llms.txt
+7 −1
https://bountyoperator.com/llms.txt
− > Pre-submission review for bug bounty reports and smart-contract findings. The AI argues against the finding. The hunter writes the report. Reviews run on the user's own AI provider API key. Free: 1 review a day. Operator: US$10 per month for unlimited reviews and US$2 API credit per paid month. Only hosted reviews count: on the site or through `run_review`.+ > Make your strongest case before you submit. Check your proof, make the impact explicit, and catch missing evidence before the triager has to ask.+ Pre-submission review for bug bounty reports and smart-contract findings. The review checks claims and counterarguments against the supplied evidence, confirms supported claims and identifies gaps. The hunter writes the report. Start with the free core workflow: `list_profiles`, `prepare_review`, your own model's review, then `build_packet`. It needs no Bounty Operator account or provider key. Hosted reviews through `run_review` are separate: Free allows 1 a day on the user's API key; Operator i+ - [Novita BYOK setup](https://bountyoperator.com/docs/model-selection#novita): Optional hosted-review provider `novita`; local MCP key variable `NOVITA_API_KEY`. In the remote MCP endpoint use `provider: "novita"` and send the key in `X-Provider-Key`, never a tool argument. Website selection: https://bountyoperator.com/?provider=novita#workspace. Check Novita's current pricing, credit and data policies; it bills model usage separately. Bounty Operator account and hosted-review allowances still a+ - [Nebius BYOK setup](https://bountyoperator.com/docs/model-selection#nebius): Optional hosted-review provider `nebius` (Nebius Token Factory); local MCP key variable `NEBIUS_API_KEY`. In the remote MCP endpoint use `provider: "nebius"` and send the key in `X-Provider-Key`, never a tool argument. Website selection: https://bountyoperator.com/?provider=nebius#workspace. Default model `deepseek-ai/DeepSeek-V4.1-Flash`. Requests send `store: false`. Nebius bills model usage separately; Bounty Opera+ - OpenCode v1: merge `{"mcp":{"bounty-operator":{"type":"remote","url":"https://bountyoperator.com/api/mcp","oauth":false}}}` into the project's `opencode.json`. OpenCode v2: put the same server entry under `mcp.servers`, not directly under `mcp`. Verify with `opencode mcp list`. Versioned local and hosted configs: https://bountyoperator.com/mcp#install+ - First call: use `list_profiles`, then `prepare_review` for `general`, `solidity` or `report` with only the files the user chose. The remote endpoint needs `files` with inline text, not local `paths`. Respect privacy blocks, write the review from the prepared request, then pass the unchanged manifest and review to `build_packet`. Report reference problems instead of presenting the packet as verified proof.+ - Free-model options and data-use limits: https://bountyoperator.com/docs/model-selection#free. The website can check OpenRouter's current zero-priced models; a free provider model does not bypass Bounty Operator's hosted-review allowance or prove review quality. Never silently switch a free request to a paid model.