v0.9.12 - Product and MCP walkthroughs

Adds a 54-second product tour to the homepage and a 75-second MCP walkthrough to the setup guide. Both use native video controls, English captions, full transcripts and click-to-play loading. The product tour shows the saved public example; the MCP guide shows recorded tool responses and a source review of the same invented protocol.

The two MP4 assets now support single HTTP byte ranges, so playback can seek correctly through the Workers asset route. Posters and fast-start MP4 files keep the initial page light.

Validation: 1,088 hosted web tests, 27 private checks, 74 MCP tests, 54 Python tests and 15 package checks passed. Typechecking, generated-page checks, privacy checks, video decoding, desktop/mobile playback and exact byte-range checks passed.

• Watch the product tour
• Watch the MCP walkthrough

v0.9.11 - CVSS consistency check

The free report checker now checks CVSS 3.1 score/vector consistency in the browser. It flags arithmetic mismatches and invalid base vectors, with a link to the original line.

CVSS remains optional. Other versions, Temporal or Environmental scores, ambiguous pairs and metric selection remain for manual review. This change does not modify the draft or make a model call.

Validated against FIRST’s reference calculator for all 2,592 base vectors, with 1,081 web tests and the existing release checks.

Bounty Operator 0.9.10

Site

• The proof lines give the builder's place on Immunefi's all-time leaderboard, with the day it was read: 77th on 10 October 2026. Each one links the public profile, which Immunefi marks Top Ranked. The rank is recomputed daily, so the day stays beside the number.
• "Built by Tradi3" at the foot of every page links that profile.

MCP package

bounty-operator-mcp-0.9.10.tgz, SHA-256 94ca08eba6cad497bfe5e24f203f71ef0692560a0a52539774d87d4882c0f1b7. The tools are unchanged from 0.9.9.

Bounty Operator 0.9.9

Site

• Every page now opens the same way. The heading starts at the same height on every page: 48px under the header rule, 32px on a phone, and one line lower on a page that shows its trail. The landing pages, the benchmark and the pricing page started theirs further down, and the template pages a few pixels further than the tools and the guide.
• The lede stands the same distance under the heading on every page and keeps one line length. The buttons in a page head are the large size on every page; on a phone they share the row width, one above the other. The guide, the security, support, benchmark and template pages had the smaller size.
• The page for an address that does not exist opens on the moving field like every other page. It was a card in the middle of a black page.
• A page that ends on a call to action ends on one closing panel. The tool pages printed theirs on solid vermilion, the guide and the other reference pages used a smaller panel and the templates hub a third. All of them are now the panel the landing pages use, with the same buttons.
• Every page ends the same distance above the footer. The reference pages ended closer to it and the template pages further.
• A few headings break better for it: "What an invalid report costs on each platform" takes two lines, not three.

Payment

• The payment page at Stripe takes the site's paper and its black box. It still had the pale blue ground and the blue button of an earlier design.

MCP package

bounty-operator-mcp-0.9.9.tgz, SHA-256 7092605d6d19eda706445f252198be399589f9fbe28d19d553037a14fc8eb467. The tools are unchanged from 0.9.8.

Bounty Operator 0.9.8

Reviews

• OpenRouter sets a review's whole output allowance against the account's credit before a model runs. An account holding less than that was refused, though a review seldom uses the allowance. The review now goes once more with the allowance the account can pay for, when that is at least 16,000 tokens. Below that, the message gives both numbers: what the review may use and what the credit covers.
• A model identifier OpenRouter does not know is now shown at the Model field, like any other unknown model.

MCP

• The official MCP Registry lists the remote endpoint as io.github.bountyoperator/bounty-operator. The entry is published from the source repository by a workflow that signs in as the repository.

MCP package

bounty-operator-mcp-0.9.8.tgz, SHA-256 a35df6dd56f9771d643b696416536000a80ced10173db8146c1363e6d28f7321. The tools are unchanged from 0.9.7.

Bounty Operator 0.9.7

Reviews

• OpenRouter answers 404 when a model exists and the account's own settings leave it no host: its privacy settings, its data policy or its list of allowed hosts. The workbench read every 404 as a wrong model identifier. It now says which setting ruled the hosts out. For a free model whose hosts may train on what they are sent, on an account that does not allow that, it says to pick a model that is not free.
• A free model on OpenRouter runs on a request allowance its host shares among all of OpenRouter's users. When that allowance is used up the answer is HTTP 429, and the message now names the host and says that the key and its credit are not the cause.
• OpenAI answers 429 for an account that is out of credit as well as for requests sent too fast. The two are now told apart: the first is not a wait.

