@bbradar/mcp 0.1.16 → 0.1.19

package/dist/server.js

@@ -34,9 +34,31 @@ const STALE_PROGRAM_ID_RESOLVE_PAGES = 1;
 const STALE_PROGRAM_ID_RESOLVE_BUDGET = 8;
 const PROGRAM_FALLBACK_CACHE_MAX_ENTRIES = 200;
 const MAX_RESOLVE_SEARCH_QUERIES = 4;
-const MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS = 8;
+const MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS = 96;
 const SDK_VERSION = "1.29.0";
-const PROGRAM_ID_PLATFORM_GUESSES = ["HackerOne", "Bugcrowd", "Intigriti", "HackenProof", "YesWeHack", "Cantina", "Code4rena", "Immunefi"];
+const PROGRAM_ID_PLATFORM_GUESSES = [
+    "HackerOne",
+    "BugCrowd",
+    "Intigriti",
+    "HackenProof",
+    "YesWeHack",
+    "Immunefi",
+    "Cantina",
+    "Code4rena",
+    "Huntr",
+    "GObugfree",
+    "Bug Bounty Switzerland",
+    "Inspectiv",
+    "Compass Security",
+    "BugRap",
+    "IssueHunt",
+    "PatchDay",
+    "Remedy",
+    "Standoff365",
+    "Sherlock",
+    "CodeHawks"
+];
+const PRIMARY_PROGRAM_ID_PLATFORM_GUESSES = PROGRAM_ID_PLATFORM_GUESSES.slice(0, 8);
 const WEB3_TAGS = ["web3", "crypto", "blockchain", "smart-contract", "smart contract", "defi", "nft", "ethereum", "solana", "solidity"];
 const WEB3_CONTEST_SIGNALS = ["contest", "audit", "competitive", "code4rena", "sherlock", "cantina", "codehawks", "hats", "spearbit", "warden"];
 const VDP_SIGNALS = ["vdp", "disclosure", "responsible disclosure", "vulnerability disclosure", "no bounty", "non-bounty", "no reward"];
@@ -150,7 +172,7 @@ function stringListSchema(description = "Optional filter values. Empty or omitte
         .describe(description);
 }
 function platformListSchema() {
-    return stringListSchema("Optional platform filters such as HackerOne, Bugcrowd, Intigriti, or HackenProof. Empty or omitted means all platforms.");
+    return stringListSchema("Optional platform filters such as HackerOne, BugCrowd, Intigriti, HackenProof, Immunefi, YesWeHack, Cantina, or GObugfree. Empty or omitted means all platforms.");
 }
 function tagListSchema() {
     return stringListSchema("Optional combined scope/language/target-type tags. Empty or omitted means all tags.");
@@ -206,7 +228,7 @@ const programIdSchema = z
     .trim()
     .min(3)
     .max(256)
-    .regex(/^[A-Za-z0-9_-]+:[^?#]+$/, "Use platform:handle, for example HackerOne:example-handle.")
+    .regex(/^[^:/?#\u0000-\u001F\u007F]+:[^?#\u0000-\u001F\u007F]+$/, "Use platform:handle, for example HackerOne:example-handle.")
     .refine((value) => !/[\u0000-\u001F\u007F]/.test(value), {
     message: "program_id cannot contain control characters."
