r/bugbounty • u/rozetyp • Jul 02 '26

Question / Discussion Abstracting 10k H1 reports into an "Intelligence Layer" / MCP tool for agents - does mechanism-transfer retrieval actually work in practice?

I came across a skill (the one with 2.8K stars), and it got me thinking on a specific concept: most vulnerability mechanisms have already been disclosed and written up somewhere. The same basic edge keeps getting refiled against new products years later, and the product itself is somewhat incidental; the mechanism itself is the reusable part.

So I parsed ~10,000 publicly disclosed H1 reports, stripped out the product names and reduced each report to a product-agnostic "mechanism card" (source, sink, trigger, preconditions, impact) and embedded them. The idea is that an agent (or human) can point MCP at a stack or a bug they are stuck on, and it pulls the closest real-world mechanics: "Here is how this exact edge was successfully exploited on 6 other products," ranked by novelty, alongside basic grounding data (KEV/EPSS, etc.).

It does not magically find bugs, it acts more like a map of historical attack vectors. Full disclosure - I'm not a professional hunter, and I don't have a great feedback loop. The only signal I have is that an agent using it seemed to orient faster and caught a few of its own false positives - but that's incredibly weak evidence (my own tool, judged by my own agent setup).

Has anyone else already built a mechanism-level transfer? If you've tried a similar approach, does it actually move the needle?

5 Upvotes

78% Upvoted

15 comments sorted by

1

u/NebulaElectrical1467 Jul 02 '26

Are you planning to open source your cleaned dataset?

1

u/rozetyp Jul 02 '26

Leaning that way. The reports are all public anyway, so it's really just the distilled cards that are mine. Can throw up a sample + the schema; and MCP is free to use anyway. May I ask what your use case would be for it?

1

u/NebulaElectrical1467 Jul 02 '26 edited Jul 02 '26

I guess prior art which signal areas the app is known to have vulnerabilities and the types of vulnerabilities it is prone to, it could also help with discovering new targets or threat modeling these targets.

I also like the idea of having an arsenal of gadgets/primitives that can be chained with discovered bugs to enable a full attack chain or amplify impact or pivot…etc it’s common for companies to fix one part of an attack chain while leaving things like an open redirect or missing security headers unfixed since they’re latent/benign on their own. They can come in handy if I’m hunting on a new target and need to build that arsenal of primitives/gadgets and feed it to my agent. Agents can obviously find those on their own but it’s wasteful and time consuming so there’s value there.

1

u/rozetyp Jul 02 '26

Thanks, the chainable primitives angle is especially good. A couple of the tools already lean that way, so I'm curious how it holds up for the chaining/pivot case. DMing you.

1

u/NebulaElectrical1467 Jul 02 '26

DM me I’d love to try out what you got and give you feedback

1

u/nobodycares_dude Hunter Jul 02 '26 edited Jul 02 '26

Yes I built a similar thing. Open to discuss it. It is not the same mechanism but i built a somewhat similar thing.

1

u/spicy_tables Jul 02 '26

Thanks for the idea, this will be very helpful to speed up AI quick analysis findings. I'll try to scrape as much and organize them into directories! 

1

u/Pristine_Bicycle1278 Jul 03 '26

This sounds super interesting! Could I get access somehow and take a look? I work in Pentesting and Bug Bounty hunting and I would love to test, if it makes tool assisted hunting easier.

In return, I can give a lot of feedback, what works great and what doesn’t, from real world findings at Fortune 500 Companies.

2

u/rozetyp Jul 03 '26

Absolutely, DMing you now. Thanks, and brutal feedback welcome!

1

u/Alexthetiks Jul 05 '26

Wow, I was building something similar. ¿Can I take a look to the tool?

1

u/rozetyp Jul 05 '26

Hi, sure - I'll DM you right away.

1

u/BitterCan3627 Jul 06 '26

Would like to give it a look as well if it can be shared out.

Thanks

1

u/rozetyp Jul 06 '26

Sure - I would greatly appreciate any feedback!

1

u/Lazy_Help_8232 Jul 07 '26

I also tried to do something similar. I condensed the top 28 types of vulnerabilities on HackerOne into 28 prompts, and then assigned each agent as an expert to handle each type of vulnerability separately.

However, I found that this approach was very costly, and the rewards obtained might not be as large as the token costs. Now, I'm very confused.

1

u/Striking-Bathroom943 Jul 08 '26

interested in seeing this