{
  "openapi": "3.0.1",
  "info": {
    "title": "Hacker Bob Security Evaluator",
    "description": "Authorized-scope autonomous web-app security evaluator (recon, HTTP, headless-browser only) driving the unmodified Hacker Bob MCP engine. Ships a self-contained loopback demo that runs out of the box. Offensive Docker tooling stays dormant; model access is keyless via Apify's OpenRouter proxy.",
    "version": "0.1",
    "x-build-id": "71rJ5d6Hc8X8JawkK"
  },
  "servers": [
    {
      "url": "https://api.apify.com/v2"
    }
  ],
  "paths": {
    "/acts/hacker-bob~hacker-bob-agent/run-sync-get-dataset-items": {
      "post": {
        "operationId": "run-sync-get-dataset-items-hacker-bob-hacker-bob-agent",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    },
    "/acts/hacker-bob~hacker-bob-agent/runs": {
      "post": {
        "operationId": "runs-sync-hacker-bob-hacker-bob-agent",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor and returns information about the initiated run in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/runsResponseSchema"
                }
              }
            }
          }
        }
      }
    },
    "/acts/hacker-bob~hacker-bob-agent/run-sync": {
      "post": {
        "operationId": "run-sync-hacker-bob-hacker-bob-agent",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "inputSchema": {
        "type": "object",
        "properties": {
          "target": {
            "title": "Target URL",
            "type": "string",
            "description": "A URL you are authorized to test: your own running web app, live API, or a PR/code-review URL — not a repository to clone. Hacker Bob evaluates the live surface only (HTTP + headless browser). In this deployment the repo-review and smart-contract/RPC tool families are disabled at the tool layer (BOB_APIFY_WEB_ONLY), so the running session has no path to your source code or an RPC endpoint (see \"I am authorized...\" below). Leave this empty and enable \"Try the built-in demo instead\" to run against a sample target instead of your own."
          },
          "confirmAuthorizedTarget": {
            "title": "I am authorized to security-test this target",
            "type": "boolean",
            "description": "I attest that I own this live target (running app / API / PR surface) or have explicit written authorization to security-test it. Required for any target other than a loopback address — the scope gate fails closed (refuses the run) on any other target left unattested. Not needed when \"Try the built-in demo instead\" is enabled.",
            "default": false
          },
          "useDemoTarget": {
            "title": "Try the built-in demo instead",
            "type": "boolean",
            "description": "Skip pointing this at your own target and run against the Actor's built-in loopback demo fixture instead — a live, self-contained fixture, not a repository — so you can see a sample report with zero setup. Off by default — this Actor is meant to be run against your own authorized live target.",
            "default": false
          },
          "modelProvider": {
            "title": "Model provider",
            "enum": [
              "apify-openrouter",
              "anthropic",
              "openrouter"
            ],
            "type": "string",
            "description": "Where model inference for this run is routed and billed. \"Keyless\" needs no setup and is billed as ordinary Apify platform usage on your Apify account — but on Apify's FREE plan, Apify's own keyless proxy caps each response at 2048 tokens (partial runs). That cap is asserted by Apify's platform, not verified or enforced by this Actor's own code. Use a paid Apify plan or bring your own key for full runs. The other two options use your own API key (see \"Model API key\" below) and are billed directly by that provider instead.",
            "default": "apify-openrouter"
          },
          "modelApiKey": {
            "title": "Model API key",
            "type": "string",
            "description": "Your own API key or token, used ONLY when \"Model provider\" above is set to Anthropic or OpenRouter — ignored (and not needed) for the default keyless option. For Anthropic this accepts either a standard API key or a Claude Code OAuth token (from `claude setup-token`, starting with sk-ant-oat). Stored as a secret input; never logged. Security note: this key is reachable by the autonomous process while it reads and acts on content served by the target you're testing — use a scoped, rotatable key you can revoke independently of your other usage, not a broadly-privileged primary key."
          },
          "model": {
            "title": "Model override",
            "type": "string",
            "description": "Optional model slug override, if you want a specific model instead of the provider's default (e.g. a specific Claude version). Leave blank to use the default for the selected model provider."