 })
@@ -3162,7 +3184,8 @@ async function findProgramsByTarget(client, config, input) {
         budget,
         warnings,
         source: "target_query_program_id_guess",
-        maxProgramIds: 1,
+        maxProgramIds: queryLooksLikeTargetIdentifier(input.target_query) || looksLikeDirectProgramHandleQuery(input.target_query) ? MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS : 4,
+        maxHandleVariants: 1,
         stopOnFirstMatch: true
     });
     sourceRequests.push(...directHandles.sourceRequests);
@@ -5346,7 +5369,8 @@ function programResolutionMatch(candidate, query) {
     };
 }
 function hasHighConfidenceProgramResolutionMatch(programs, webBaseUrl, query) {
-    return programs.some((program) => programResolutionMatch(toProgramCandidate(program, webBaseUrl), query).score >= 85);
+    const threshold = looksLikeDirectProgramHandleQuery(query) ? 95 : 85;
+    return programs.some((program) => programResolutionMatch(toProgramCandidate(program, webBaseUrl), query).score >= threshold);
 }
 function bestProgramResolutionScore(programs, webBaseUrl, query) {
     return programs.reduce((best, program) => Math.max(best, programResolutionMatch(toProgramCandidate(program, webBaseUrl), query).score), 0);
@@ -5357,6 +5381,7 @@ function programResolutionSearchQueries(query) {
 function programResolutionQueryVariants(query) {
     const normalized = normalizeTag(query);
     const meaningfulTokens = [...meaningfulProgramQueryTokens(query)];
+    const searchTokens = meaningfulTokens.filter((token) => token.length >= 3);
     const meaningfulPhrase = meaningfulTokens.join(" ");
     const singleTokenNameVariants = meaningfulTokens.length === 1
         ? [
@@ -5370,7 +5395,7 @@ function programResolutionQueryVariants(query) {
         normalized,
         meaningfulPhrase,
         meaningfulTokens.join("-"),
-        ...meaningfulTokens,
+        ...searchTokens,
         ...singleTokenNameVariants
     ];
     return uniqueStrings(values.filter((value) => value.length >= 2));
@@ -5598,15 +5623,18 @@ async function collectProgramsForResolution(client, options) {
     const collections = [];
     const queryCollections = [];
     const queries = options.searchQueries.length > 0 ? options.searchQueries : [undefined];
-    const primaryDirectProgramIds = new Set(directProgramIdCandidates(options.query, options.platforms).slice(0, 1));
+    const primaryDirectPlatforms = options.platforms.length > 0 ? options.platforms : PRIMARY_PROGRAM_ID_PLATFORM_GUESSES;
+    const primaryDirectProgramIds = new Set(directProgramIdCandidates(options.query, primaryDirectPlatforms, { maxHandleVariants: 1 }));
     if (primaryDirectProgramIds.size > 0 && options.budget.remaining > 0) {
         const primaryDirectHandles = await collectDirectHandlePrograms(client, {
             query: options.query,
-            platforms: options.platforms,
+            platforms: primaryDirectPlatforms,
             budget: options.budget,
             warnings: options.warnings,
             source: "program_id_handle_guess",
-            maxProgramIds: 1,
+            maxProgramIds: MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS,
+            maxHandleVariants: 1,
+            acceptEmptyTargetsAsPrograms: true,
             stopOnFirstMatch: true
         });
         if (primaryDirectHandles.programs.length > 0 || primaryDirectHandles.requestsScanned > 0) {
@@ -5645,6 +5673,8 @@ async function collectProgramsForResolution(client, options) {
             warnings: options.warnings,
             source: "program_id_handle_guess",
             skipProgramIds: primaryDirectProgramIds,
+            maxHandleVariants: 4,
+            acceptEmptyTargetsAsPrograms: true,
             stopOnFirstMatch: true
         });
         if (directHandles.programs.length > 0 || directHandles.requestsScanned > 0) {
@@ -5715,28 +5745,32 @@ function mergeProgramCollections(collections) {
     };
 }
 async function collectDirectHandlePrograms(client, options) {
-    const programIds = directProgramIdCandidates(options.query, options.platforms)
+    const programIds = directProgramIdCandidates(options.query, options.platforms, { maxHandleVariants: options.maxHandleVariants })
         .filter((programId) => !options.skipProgramIds?.has(programId))
         .slice(0, options.maxProgramIds ?? MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS);
     const programs = [];
     const sourceRequests = [];
     let requestsScanned = 0;
     for (const programId of programIds) {
-        if (!tryConsumeBudget(options.budget)) {
-            break;
-        }
         requestsScanned += 1;
         try {
-            const api = await client.getProgram(programId);
-            programs.push(api.data);
+            const targetsApi = await client.getProgramTargets(programId);