Site and privacy

• /your-model-your-key answers "Can I run it on a free model?".
• The site keeps a daily total of the page views a browser navigated to, read from two headers a browser sends when it opens a page. No page sends anything new. /privacy lists it.

MCP package

bounty-operator-mcp-0.9.7.tgz, SHA-256 4193a935eb0e154384445cc96b711d5169fb3ea1e8b4f5174eb26884f3a4b1e8. The tools are unchanged from 0.9.6.

Bounty Operator 0.9.6

Account and billing

• The site now reads a subscription from Stripe itself when its paid week is ending: from twelve hours before the end, at most once an hour, until the next week is on record. Until now a renewal, a cancellation or a failed payment reached your account only through the notice Stripe sends. Had that notice been lost, a subscriber who paid for the next week would have lost Operator six hours into it.

Site and privacy

• The counters of the MCP endpoint now hold agents only. Our own release checks are not counted, a registry or a monitor that calls on a timer is counted apart, and a session is counted under the kind of agent that opened it: Claude, Codex, Cursor or "other". A headless browser that drives a page is no longer counted as someone using it.
• /privacy lists every counter the site keeps. The list had left out the MCP endpoint's counters and eight of the named actions a page reports. A counter is still a date, a name and a total, with no account, address or cookie in it.

MCP package

bounty-operator-mcp-0.9.6.tgz, SHA-256 75aa8686586b7c5fb305f0b745c597c2bea76c5618621845721abf837ebcebae. The tools are unchanged from 0.9.5.

Bounty Operator 0.9.5

Site

• There is a help page, /support, linked from the foot of every page and
  from the billing view of your account. It sends each kind of request to
  its place: a question to Q&A and an idea to Ideas on the forum, a bug to
  the bug report form, an account or payment problem to email, and a
  vulnerability in Bounty Operator to the private report form.
• The forum is GitHub Discussions on the source repository. Anyone can read
  it; posting needs a GitHub account. It is public, so the help page says
  first what stays out of it: unreported findings, report drafts, API keys,
  connection tokens and recovery codes.
• The README, llms.txt and the issue chooser on GitHub point to the same
  places.

Bounty Operator 0.9.4

Site

• /benchmark has a new table, "Right, wrong and not finished". It splits
  every ranked model's inputs into those it answered right, those it
  answered wrong and those it did not finish, with the reason. An unfinished
  input scores as wrong, so a low rank can mean either, and the table tells
  them apart: of 792 inputs, 646 were answered right, 85 wrong and 61 were
  not finished.
• The same section says why two models rank low without one wrong answer.
  Claude Sonnet 5.5 lost 13 inputs, 11 cut off at the output limit and 2
  timed out. That is the agent run at the highest effort; a review in the
  workbench is one request, and Sonnet 5.5 is its default model on
  OpenRouter.

Bounty Operator 0.9.3

Reviews

• Claude Sonnet 5.5 is the default model on OpenRouter. We ran the review the
  product runs, one request, on pairs of the benchmark with seven models.
  With the review method Sonnet 5.5 got the largest share of its pairs right,
  and it is the model that ran all eight stages of the gauntlet without a
  block. GPT-6.1 Sol, the default until now, is second in the list.
• The gauntlet says when a model is known to stop. OpenAI's safeguards
  blocked stage 4, the proof review, on GPT-6.1 Sol for all four drafts we
  tried. The row says so before a run starts on that model.
• When a provider blocks a gauntlet stage on an OpenRouter key, the notice
  has a button that resumes that stage on a model from another vendor. The
  finished stages are kept.
• Blocks and credit errors are named for what they are. A request stopped by
  a guardrail on an OpenRouter key, a credit hold on a new OpenRouter account
  and a key that has used up its own limit each read as a rejected key or an
  empty account before. An OpenAI cyber block passed on by OpenRouter is named
  as OpenAI's. Anthropic's refusal to write out a model's reasoning has its
  own notice, because another model does not get past it.
• The wait after a rate limit is said once, not twice.
• A GitHub import without a token reads the files from GitHub's file host,
  so fifty files no longer use up the 60 API calls an hour GitHub gives a
  visitor. A file kept in Git LFS is reported as a pointer, not imported as
  one.

MCP

• run_review can return two more values of blocked: guardrail and
  anthropic-reasoning.

Site

• The guide's "When the model refuses" entry says where blocks happen most
  and what we measured.
• /security says that with OpenRouter a review goes to OpenRouter and on to
  the model host it picks.
• The home page tells search engines the site's name. After a release the
  pages that changed are sent to IndexNow. A visit that comes from ChatGPT,
  Perplexity, Claude, Copilot or Gemini is counted under that name, and
  /privacy lists them.