Cost control: a monthly token allowance for each modelSee how it works
memtro
Start for free

HackerOne + Memtro

Which vulnerability reports are still untriaged, and how severe are they?

HackerOne connects Memtro to your bug bounty and vulnerability disclosure programmes. It reads reports by programme, state, severity, reporter, assignee and date, a report's write-up, triage details and activity timeline, programme members, in-scope assets and weaknesses. When asked, and once an administrator has granted the action by name, it can add an internal comment, post a public comment the hacker sees, assign a report, change its state or severity, replace its tags, add a summary, change its title, set an issue reference and suggest a bounty internally. Attachments and bounty amounts are never returned.

Connect HackerOneStart for freeReference
In Memtro

What you can do with HackerOne in Memtro

Ask in plain English from chat, your editor, a scheduled job or your own agent. The model picks the right HackerOne tool, reads what it needs, and answers with the source cited.

What it does

  1. 01Lists reports across programmes with title, state, severity, reporter's username, assignee, weakness, asset, key dates and tags
  2. 02Reads one report's write-up, triage details, CVE ids and issue tracker reference
  3. 03Lists activity on a programme or a report, with comments, state changes and assignments, and who did what
  4. 04Reads a programme's groups and members, its in-scope assets with maximum severity and bounty eligibility, and the weaknesses it accepts
  5. 05When asked and granted, adds an internal comment only the team sees, or posts a public comment that notifies the hacker, assigns a report, and changes its state, which the hacker sees
  6. 06When asked and granted, sets severity, replaces tags, adds the team's summary, changes the title, sets the issue tracker reference and suggests a bounty internally, which moves no money

Acts when asked

When you ask it to

These tools change something in HackerOne. The model is told to use them only when you ask for exactly that, and an administrator grants each one by name to the teams that may use it; a personal connection acts only after its owner allows it.

  1. 01Add an internal comment to a report (programme members only)
  2. 02Post a public comment on a report (the hacker who reported it is notified)
  3. 03Assign a report to a user or group, or clear the assignee
  4. 04Change a report's state (visible to the hacker; resolved credits them, N/A, informative and spam deduct reputation)
  5. 05Set a report's severity rating
  6. 06Replace a report's tags
  7. 07Add the team's summary to a report
  8. 08Change a report's title
  9. 09Set a report's issue tracker reference
  10. 10Suggest a bounty on a report (internal, moves no money)

Events

When it happens

Turn events on in the connection's Events tab on the Connections page, then add the address it shows as a webhook in HackerOne, choosing the same kinds; the tab shows HackerOne's own steps. Each event can start a job, with the event as its input. HackerOne signs every delivery, and one whose signature does not check out is refused before it is read.

Events and webhooks
  • 01A new report was submitted
  • 02A report was triaged
  • 03A report changed and needs programme input
  • 04A report needs more information
  • 05A report was resolved
  • 06A report was reopened
  • 07A comment was added to a report
  • 08A user was assigned to a report
  • 09A group was assigned to a report
  • 10A report was closed as a duplicate
  • 11A report was closed as informative
  • 12A report was closed as spam
  • 13A report was closed as not applicable
  • 14A bounty was awarded on a report
  • 15A bounty was suggested on a report
  • 16A report was marked not eligible for a bounty
  • 17A report went to retesting
  • 18A hacker completed a retest
  • 19Hai prioritised a report
  • 20Disclosure of a report was agreed
  • 21A report was manually disclosed
  • 22A report became public
  • 23A report's custom field was updated
  • 24A hacker joined a private programme
  • 25A hacker left a private programme
In practice

Ask it like you would a colleague

Once HackerOne is connected, these are the kinds of things people ask. Plain questions, no syntax. If the answer lives partly in another system you have connected, Memtro looks there too.

HackerOne + Memtro

  • Which reports are waiting for triage?

  • What critical reports were submitted this month?

  • What happened on our programme this week?

  • Which assets are eligible for bounty?

  • Assign report 2481234 to the platform team

01

Monday triage

Maya Okafor, security engineer at Acme Ltd, asked which new reports had come in over the weekend. Memtro listed them with severity, asset and weakness, and the first lines of each write-up.

02

Handing a report on

Dan Fletcher, security lead at Northwind, asked Memtro to assign a high severity report to the platform team and set its Jira reference. Memtro assigned it in HackerOne, which notified the team's subscribers, and set the issue tracker reference.

Teams

Where it fits

The teams that lean on HackerOne most, a question each of them asks, and what they connect beside it.

Better together

Works with

A record in HackerOne is rarely the whole story. Connect the systems that hold the rest and Memtro checks them together, then remembers what it learned so the next question starts further along.

Also in Engineering and operations

Using something else for the same job, or both? Each connector has its own tools; connect as many as you like.

Setup

How to connect

Connect withAPI token identifier and API token value
  1. 1

    In HackerOne, open Organization settings → API tokens and create a token named Memtro. Only organisation admins can create one.

  2. 2

    Give it the groups for the programmes Memtro should see. Report Management is needed for comments to hackers, assignment, state and the other report changes.

  3. 3

    In Memtro, open Connections → HackerOne and enter the API token identifier, which is not an email address, and the API token value, shown once.

  4. 4

    Ask your first question: which reports are waiting for triage?

Also works from

Chat in the dashboard, the OpenAI-compatible API, scheduled jobs, and any MCP client: Claude Code, OpenCode, Cursor, Claude Desktop. The HackerOne tools are the same everywhere.

Set it up as an MCP serverClients and agents
FAQ

Questions

Can Memtro change anything in HackerOne?+

Only when you ask, and only what it has been granted: add an internal comment to a report (programme members only); post a public comment on a report (the hacker who reported it is notified); assign a report to a user or group, or clear the assignee; change a report's state (visible to the hacker; resolved credits them, N/A, informative and spam deduct reputation); set a report's severity rating; replace a report's tags; add the team's summary to a report; change a report's title; set a report's issue tracker reference; suggest a bounty on a report (internal, moves no money). Every other tool reads, searches or lists. The Connections page labels the tools that act, an administrator grants each one by name to the teams that may use it, and a personal connection acts only after its owner allows it.

Who can use a HackerOne connection?+

A personal connection serves only your own requests. A shared connection serves the organisation: everyone, or only the teams an admin chooses. Admins can always add shared connections; other members need the permission.

Does Memtro store my HackerOne data?+

Credentials are encrypted at rest. Tool results are cached briefly so agent loops do not repeat identical calls, and the facts the model extracts are saved to your organisation's memory with provenance (system, record and link) so they can be checked and superseded. An hourly sync anchors recently changed HackerOne records into memory as entities.

How do I connect HackerOne?+

API token identifier and API token value. In HackerOne, open Organization settings → API tokens and create a token named Memtro. Only organisation admins can create one.

Can HackerOne start a job?+

Yes. Turn events on in the connection's Events tab on the Connections page, then add the address it shows as a webhook in HackerOne, choosing the same kinds; the tab shows HackerOne's own steps. A job set to start "When an event arrives" then runs once for each matching event, with the event as its input. The run treats the event as outside data, never as instructions, and anything the run remembers is kept as unverified.

Connect HackerOne in a few minutes

Seven-day free trial, then one monthly price per organisation. Connectors, jobs and memory are never metered.

Start for freePricing

Where agents remember your company

Sign in, add a provider key, create an API key and point your tools at Memtro. It takes about five minutes.

Start for freeGetting started

7-day free trial · card on file, nothing charged until it ends · cancel any time