Hacker Bob

Hacker Bob Public CVE records API

Cleared vulnerability records from Michalis Vasileiadis's research portfolio; Hacker Bob's assistance varied by case.

GitHub OpenAPI

Operations 3

GET /api/v1/cve-records List public CVE records #
GET /api/v1/cve-records/{recordId} Get one public CVE record #
POST /api/v1/cve-records/batch Get multiple public CVE records #

Specifications

⚙
OpenAPI
https://artifacts.apis.io/hackerbob-ai/openapi/hackerbob-ai-public-cve-records-api-openapi.yml

Schemas & Data

📊
JSONSchema
https://artifacts.apis.io/hackerbob-ai/json-schema/hackerbob-ai-cve-record-page-schema.json
📊
JSONSchema
https://artifacts.apis.io/hackerbob-ai/json-schema/hackerbob-ai-cve-record-schema.json
📊
JSONSchema
https://artifacts.apis.io/hackerbob-ai/json-schema/hackerbob-ai-batch-response-schema.json

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/hackerbob-ai:hackerbob-ai-public-cve-records-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

hackerbob-ai-public-cve-records-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Hacker Bob public records Public CVE records API
  version: 1.0.0
  summary: Read-only access to cleared public Hacker Bob CVE records and capability metadata.
  description: 'This API exposes only cleared public records. It cannot start assessments, interact with targets, access private workspaces, or spend credits. Assessment execution remains in the separately installed local Hacker Bob runtime. The major version is encoded in the URL. Breaking changes use a new major version. Deprecated versions publish Deprecation and Sunset headers with at least 90 days notice. Lifecycle policy: https://hackerbob.ai/api-policy.md.'
  license:
    name: Apache-2.0
    identifier: Apache-2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
  contact:
    name: Hacker Bob security
    email: security@hackerbob.ai
    url: https://hackerbob.ai/contact
  x-versioning-policy:
    strategy: URL major version
    current: v1
    deprecated: []
    policy: https://hackerbob.ai/api-policy.md
    minimumSunsetNoticeDays: 90
servers:
- url: https://hackerbob.ai
  description: Public production records service
security: []
tags:
- name: Public CVE records
  description: Cleared vulnerability records from Michalis Vasileiadis's research portfolio; Hacker Bob's assistance varied by case.
paths:
  /api/v1/cve-records:
    get:
      operationId: listPublicCveRecords
      summary: List public CVE records
      description: List cleared public records with cursor pagination and optional exact project or status filters.
      tags:
      - Public CVE records
      parameters:
      - name: limit
        in: query
        description: Maximum records to return.
        schema:
          type: integer
          minimum: 1
          maximum: 100
          default: 20
      - name: cursor
        in: query
        description: Opaque cursor from the previous response.
        schema:
          type: string
      - name: project
        in: query
        description: Exact open-source project name.
        schema:
          type: string
      - name: status
        in: query
        description: Publication status.
        schema:
          $ref: '#/components/schemas/RecordStatus'
      responses:
        '200':
          description: A page of public CVE records.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CveRecordPage'
          headers:
            Link:
              $ref: '#/components/headers/Link'
            Deprecation:
              $ref: '#/components/headers/Deprecation'
            Sunset:
              $ref: '#/components/headers/Sunset'
        '400':
          description: The request is invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: The endpoint or public record does not exist.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '405':
          description: The HTTP method is not supported.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: The edge request limit is exhausted. Retry after the advertised reset.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: The public records service could not complete the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      deprecated: false
      x-lifecycle:
        status: active
        deprecationPolicy: https://hackerbob.ai/api-policy.md
        minimumSunsetNoticeDays: 90
  /api/v1/cve-records/{recordId}:
    get:
      operationId: getPublicCveRecord
      summary: Get one public CVE record
      description: Return one cleared public record by CVE identifier.
      tags:
      - Public CVE records
      parameters:
      - name: recordId
        in: path
        required: true
        description: CVE identifier.
        schema:
          type: string
          pattern: ^CVE-[0-9]{4}-[0-9]+$
          examples:
          - CVE-2026-47747
      responses:
        '200':
          description: The requested public CVE record.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CveRecord'
          headers:
            Link:
              $ref: '#/components/headers/Link'
            Deprecation:
              $ref: '#/components/headers/Deprecation'
            Sunset:
              $ref: '#/components/headers/Sunset'
        '404':
