API & MCP

Read-only, no auth, CORS enabled (*), soft-limited to 120 requests / minute / client. Responses are cached 60s. Disclosure endpoints return factual metadata + a short excerpt and a link to the canonical source — never the full researcher-authored body.

REST endpoints

Method	Path	Purpose
GET	/api/reports	Search disclosures (filters + sort + paging)
GET	/api/reports/{id}	One record by id
GET	/api/knowledge	Full-text search of the knowledge base
GET	/api/knowledge/{id}	One passage by id
GET	/api/knowledge/sources	Every document (source, category, passage count) — powers `/kb`
GET	/api/stats	Aggregate stats + facets
GET	/api/tags	Vulnerability-class taxonomy (reports + knowledge counts)
GET/POST	/api/mcp	Model Context Protocol (Streamable HTTP)

GET /api/reports

Query parameters:

Param	Type	Notes
`q`	string	Full-text (title, program, weakness, reporter, excerpt). Prefix match on last term.
`platform`	string	HackerOne · Bugcrowd · Code4rena · Immunefi · Intigriti · YesWeHack
`severity`	string	Critical · High · Medium · Low · None · Informational
`class`	string	Weakness / vulnerability class
`program`, `researcher`, `kind`	string	Exact (case-insensitive)
`tag`	string	Vulnerability-class slug (ssrf, xss, idor, rce, auth, …) — see `/api/tags`
`kev`	bool	`1` = only reports referencing a CVE in CISA’s Known Exploited Vulnerabilities catalogue
`year`	int	Disclosure year
`sort`	string	`relevance` (default with q) · `date` · `bounty` · `votes` · `cvss` · `epss` (most likely exploited) · `alpha`
`limit`	int	1–120, default 25
`offset`	int	Pagination; response carries `next_offset`

Example:

curl "https://YOUR-DOMAIN/api/reports?q=ssrf+aws+metadata&severity=High&sort=bounty&limit=5"

Response shape:

{
  "query": { "q": "ssrf aws metadata", "severity": "High", ... },
  "total": 42,
  "count": 5,
  "limit": 5,
  "offset": 0,
  "next_offset": 5,
  "results": [
    {
      "id": "h1-1087489",
      "platform": "HackerOne",
      "title": "…",
      "program": "…",
      "severity": "High",
      "cvss": 8.6,
  "kev": true,
  "epss": 0.94021,
  "epssPct": 0.99,
  "cwe": ["CWE-918"],
  "nvdCvss": 9.1,
  "analysis": {
    "classes": [{ "slug": "ssrf", "label": "Server-Side Request Forgery (SSRF)" }],
    "mechanism": "The server fetches a URL built from unvalidated user input, letting an attacker reach internal services or cloud metadata endpoints.",
    "cwe": ["CWE-918"],
    "owasp": ["OWASP API Security Top 10 API7:2023 SSRF"]
  },
      "weakness": "Server-Side Request Forgery (SSRF)",
      "bounty": 4000,
      "votes": 57,
      "reporter": "…",
      "cves": ["CVE-2023-…"],
      "disclosed_at": "2023-05-01",
      "source_url": "https://hackerone.com/reports/1087489",
      "snippet": "…short excerpt…",
      "license": "Public disclosure — metadata & excerpt only",
      "attribution": "…"
    }
  ]
}

Every record carries analysis — a rule-based technical summary (vulnerability class, mechanism sentence, CWE, OWASP reference) derived only from the weakness/title/excerpt already shown, never the full report. /api/reports/{id} additionally embeds cveDetails: per-CVE intel merged from NVD (CWE, CVSS vector, description, references) and CISA KEV (exploited status, due date, vendor/product, known ransomware use).

GET /api/knowledge

Full-text search of permissively-licensed material (OWASP WSTG / Cheat Sheets / API Security, PayloadsAllTheThings, HowToHunt, CISA KEV). Full passages are returned with id (for /api/knowledge/{id} and the web UI’s /knowledge/{id} page), license and attribution.

curl "https://YOUR-DOMAIN/api/knowledge?q=jwt+none+algorithm&k=5"
curl "https://YOUR-DOMAIN/api/knowledge/42"          # one passage
curl "https://YOUR-DOMAIN/api/knowledge/sources"     # every document, for browsing

Vulnerability-class tags

Every report is auto-tagged with a shared vulnerability-class taxonomy (~33 classes: ssrf, xss, idor, rce, auth, jwt, …) derived from its weakness, title and excerpt. The same tags annotate the knowledge base, so a class links disclosures to the methodology that explains them.

curl "https://YOUR-DOMAIN/api/tags"                       # taxonomy + counts
curl "https://YOUR-DOMAIN/api/reports?tag=ssrf&sort=bounty"  # reports of a class

MCP server (public)

The archive is exposed as a Model Context Protocol server over Streamable HTTP, so any MCP-capable client (Claude, Cursor, Claude Code, VS Code) can query it as a tool. Endpoint:

https://YOUR-DOMAIN/api/mcp

Tools:

Tool	Args	Returns
`search_disclosures`	q, platform?, severity?, program?, year?, tag?, sort?, limit?	disclosure metadata + excerpt + source_url
`get_report`	id	one record (incl. tags)
`search_knowledge`	q, k?	knowledge passages + attribution
`list_tags`	—	taxonomy with reports/knowledge counts
`knowledge_for_tag`	tag, k?	methodology/payloads for a vuln class
`archive_stats`	—	aggregate stats

Add to a client config (e.g. Claude Code / Cursor mcp.json):

{
  "mcpServers": {
    "security-archive": {
      "type": "http",
      "url": "https://YOUR-DOMAIN/api/mcp"
    }
  }
}

Or from the CLI: claude mcp add --transport http security-archive https://YOUR-DOMAIN/api/mcp

Attribution & licensing

Code is MIT. Knowledge passages keep their upstream license (share-alike for OWASP CC BY-SA). Disclosure records are factual metadata + short excerpts linking to the canonical source. Respect each platform's and researcher's rights when reusing.