[{"data":1,"prerenderedAt":684},["ShallowReactive",2],{"page-\u002Fagent\u002Foverview":3,"all-pages":357},{"id":4,"title":5,"body":6,"description":347,"extension":348,"meta":349,"navigation":350,"path":351,"robots":352,"seo":353,"sitemap":354,"stem":355,"__hash__":356},"content\u002F05.agent\u002F1.overview.md","BH Agent Overview",{"type":7,"value":8,"toc":338},"minimark",[9,14,47,51,58,129,158,167,171,189,193,204,217,221,224,250,276,285,289,300,304,334],[10,11,13],"h2",{"id":12},"the-two-surfaces","The Two Surfaces",[15,16,17,38],"ul",{},[18,19,20,24,25,29,30,33,34,37],"li",{},[21,22,23],"strong",{},"Your agent space"," (",[26,27,28],"code",{},"\u002Fu\u002F\u003Cyou>\u002Fbh-agent\u002F","): personal overview, reusable\n",[21,31,32],{},"skills",", and ",[21,35,36],{},"MCP servers"," you configure once and grant to agents.",[18,39,40,24,43,46],{},[21,41,42],{},"Project agent tab",[26,44,45],{},"\u002Fu\u002F\u003Cyou>\u002Fprojects\u002F\u003Cproject>\u002Fagent","): chat,\nproviders, and skills scoped to one project.",[10,48,50],{"id":49},"connecting-to-workflows","Connecting to Workflows",[52,53,54,57],"p",{},[26,55,56],{},"step.agent"," is the workflow primitive that runs an agent with explicitly\ngranted capabilities. The product surfaces above are what it draws on:",[59,60,65],"pre",{"className":61,"code":62,"language":63,"meta":64,"style":64},"language-bhw shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","step.agent(\n    prompt = \"Classify each finding as EXPLOITABLE, LIKELY_NOISE, or OUT_OF_SCOPE.\",\n    provider = provider.key(\"anthropic\u002Fpersonal\"),\n    model = model(\"default\"),\n    context = [\n        agent.context.path(description = \"Findings to triage.\", path = path.file(\"findings.txt\")),\n    ],\n    tools = [tool.shell(), mcp.server(\"github\")],\n    output = agent.output(path = path.file(\"agent-output.txt\")),\n)\n","bhw","",[26,66,67,75,81,87,93,99,105,111,117,123],{"__ignoreMap":64},[68,69,72],"span",{"class":70,"line":71},"line",1,[68,73,74],{},"step.agent(\n",[68,76,78],{"class":70,"line":77},2,[68,79,80],{},"    prompt = \"Classify each finding as EXPLOITABLE, LIKELY_NOISE, or OUT_OF_SCOPE.\",\n",[68,82,84],{"class":70,"line":83},3,[68,85,86],{},"    provider = provider.key(\"anthropic\u002Fpersonal\"),\n",[68,88,90],{"class":70,"line":89},4,[68,91,92],{},"    model = model(\"default\"),\n",[68,94,96],{"class":70,"line":95},5,[68,97,98],{},"    context = [\n",[68,100,102],{"class":70,"line":101},6,[68,103,104],{},"        agent.context.path(description = \"Findings to triage.\", path = path.file(\"findings.txt\")),\n",[68,106,108],{"class":70,"line":107},7,[68,109,110],{},"    ],\n",[68,112,114],{"class":70,"line":113},8,[68,115,116],{},"    tools = [tool.shell(), mcp.server(\"github\")],\n",[68,118,120],{"class":70,"line":119},9,[68,121,122],{},"    output = agent.output(path = path.file(\"agent-output.txt\")),\n",[68,124,126],{"class":70,"line":125},10,[68,127,128],{},")\n",[15,130,131,145,151],{},[18,132,133,136,137,140,141,144],{},[26,134,135],{},"provider.key(...)"," must reference a key ",[21,138,139],{},"enabled for the project","\n(project agent providers tab); other references fail with an\n",[26,142,143],{},"unknown_provider_key"," diagnostic.",[18,146,147,150],{},[26,148,149],{},"mcp.server(\"github\")"," grants a preconfigured MCP connection — credentials\nlive in the MCP server configuration, never in the workflow.",[18,152,153,154,157],{},"Context items (",[26,155,156],{},"agent.context.text\u002Fpath\u002Fartifact\u002Fdataset",") pass by\nreference; contents are never injected wholesale into the model.",[52,159,160,161,166],{},"Full