+            const targetsData = readObject(targetsApi.data);
+            const hasTargetsArray = Array.isArray(targetsData?.targets);
+            const targets = readArray(targetsData?.targets).map(sanitizeTarget);
+            const programEndpointExists = targets.length > 0 || (options.acceptEmptyTargetsAsPrograms === true && hasTargetsArray);
+            if (programEndpointExists) {
+                programs.push(syntheticProgramFromProgramId(programId, targets));
+            }
             sourceRequests.push({
                 source: options.source,
+                endpoint: "program_targets",
                 program_id: programId,
-                request_id: api.requestId,
-                upstream_request_id: api.upstreamRequestId,
-                ...apiSourceMetadata(api)
+                request_id: targetsApi.requestId,
+                upstream_request_id: targetsApi.upstreamRequestId,
+                ...apiSourceMetadata(targetsApi)
             });
-            if (options.stopOnFirstMatch) {
+            if (programEndpointExists && options.stopOnFirstMatch) {
                 break;
             }
         }
@@ -5744,49 +5778,12 @@ async function collectDirectHandlePrograms(client, options) {
             if (error instanceof BBRadarApiError && error.status === 404) {
                 sourceRequests.push({
                     source: options.source,
-                    endpoint: "program_detail",
+                    endpoint: "program_targets",
                     program_id: programId,
                     request_id: error.requestId,
                     upstream_request_id: error.upstreamRequestId,
                     status: error.status
                 });
-                if (!tryConsumeBudget(options.budget)) {
-                    break;
-                }
-                requestsScanned += 1;
-                try {
-                    const targetsApi = await client.getProgramTargets(programId);
-                    const targetsData = readObject(targetsApi.data);
-                    const targets = readArray(targetsData?.targets).map(sanitizeTarget);
-                    if (targets.length > 0) {
-                        programs.push(syntheticProgramFromProgramId(programId, targets));
-                    }
-                    sourceRequests.push({
-                        source: options.source,
-                        endpoint: "program_targets",
-                        program_id: programId,
-                        request_id: targetsApi.requestId,
-                        upstream_request_id: targetsApi.upstreamRequestId,
-                        ...apiSourceMetadata(targetsApi)
-                    });
-                    if (targets.length > 0 && options.stopOnFirstMatch) {
-                        break;
-                    }
-                }
-                catch (targetError) {
-                    if (targetError instanceof BBRadarApiError && targetError.status === 404) {
-                        sourceRequests.push({
-                            source: options.source,
-                            endpoint: "program_targets",
-                            program_id: programId,
-                            request_id: targetError.requestId,
-                            upstream_request_id: targetError.upstreamRequestId,
-                            status: targetError.status
-                        });
-                        continue;
-                    }
-                    throw targetError;
-                }
                 continue;
             }
             throw error;
@@ -5804,11 +5801,12 @@ function syntheticProgramFromProgramId(programId, targets) {
     const separatorIndex = programId.indexOf(":");
     const platform = separatorIndex >= 0 ? programId.slice(0, separatorIndex) : undefined;
     const handle = separatorIndex >= 0 ? programId.slice(separatorIndex + 1) : programId;
+    const displayHandle = handle.split("/").filter(Boolean).at(-1) ?? handle;
     const scopeTags = uniqueStrings(targets.flatMap((target) => readStringArrayField(target, "scope_tags")));
     return stripUndefined({
         id: programId,
         handle,
-        name: titleizeProgramHandle(handle),
+        name: titleizeProgramHandle(displayHandle),
         platform,
         scope_tags: scopeTags,
         target_counts: {
@@ -5827,38 +5825,75 @@ function titleizeProgramHandle(handle) {
         .map((part) => part.slice(0, 1).toUpperCase() + part.slice(1))
         .join(" ");
 }
-function directProgramIdCandidates(query, platforms) {
+function directProgramIdCandidates(query, platforms, options = {}) {
     const platformGuesses = (platforms.length > 0 ? platforms : PROGRAM_ID_PLATFORM_GUESSES).map(canonicalProgramIdPlatform);
