vmihalis/hacker-bob

npx -y hacker-bob@latest install /path/to/your/project

Usage

• •Install into a dedicated project directory (not the source checkout), then fully restart the host CLI from that directory.
• •Run /bob-evaluate target.com (Claude Code), $bob-evaluate target.com (Codex), or /skill:bob-evaluate target.com (Kimi CLI).
• •Verify integration with /bob-status or hacker-bob doctor /path/to/your/project.
• •Optionally wire up GitHub Actions Bob Diff Review for headless PR security review.

Key features

• ✓Structured workflow: SURFACE_DISCOVERY -> AUTH -> EVALUATE -> CHAIN -> VERIFY -> GRADE -> REPORT.
• ✓Host adapters for Claude Code, Codex, Kimi CLI, and generic MCP hosts; the installer is idempotent and preserves unrelated host config.
• ✓OSS Project Review Mode for testing checked-out repositories with session-scoped Docker replay.
• ✓Local read-only multi-session dashboard (hacker-bob dashboard) on 127.0.0.1:4873.
• ✓GitHub Actions diff review with inline comments, Check Run results, and severity-gated failure (min-severity-for-failure).

Best for

Authorized offensive-security testing (your own code in CI, staging, and authorized live targets) driven by AI agents.

Caveats

• ⚠For authorized testing only — you are responsible for having permission; Bob does not prove authorization, enforce policy, or guarantee containment.
• ⚠Browser auto-signup refuses effective block_internal_hosts; strict local/private DNS blocking is default only in paranoid sessions (--allow-internal-hosts otherwise).
• ⚠Requires Node.js 20+, curl, and python3; surface-discovery tools (subfinder, httpx, nuclei, amass, assetfinder, etc.) are optional but improve coverage.
• ⚠v1.x installs auto-migrate to the canonical 'hacker-bob' server key; legacy ~/bounty-agent-sessions/ roots are not auto-resolved (purge with --purge-legacy-session-root).
• ⚠Read DISCLAIMER.md before use; npm packages publish with provenance.