primitive reference: ",[162,163,165],"a",{"href":164},"\u002Fworkflows\u002Fagents","Agents",".",[10,168,170],{"id":169},"project-config-behind-agents","Project Config Behind Agents",[52,172,173,174,177,178,177,181,184,185,166],{},"Providers, secrets, and MCP connections resolve through project\nconfiguration (",[26,175,176],{},"config.var"," \u002F ",[26,179,180],{},"config.secret",[26,182,183],{},"config.mcp","), managed in\nthe project's Vars \u002F Secrets \u002F MCP tabs. See\n",[162,186,188],{"href":187},"\u002Fworkflows\u002Fconfig","Configuration",[10,190,192],{"id":191},"specialized-agents-chat","Specialized Agents (Chat)",[52,194,195,196,199,200,203],{},"Agent chat delegates to specialized subagents (recon, exploit, triage,\nreport) through the ",[26,197,198],{},"task"," tool. On the project's ",[21,201,202],{},"AI Providers"," tab you can\nroute each role to its own provider key and model, so cheap work runs on a\ncheap model while hard work uses a stronger one. Leaving a role's provider or\nmodel empty makes it inherit the session's.",[52,205,206,207,209,210,213,214,166],{},"Workflow ",[26,208,56],{}," steps configure the same idea in the workflow source\nwith ",[26,211,212],{},"agent.harness([...])"," — see\n",[162,215,165],{"href":216},"\u002Fworkflows\u002Fagents#specialized-agents-harness",[10,218,220],{"id":219},"attaching-project-context","Attaching Project Context",[52,222,223],{},"A message can point the agent at data that already exists in the project\ninstead of pasting it into the prompt:",[15,225,226,241],{},[18,227,228,231,232,236,237,240],{},[21,229,230],{},"From a run page",": ",[233,234,235],"em",{},"Investigate with agent"," attaches the whole run, and\n",[233,238,239],{},"Ask agent"," on one artifact attaches that artifact. The agent session opens\nwith the reference ready for you to describe the task.",[18,242,243,231,246,249],{},[21,244,245],{},"From the composer",[233,247,248],{},"Attach run",", then paste a run link or id. Pasting a\nrun link directly into a message does the same thing.",[52,251,252,253,256,257,260,261,264,265,260,268,271,272,275],{},"Attachments travel as ",[26,254,255],{},"bountyhub:\u002F\u002F"," references\n(",[26,258,259],{},"bountyhub:\u002F\u002Frun\u002F\u003Cid>",", ",[26,262,263],{},"bountyhub:\u002F\u002Frun\u002F\u003Cid>\u002Fartifact\u002F\u003Cname>",") inside the\nmessage text, so they survive compaction, forking, and replay. The agent reads\nthem with the bundled BountyHub MCP tools (",[26,266,267],{},"get_workflow_run",[26,269,270],{},"read_artifact",")\nusing its task-scoped token. Contents are never copied into the prompt, and\naccess is still enforced by the platform's scopes: the reference only tells the\nagent ",[233,273,274],{},"what"," to look at.",[52,277,278,280,281,284],{},[26,279,270],{}," extracts the archive into the session workspace under\n",[26,282,283],{},"context\u002Fruns\u002F\u003Crun>\u002F\u003Cartifact>\u002F",", where the agent's file tools can read it.",[10,286,288],{"id":287},"diagnosing-a-session","Diagnosing a Session",[52,290,291,292,295,296,299],{},"The session menu (",[26,293,294],{},"⋯",") in the chat header has ",[21,297,298],{},"Copy session",". It copies a\nMarkdown report you can paste into an issue or a thread: session id, project,\nrunner, provider\u002Fmodel, state, approval mode, timings, token usage, MCP\nservers, and the full event log including tool arguments and output (tool\noutput is capped at 20k chars per call). Use it when a session stalls, fails,\nor behaves differently from what the transcript suggests.",[10,301,303],{"id":302},"next-steps","Next