          },
          "budget": {
            "title": "Budget (USD)",
            "minimum": 0,
            "maximum": 20,
            "type": "number",
            "description": "Maximum model spend for this run, in US dollars, enforced as a hard cap on the invocation. A higher budget lets the evaluator dig deeper — more surface coverage, more finding verification — before it has to wrap up; a low budget produces a faster but shallower report. Set budget to 0 to run UNCAPPED (run to completion) — billed to your own inference budget; positive values are a hard cap up to $20.",
            "default": 2
          },
          "timeout": {
            "title": "Timeout (seconds)",
            "minimum": 1,
            "maximum": 43200,
            "type": "integer",
            "description": "Wall-clock limit for the run, in seconds (max 43200 = 12h). Bob's full evaluation pipeline is a MANY-HOUR process and only emits a report after it completes, so a deep run needs a large budget. The invocation is terminated at this deadline and the latest report snapshot produced so far is salvaged and written. If you raise this, also raise the Actor's platform run timeout (Console/API) to match, or the container is stopped first.",
            "default": 780
          },
          "mode": {
            "title": "Mode",
            "enum": [
              "normal",
              "paranoid",
              "yolo"
            ],
            "type": "string",
            "description": "How aggressively Hacker Bob probes your live target. \"Normal\" is the default balance of coverage and safety; \"Paranoid\" adds direct-egress private-address blocking (extra guardrails against SSRF/DNS-rebinding while testing a live surface); \"YOLO\" is the most permissive, with fewer guardrails on live probing.",
            "default": "normal"
          }
        }
      },
      "runsResponseSchema": {
        "type": "object",
        "properties": {
          "data": {
            "type": "object",
            "properties": {
              "id": {
                "type": "string"
              },
              "actId": {
                "type": "string"
              },
              "userId": {
                "type": "string"
              },
              "startedAt": {
                "type": "string",
                "format": "date-time",
                "example": "2025-01-08T00:00:00.000Z"
              },
              "finishedAt": {
                "type": "string",
                "format": "date-time",
                "example": "2025-01-08T00:00:00.000Z"
              },
              "status": {
                "type": "string",
                "example": "READY"
              },
              "meta": {
                "type": "object",
                "properties": {
                  "origin": {
                    "type": "string",
                    "example": "API"
                  },
                  "userAgent": {
                    "type": "string"
                  }
                }
              },
              "stats": {
                "type": "object",
                "properties": {
                  "inputBodyLen": {
                    "type": "integer",
                    "example": 2000
                  },
                  "rebootCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "restartCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "resurrectCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "computeUnits": {
                    "type": "integer",
                    "example": 0
                  }
                }
              },
              "options": {
                "type": "object",
                "properties": {
                  "build": {
                    "type": "string",
                    "example": "latest"
                  },
                  "timeoutSecs": {
                    "type": "integer",
                    "example": 300
                  },
                  "memoryMbytes": {
                    "type": "integer",
                    "example": 1024
                  },
                  "diskMbytes": {
                    "type": "integer",
                    "example": 2048
                  }
                }
              },
              "buildId": {
                "type": "string"
              },
              "defaultKeyValueStoreId": {
                "type": "string"
              },
              "defaultDatasetId": {
                "type": "string"
              },
              "defaultRequestQueueId": {
                "type": "string"
              },
              "buildNumber": {
                "type": "string",
                "example": "1.0.0"
              },
              "containerUrl": {
                "type": "string"
              },
              "usage": {
                "type": "object",
                "properties": {
                  "ACTOR_COMPUTE_UNITS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_WRITES": {
                    "type": "integer",
                    "example": 1
                  },
                  "KEY_VALUE_STORE_LISTS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_INTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_EXTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_SERPS": {
                    "type": "integer",
                    "example": 0
                  }
                }
              },
              "usageTotalUsd": {
                "type": "number",
                "example": 0.00005
              },
              "usageUsd": {
                "type": "object",
                "properties": {
                  "ACTOR_COMPUTE_UNITS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_WRITES": {
                    "type": "number",
                    "example": 0.00005
                  },
                  "KEY_VALUE_STORE_LISTS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_INTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_EXTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_SERPS": {
                    "type": "integer",
                    "example": 0
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}