errors. No recovery hints (e.g., 'Try search_X() first if you only have a name'). No validation of input constraints.