Steps",[15,305,306,312,320,327],{},[18,307,308,311],{},[162,309,36],{"href":310},"\u002Fagent\u002Fmcp-servers",": Add transports, authenticate with API\nkeys, and grant servers to projects and workflow steps.",[18,313,314,316,317,319],{},[162,315,165],{"href":164},": The complete ",[26,318,56],{}," reference.",[18,321,322,326],{},[162,323,325],{"href":324},"\u002Fprojects\u002Foverview","Projects Overview",": Where the agent tab lives.",[18,328,329,333],{},[162,330,332],{"href":331},"\u002Fdeveloper\u002Fscopes","Developer Scopes",": PAT scopes if you drive agents via\nthe API.",[335,336,337],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":64,"searchDepth":95,"depth":89,"links":339},[340,341,342,343,344,345,346],{"id":12,"depth":77,"text":13},{"id":49,"depth":77,"text":50},{"id":169,"depth":77,"text":170},{"id":191,"depth":77,"text":192},{"id":219,"depth":77,"text":220},{"id":287,"depth":77,"text":288},{"id":302,"depth":77,"text":303},"Agent chat, skills, providers, and MCP servers — the product surface behind step.agent workflow steps.","md",{},true,"\u002Fagent\u002Foverview",null,{"title":5,"description":347},{"loc":351},"05.agent\u002F1.overview","HuwQ4aqlR453QzgekdMILmoFFnRlUdVVJR6ced0uzvs",[358,418,432,451,486,497,509,520,531,542,566,584,604,615,626],{"title":359,"path":360,"stem":361,"children":362},"Workflows","\u002Fworkflows","01.workflows",[363,365,369,373,377,381,385,389,393,397,401,403,407,410,414],{"title":359,"path":360,"stem":364},"01.workflows\u002Findex",{"title":366,"path":367,"stem":368},"Workflow Quick Reference","\u002Fworkflows\u002Fquick-reference","01.workflows\u002F00.quick-reference",{"title":370,"path":371,"stem":372},"Workflows Overview","\u002Fworkflows\u002Foverview","01.workflows\u002F01.overview",{"title":374,"path":375,"stem":376},"Workflow Syntax Reference","\u002Fworkflows\u002Fsyntax-reference","01.workflows\u002F02.syntax-reference",{"title":378,"path":379,"stem":380},"Steps","\u002Fworkflows\u002Fsteps","01.workflows\u002F03.steps",{"title":382,"path":383,"stem":384},"Step Outputs","\u002Fworkflows\u002Fstep-outputs","01.workflows\u002F04.step-outputs",{"title":386,"path":387,"stem":388},"Concurrency","\u002Fworkflows\u002Fconcurrency","01.workflows\u002F05.concurrency",{"title":390,"path":391,"stem":392},"Transforms","\u002Fworkflows\u002Ftransforms","01.workflows\u002F06.transforms",{"title":394,"path":395,"stem":396},"For Each","\u002Fworkflows\u002Ffor-each","01.workflows\u002F07.for-each",{"title":398,"path":399,"stem":400},"Modules","\u002Fworkflows\u002Fmodules","01.workflows\u002F08.modules",{"title":165,"path":164,"stem":402},"01.workflows\u002F09.agents",{"title":404,"path":405,"stem":406},"Decisions","\u002Fworkflows\u002Fdecisions","01.workflows\u002F10.decisions",{"title":408,"path":187,"stem":409},"Configuration References","01.workflows\u002F11.config",{"title":411,"path":412,"stem":413},"Comparison With Other Automation Systems","\u002Fworkflows\u002Fcomparison","01.workflows\u002F12.comparison",{"title":415,"path":416,"stem":417},"Generate with AI","\u002Fworkflows\u002Fai-generation","01.workflows\u002F13.ai-generation",{"title":419,"path":420,"stem":421,"children":422},"Projects","\u002Fprojects","02.projects",[423,426,428],{"title":424,"path":420,"stem":425},"Projects & Runs","02.projects\u002Findex",{"title":325,"path":324,"stem":427},"02.projects\u002F1.overview",{"title":429,"path":430,"stem":431},"Runs & Artifacts","\u002Fprojects\u002Fruns-artifacts","02.projects\u002F2.runs-artifacts",{"title":433,"path":434,"stem":435,"children":436},"Runners","\u002Frunners","03.runners",[437,439,443,447],{"title":433,"path":434,"stem":438},"03.runners\u002Findex",{"title":440,"path":441,"stem":442},"Runner