          description: The endpoint or public record does not exist.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: The edge request limit is exhausted. Retry after the advertised reset.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: The public records service could not complete the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      deprecated: false
      x-lifecycle:
        status: active
        deprecationPolicy: https://hackerbob.ai/api-policy.md
        minimumSunsetNoticeDays: 90
  /api/v1/cve-records/batch:
    post:
      operationId: batchGetPublicCveRecords
      summary: Get multiple public CVE records
      description: Return up to 50 public records in one side-effect-free request. The operation is idempotent and safe to retry.
      tags:
      - Public CVE records
      parameters:
      - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BatchRequest'
      responses:
        '200':
          description: Found records and requested identifiers without a public record.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BatchResponse'
          headers:
            Link:
              $ref: '#/components/headers/Link'
            Deprecation:
              $ref: '#/components/headers/Deprecation'
            Sunset:
              $ref: '#/components/headers/Sunset'
        '400':
          description: The request is invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: The endpoint or public record does not exist.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '405':
          description: The HTTP method is not supported.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: The edge request limit is exhausted. Retry after the advertised reset.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: The public records service could not complete the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      deprecated: false
      x-lifecycle:
        status: active
        deprecationPolicy: https://hackerbob.ai/api-policy.md
        minimumSunsetNoticeDays: 90
components:
  headers:
    Deprecation:
      description: Present only after this API version receives a formal deprecation date. RFC 9745 structured date such as @1788134400.
      schema:
        type: string
        pattern: ^@[0-9]+$
    Sunset:
      description: Present only for a deprecated version with a scheduled shutdown. RFC 8594 HTTP-date value.
      schema:
        type: string
    Link:
      description: Links to the public API lifecycle policy with rel=deprecation.
      schema:
        type: string
  schemas:
    ErrorResponse:
      type: object
      additionalProperties: false
      required:
      - error
      - requestId
      properties:
        error:
          type: object
          additionalProperties: false
          required:
          - code
          - message
          properties:
            code:
              type: string
            message:
              type: string
            details: {}
        requestId:
          type: string
    RecordStatus:
      type: string
      enum:
      - public
      - assigned-no-public-record
    CveRecord:
      type: object
      additionalProperties: false
      required:
      - id
      - project
      - status
      - url
      properties:
        id:
          type: string
          pattern: ^CVE-[0-9]{4}-[0-9]+$
        project:
          type: string
        status:
          $ref: '#/components/schemas/RecordStatus'
        url:
          type:
          - string
          - 'null'
          format: uri
    CveRecordPage:
      type: object
      additionalProperties: false
      required:
      - schemaVersion
      - lastVerified
      - records
      - pagination
      properties:
        schemaVersion:
          type: string
        lastVerified:
          type: string
          format: date
        records:
          type: array
          items:
            $ref: '#/components/schemas/CveRecord'
        pagination:
          $ref: '#/components/schemas/Pagination'
    BatchResponse:
      type: object
      additionalProperties: false
      required:
      - records
      - missing
      properties:
        records:
          type: array
          items:
            $ref: '#/components/schemas/CveRecord'
        missing:
          type: array
          items:
            type: string
    Pagination:
      type: object
      additionalProperties: false
      required:
      - limit
      - returned
      - total
      - nextCursor
      properties:
        limit:
          type: integer
          minimum: 1
          maximum: 100
        returned:
          type: integer
          minimum: 0
        total:
          type: integer
          minimum: 0
        nextCursor:
          type:
          - string
          - 'null'
    BatchRequest:
      type: object
      additionalProperties: false
      required:
      - recordIds
      properties:
        recordIds:
          type: array
          minItems: 1
          maxItems: 50
          uniqueItems: true
          items:
            type: string
            pattern: ^CVE-[0-9]{4}-[0-9]+$
  parameters:
    IdempotencyKey:
      name: Idempotency-Key
      in: header
      required: false
      description: Optional caller-generated request correlation key. Batch lookup is side-effect free and returns the same result for the same recordIds.
      schema:
        type: string
        minLength: 1
        maxLength: 255
externalDocs:
  description: Hacker Bob public API reference
  url: https://hackerbob.ai/api-reference