h1-brain MCP — 使用場景, 安裝 & 即時演示

為什麼要用

核心特性

hack(handle) generates one-shot attack briefings with scope, patterns, and vectors
Dual databases: personal bounty history + 3,600+ public disclosures
Search your own rewarded reports, program scopes, and attachments
Search across publicly disclosed HackerOne reports for vulnerability patterns
Real-time scope fetching from HackerOne API

即時演示

實際使用效果

h1-brain.replay ▶ 就緒

0/0

安裝

選擇你的客戶端

~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "h1-brain": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/PatrikFehrenbach/h1-brain"
      ]
    }
  }
}

開啟 Claude Desktop → Settings → Developer → Edit Config。儲存後重啟應用。

~/.cursor/mcp.json · .cursor/mcp.json

{
  "mcpServers": {
    "h1-brain": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/PatrikFehrenbach/h1-brain"
      ]
    }
  }
}

Cursor 使用與 Claude Desktop 相同的 mcpServers 格式。專案級設定優先於全域。

VS Code → Cline → MCP Servers → Edit

{
  "mcpServers": {
    "h1-brain": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/PatrikFehrenbach/h1-brain"
      ]
    }
  }
}

點擊 Cline 側欄中的 MCP Servers 圖示，然後選 "Edit Configuration"。

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "h1-brain": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/PatrikFehrenbach/h1-brain"
      ]
    }
  }
}

格式與 Claude Desktop 相同。重啟 Windsurf 生效。

~/.continue/config.json

{
  "mcpServers": [
    {
      "name": "h1-brain",
      "command": "TODO",
      "args": [
        "See README: https://github.com/PatrikFehrenbach/h1-brain"
      ]
    }
  ]
}

Continue 使用伺服器物件陣列，而非映射。

~/.config/zed/settings.json

{
  "context_servers": {
    "h1-brain": {
      "command": {
        "path": "TODO",
        "args": [
          "See README: https://github.com/PatrikFehrenbach/h1-brain"
        ]
      }
    }
  }
}

加入 context_servers。Zed 儲存後熱重載。

claude mcp add h1-brain -- TODO 'See README: https://github.com/PatrikFehrenbach/h1-brain'

一行命令搞定。用 claude mcp list 驗證，claude mcp remove 移除。

使用場景

實戰用法： h1-brain

Generate an attack briefing for an authorized bug bounty program

👤 Bug bounty hunters working on authorized HackerOne programs ⏱ ~15 min intermediate

何時使用： You're starting work on a new bug bounty target and want a strategic overview.

前置條件

HackerOne API token — Generate at hackerone.com/settings/api_token
h1-brain installed and databases populated — Clone, install, run fetch_rewarded_reports to populate personal DB

步驟

Generate the briefing

hack('target-company') — Generate a full attack briefing for this program.✓ 已複製

→ Comprehensive briefing with scope, known weakness patterns, untouched assets, and suggested attack vectors
Cross-reference with disclosures

Search disclosed reports for this company. What vulnerability types have been found before?✓ 已複製

→ List of disclosed vulnerabilities with types and bounty amounts

結果： A strategic attack plan based on historical data and current scope.

注意事項

Stale scope data — The tool fetches fresh scope from HackerOne API, but verify on the program page

Analyze your bug bounty track record to find your strengths

👤 Bug bounty hunters optimizing their approach ⏱ ~20 min beginner

何時使用： You want to understand which vulnerability types and programs earn you the most bounties.

前置條件

Personal database populated — Run fetch_rewarded_reports to sync your history

步驟

Review your history

Search my rewarded reports. Group them by vulnerability type and show the total bounty per type.✓ 已複製

→ Breakdown of earnings by vulnerability category
Identify patterns

Which programs am I most successful on? What do they have in common?✓ 已複製

→ Pattern analysis across your most rewarded programs

結果： Insight into your strengths to focus future hunting efforts.

注意事項

Old reports may not reflect current program scope — Re-fetch program scopes to get current assets

組合

與其他 MCP 搭配，撬動十倍槓桿

h1-brain + filesystem

Save attack briefings and reports to organized files for each program

Generate an attack briefing for target-company and save it as ~/bounty/target-company/briefing.md.✓ 已複製

工具

此 MCP 暴露的能力

工具	輸入參數	何時呼叫	成本
hack	handle: str	Generate a comprehensive attack briefing for a HackerOne program	Multiple API calls
search_reports	query?: str	Search your personal rewarded reports	0 (local DB)
search_disclosed_reports	query?: str	Search across 3,600+ public disclosures	0 (local DB)
search_programs	query?: str	Search bug bounty programs	0 (local DB)
fetch_rewarded_reports	none	Sync your HackerOne rewarded reports to local DB	Multiple API calls

成本與限制

運行它的成本

API 配額: HackerOne API rate limits apply during sync and scope fetching
每次呼叫 Token 數: 500–3000 tokens per briefing
費用: Free — HackerOne API access is free with your account
提示: Populate the local databases once, then queries are free and instant. Re-sync periodically.

安全

權限、密鑰、影響範圍

最小權限： HackerOne API token with read access

憑證儲存： API token in environment variable or Claude Desktop config

資料出站： API calls to HackerOne during sync and scope fetching. Local DB queries have no network calls.

⚠ This tool is designed for authorized security research, CTF competitions, and defensive analysis only. Do not use it against systems you don't own or have written authorization to test.
Only target programs that are active on HackerOne and within their defined scope.
Your HackerOne API token grants access to your account data. Keep it secure.

故障排查

常見錯誤與修復

Empty personal database

Run fetch_rewarded_reports first to populate your local database from HackerOne.

驗證： Check that h1_data.db file exists and has data

HackerOne API authentication failed

Verify your API token is valid and hasn't expired. Generate a new one at hackerone.com/settings/api_token.

驗證： curl -H 'Authorization: ...' https://api.hackerone.com/v1/me

hack() returns empty briefing

The program handle may be incorrect. Search for the exact handle on HackerOne's directory.

驗證： search_programs to find the correct handle

替代方案

h1-brain 對比其他方案

替代方案	何時用它替代	權衡
hexstrike-ai	You need active security scanning tools rather than HackerOne-specific intelligence	Broader tool coverage but no HackerOne integration or report history

h1-brain

為什麼要用

核心特性

即時演示

實際使用效果

安裝

選擇你的客戶端

使用場景

實戰用法： h1-brain

Generate an attack briefing for an authorized bug bounty program

前置條件

步驟

注意事項

Analyze your bug bounty track record to find your strengths

前置條件

步驟

注意事項

組合

與其他 MCP 搭配，撬動十倍槓桿

工具

此 MCP 暴露的能力

成本與限制

運行它的成本

安全

權限、密鑰、影響範圍

故障排查

常見錯誤與修復

替代方案

h1-brain 對比其他方案

更多

資源