-    const handles = directProgramHandleVariants(query);
-    return uniqueStrings(platformGuesses.flatMap((platform) => handles.map((handle) => `${platform}:${handle}`))).slice(0, MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS);
+    const handles = directProgramHandleVariants(query).slice(0, options.maxHandleVariants ?? Number.POSITIVE_INFINITY);
+    return uniqueStrings(handles.flatMap((handle) => platformGuesses.flatMap((platform) => normalizeTag(platform) === "bugcrowd"
+        ? [`${platform}:engagements/${handle}`, `${platform}:${handle}`]
+        : [`${platform}:${handle}`]))).slice(0, MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS);
 }
 function canonicalProgramIdPlatform(platform) {
     const normalized = normalizeTag(platform).replace(/[^a-z0-9]/g, "");
     const knownPlatforms = {
         hackerone: "HackerOne",
-        bugcrowd: "Bugcrowd",
+        bugcrowd: "BugCrowd",
         intigriti: "Intigriti",
         hackenproof: "HackenProof",
         yeswehack: "YesWeHack",
+        immunefi: "Immunefi",
         cantina: "Cantina",
         code4rena: "Code4rena",
-        immunefi: "Immunefi"
+        huntr: "Huntr",
+        gobugfree: "GObugfree",
+        bugbountyswitzerland: "Bug Bounty Switzerland",
+        inspectiv: "Inspectiv",
+        compasssecurity: "Compass Security",
+        bugrap: "BugRap",
+        issuehunt: "IssueHunt",
+        patchday: "PatchDay",
+        remedy: "Remedy",
+        standoff365: "Standoff365",
+        sherlock: "Sherlock",
+        codehawks: "CodeHawks"
     };
     return knownPlatforms[normalized] ?? platform.trim();
 }
 function directProgramHandleVariants(query) {
     const handleText = query.includes(":") ? query.slice(query.indexOf(":") + 1) : query;
     const normalized = normalizeTargetIdentifierForMatch(handleText);
+    const literal = directProgramLiteralHandleVariant(handleText);
     const dashed = normalized.replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
     const compact = dashed.replace(/-/g, "");
     const tokens = [...meaningfulProgramQueryTokens(handleText)];
-    return uniqueStrings([
-        ...targetBrandTokens(handleText),
-        dashed,
-        compact,
-        tokens.join("-"),
-        tokens.join("")
-    ]).filter((handle) => /^[a-z0-9][a-z0-9_.-]{3,100}$/i.test(handle));
+    const brandTokens = targetBrandTokens(handleText);
+    const literalVariants = [literal, dashed, compact, tokens.join("-"), tokens.join("")];
+    const values = queryLooksLikeTargetIdentifier(handleText) ? [...brandTokens, ...literalVariants] : [...literalVariants, ...brandTokens];
+    return uniqueStrings(values).filter(isDirectProgramHandleVariant);
+}
+function looksLikeDirectProgramHandleQuery(query) {
+    const handleText = query.includes(":") ? query.slice(query.indexOf(":") + 1) : query;
+    return isDirectProgramHandleVariant(directProgramLiteralHandleVariant(handleText));
+}
+function directProgramLiteralHandleVariant(value) {
+    const normalized = value
+        .trim()
+        .replace(/\\/g, "/")
+        .replace(/^['"`<]+|['"`>]+$/g, "")
+        .replace(/^[a-z][a-z0-9+.-]*:\/\//i, "")
+        .replace(/^www\./i, "");
+    const queryStart = normalized.search(/[?#]/);
+    return (queryStart >= 0 ? normalized.slice(0, queryStart) : normalized).replace(/\/+$/, "");
+}
+function isDirectProgramHandleVariant(value) {
+    if (!value) {
+        return false;
+    }
+    if (value.length < 2 || value.length > 150 || /[\u0000-\u001F\u007F?#:]/.test(value)) {
+        return false;
+    }
+    return value
+        .split("/")
+        .every((segment) => segment.length > 0 && segment !== "." && segment !== ".." && !/^[\s.]+$/.test(segment));
 }
 async function collectProgramSources(client, sources, options) {
     const pages = [];
@@ -6633,7 +6668,7 @@ function targetMatchesQuery(target, query, mode) {
     }
     return (containsMatch ||
         profile.values.some((value) => queryValues.some((queryValue) => targetSuffixMatch(value, queryValue) || targetWildcardMatch(value, queryValue))) ||
-        targetTokensMatch(profile.tokens, query));
+        (!queryLooksLikeTargetIdentifier(query) && targetTokensMatch(profile.tokens, query)));
 }
 function upstreamTargetMatchMode(mode) {
     return mode === "smart" ? "contains" : mode;
@@ -6671,7 +6706,11 @@ function targetSearchProfile(target) {
     };
 }
 function targetQueryVariants(query) {
-    return targetStringVariants(query);
+    const variants = targetStringVariants(query);
+    if (!queryLooksLikeTargetIdentifier(query)) {
+        return variants;
+    }
+    return variants.filter(targetValueCanContainQuery);
 }
 function targetApiSearchQueries(query) {
     const normalized = normalizeTargetIdentifierForMatch(query);