Overview","\u002Frunners\u002Foverview","03.runners\u002F1.overview",{"title":444,"path":445,"stem":446},"Getting Started with Runners","\u002Frunners\u002Fgetting-started","03.runners\u002F2.getting-started",{"title":448,"path":449,"stem":450},"Custom Runner Images","\u002Frunners\u002Fcustom-image","03.runners\u002F3.custom-image",{"title":452,"path":453,"stem":454,"children":455},"Datasets","\u002Fdatasets","04.datasets",[456,458,462,466,470,474,478,482],{"title":452,"path":453,"stem":457},"04.datasets\u002Findex",{"title":459,"path":460,"stem":461},"Datasets Overview","\u002Fdatasets\u002Foverview","04.datasets\u002F1.overview",{"title":463,"path":464,"stem":465},"Dataset Schemas and Identity","\u002Fdatasets\u002Fschema","04.datasets\u002F2.schema",{"title":467,"path":468,"stem":469},"Pushing and Reading Dataset Rows","\u002Fdatasets\u002Fworkflows","04.datasets\u002F3.workflows",{"title":471,"path":472,"stem":473},"Dataset SQL Reference","\u002Fdatasets\u002Fsql","04.datasets\u002F4.sql",{"title":475,"path":476,"stem":477},"Dataset Structured Filters","\u002Fdatasets\u002Ffilters","04.datasets\u002F5.filters",{"title":479,"path":480,"stem":481},"Dataset Saved Views","\u002Fdatasets\u002Fviews","04.datasets\u002F6.views",{"title":483,"path":484,"stem":485},"Datasets API and CLI","\u002Fdatasets\u002Fapi-cli","04.datasets\u002F7.api-cli",{"title":487,"path":488,"stem":489,"children":490},"Agent","\u002Fagent","05.agent",[491,494,495],{"title":492,"path":488,"stem":493},"BH Agent","05.agent\u002Findex",{"title":5,"path":351,"stem":355},{"title":36,"path":310,"stem":496},"05.agent\u002F2.mcp-servers",{"title":498,"path":499,"stem":500,"children":501},"Bhlast","\u002Fbhlast","06.bhlast",[502,505],{"title":503,"path":499,"stem":504},"Bhlast Servers","06.bhlast\u002Findex",{"title":506,"path":507,"stem":508},"Bhlast servers overview","\u002Fbhlast\u002Foverview","06.bhlast\u002F1.overview",{"title":510,"path":511,"stem":512,"children":513},"Notifications","\u002Fnotifications","07.notifications",[514,516],{"title":510,"path":511,"stem":515},"07.notifications\u002Findex",{"title":517,"path":518,"stem":519},"Notifications Overview","\u002Fnotifications\u002Foverview","07.notifications\u002F1.overview",{"title":521,"path":522,"stem":523,"children":524},"Blob Storage","\u002Fblob-storage","08.blob-storage",[525,527],{"title":521,"path":522,"stem":526},"08.blob-storage\u002Findex",{"title":528,"path":529,"stem":530},"Blob Storage Overview","\u002Fblob-storage\u002Foverview","08.blob-storage\u002F1.overview",{"title":532,"path":533,"stem":534,"children":535},"Payloads","\u002Fpayloads","09.payloads",[536,538],{"title":532,"path":533,"stem":537},"09.payloads\u002Findex",{"title":539,"path":540,"stem":541},"Payloads overview","\u002Fpayloads\u002Foverview","09.payloads\u002F1.overview",{"title":543,"path":544,"stem":545,"children":546},"Cve Watcher","\u002Fcve-watcher","10.cve-watcher",[547,550,554,558,562],{"title":548,"path":544,"stem":549},"CVE Watcher","10.cve-watcher\u002Findex",{"title":551,"path":552,"stem":553},"CVE Watcher Overview","\u002Fcve-watcher\u002Foverview","10.cve-watcher\u002F1.overview",{"title":555,"path":556,"stem":557},"CVE Watcher Search and Filters","\u002Fcve-watcher\u002Fsearch","10.cve-watcher\u002F2.search",{"title":559,"path":560,"stem":561},"CVE Watcher Push Notifications","\u002Fcve-watcher\u002Fnotifications","10.cve-watcher\u002F3.notifications",{"title":563,"path":564,"stem":565},"CVE Watcher API and Scopes","\u002Fcve-watcher\u002Fapi","10.cve-watcher\u002F4.api",{"title":567,"path":568,"stem":569,"children":570},"Developer","\u002Fdeveloper","11.developer",[571,573,577,580],{"title":567,"path":568,"stem":572},"11.developer\u002Findex",{"title":574,"path":575,"stem":576},"Developer Overview","\u002Fdeveloper\u002Foverview","11.developer\u002F1.overview",{"title":578,"path":331,"stem":579},"Personal Access Token Scopes","11.developer\u002F2.scopes",{"title":581,"path":582,"stem":583},"Personal Access Tokens","\u002Fdeveloper\u002Fpersonal-access-tokens","11.developer\u002F3.personal-access-tokens",{"title":585,"path":586,"stem":587,"children":588},"Bh","\u002Fbh","12.bh",[589,592,596,600],{"title":590,"path":586,"stem":591},"BH CLI","12.bh\u002Findex",{"title":593,"path":594,"stem":595},"BH CLI Overview","\u002Fbh\u002Foverview","12.bh\u002F1.overview",{"title":597,"path":598,"stem":599},"BH CLI Commands","\u002Fbh\u002Fcommands","12.bh\u002F2.commands",{"title":601,"path":602,"stem":603},"BH CLI Examples","\u002Fbh\u002Fexamples","12.bh\u002F3.examples",{"title":605,"path":606,"stem":607,"children":608},"Billing","\u002Fbilling","13.billing",[609,611],{"title":605,"path":606,"stem":610},"13.billing\u002Findex",{"title":612,"path":613,"stem":614},"Billing Overview","\u002Fbilling\u002Foverview","13.billing\u002F1.overview",{"title":616,"path":617,"stem":618,"children":619},"Tools","\u002Ftools","14.tools",[620,622],{"title":616,"path":617,"stem":621},"14.tools\u002Findex",{"title":623,"path":624,"stem":625},"Cookie Lab","\u002Ftools\u002Fcookie-lab","14.tools\u002F1.cookie-lab",{"title":627,"path":628,"stem":629,"children":630},"Site Policies","\u002Fsite-policies","99.site-policies",[631,633,646,650,654,658,662,666,670],{"title":627,"path":628,"stem":632},"99.site-policies\u002Findex",{"title":634,"path":635,"stem":636,"children":637},"Privacy Policy","\u002Fsite-policies\u002Fprivacy-policy","99.site-policies\u002F1.privacy-policy",[638,642],{"title":639,"path":640,"stem":641},"Company Processors","\u002Fsite-policies\u002Fprivacy-policy\u002Fcompany-processors","99.site-policies\u002Fprivacy-policy\u002F1.company-processors",{"title":643,"path":644,"stem":645},"Data Export Instructions","\u002Fsite-policies\u002Fprivacy-policy\u002Fdata-export-instructions","99.site-policies\u002Fprivacy-policy\u002F2.data-export-instructions",{"title":647,"path":648,"stem":649},"Terms of Service","\u002Fsite-policies\u002Fterms-of-service","99.site-policies\u002F2.terms-of-service",{"title":651,"path":652,"stem":653},"California Resident Notice at Collection","\u002Fsite-policies\u002Fccpa","99.site-policies\u002F3.ccpa",{"title":655,"path":656,"stem":657},"Cancellation Policy","\u002Fsite-policies\u002Fcancellation-policy","99.site-policies\u002F4.cancellation-policy",{"title":659,"path":660,"stem":661},"Refund Policy","\u002Fsite-policies\u002Frefund-policy","99.site-policies\u002F5.refund-policy",{"title":663,"path":664,"stem":665},"Taxes on Services","\u002Fsite-policies\u002Ftaxes-on-services","99.site-policies\u002F6.taxes-on-services",{"title":667,"path":668,"stem":669},"Disclaimer","\u002Fsite-policies\u002Fdisclaimer","99.site-policies\u002F7.disclaimer",{"title":671,"path":672,"stem":673,"children":674},"Security","\u002Fsite-policies\u002Fsecurity","99.site-policies\u002Fsecurity\u002Findex",[675,676,680],{"title":671,"path":672,"stem":673},{"title":677,"path":678,"stem":679},"Security Overview","\u002Fsite-policies\u002Fsecurity\u002Fsecurity-overview","99.site-policies\u002Fsecurity\u002F1.security-overview",{"title":681,"path":682,"stem":683},"Security Response","\u002Fsite-policies\u002Fsecurity\u002Fsecurity-response","99.site-policies\u002Fsecurity\u002F2.security-response",1794410312376]