# ToolMint Bounty Finder

> Live crypto/USDC bounties, grants, hackathons and bug bounties from public sources, as one clean JSON list.

- Status: Coming soon
- Price: $0.01 / call (x402 exact, USDC on Base eip155:8453, payTo 0xfbF7413bcB3a604936775C96FDbe0b0C9c9E37F5)
- Planned URL: https://toolmint-bounty-finder.toolmint.workers.dev
- OpenAPI: https://toolmint.toolmint.workers.dev/tools/bounty-finder-json/openapi.json

## Routes

- `GET /search` $0.01: Live crypto/USDC bounties, grants, hackathons and bug bounties (Superteam Earn, Immunefi, Devpost Blockchain) as one JSON list: payout + token + USD estimate, deadline, requirements (KYC, invite-only, location, agent access), source URL. Filters: kind, token, stablecoin, minUsd, dueWithinDays, noKyc, q, sort. Example: kind=bounty,grant&token=USDC&minUsd=500

## What question it answers

"What paid work is open right now in crypto, and what does it pay?" One call returns a merged list from Superteam Earn (bounties and grants), Immunefi (bug bounty programs) and Devpost (hackathons tagged Blockchain), in one JSON shape: payout, token, USD estimate where it can be stated honestly, deadline, requirements (KYC, invite-only, location, agent access) and a link to the source page.

## When to use it

- An agent looks for work it could take on, filtered by token (`token=USDC`), size (`minUsd=500`), urgency (`dueWithinDays=14`) or `noKyc=true`.
- You want one list instead of three site-specific scrapers.

## When not to

- It is a pointer to public listings, not an application service. Confirm payouts, deadlines and eligibility on the source page (`url`) before doing any work. Not financial advice.
- `usdEstimate` is `null` for non-stablecoin tokens and non-USD prizes. Hackathon prizes are usually fiat. For Immunefi, `usdEstimate` is the program's maximum bounty, which is a ceiling, not a typical payout.
- `noKyc=true` only drops items that state KYC is required. Many items say nothing (`kyc: null`) and are kept.
- Four sources only; it does not cover every bounty board.

## Example

```bash
curl -i "https://toolmint-bounty-finder.toolmint.workers.dev/search?kind=bounty,grant&token=USDC&minUsd=500&limit=5"
```
Unpaid, this returns HTTP 402. Trimmed 200 response shape (the item is the example from the Worker's discovery metadata, not a live listing):
```json
{
  "tool": "bounty-finder-json",
  "version": "0.1.0",
  "query": { "kinds": ["bounty", "grant"], "token": "USDC", "minUsd": 500, "status": "active", "sort": "deadline", "limit": 5 },
  "sources": [
    { "id": "superteam_bounties", "ok": true, "cached": false, "fetchedAt": "2026-10-31T...Z", "count": 40, "error": null },
    { "id": "superteam_grants",   "ok": true, "cached": false, "fetchedAt": "2026-10-31T...Z", "count": 12, "error": null }
  ],
  "generatedAt": "2026-10-31T...Z",
  "partial": false,
  "count": 1,
  "totalMatched": 1,
  "items": [{
    "id": "superteam:example-bounty",
    "source": "superteam_bounties",
    "kind": "bounty",
    "title": "Write a Solana Pay integration guide",
    "organizer": "Example Sponsor",
    "payout": { "amount": 1500, "minAmount": 1500, "maxAmount": 1500, "token": "USDC",
                "model": "fixed", "usdEstimate": 1500, "stablecoin": true },
    "deadline": "2026-11-15T23:59:59.000Z",
    "deadlinePrecision": "datetime",
    "status": "open",
    "requirements": { "kyc": null, "inviteOnly": null, "location": null, "agentAccess": "AGENT_ALLOWED",
                      "ecosystems": ["Solana"], "categories": [], "notes": [] },
    "url": "https://superteam.fun/earn/listing/example-bounty"
  }],
  "provenance": [{ "source": "superteam_bounties", "site": "https://superteam.fun/earn", "terms": "..." }],
  "notice": "Facts are pulled live from each public source and linked back; ToolMint is not affiliated with any source. ..."
}
```
The counts in `sources[]` above are placeholders. Other filters: `source`, `stablecoin`, `status` (`active`, `open`, `upcoming`), `q` (up to 80 chars), `sort` (`deadline`, `payout`, `newest`), `kind` (`bounty`, `grant`, `hackathon`, `bug_bounty`, `all`). The free `GET /sources` lists the sources and their terms notes.

## Data sources and licence

Fixed public endpoints at superteam.fun, immunefi.com and devpost.com. None states a data licence, so the tool returns facts (titles, amounts, dates, flags) and links back, and never copies program rules text. Check each source's terms for your own use. ToolMint is not affiliated with any of them.

## Freshness and limits

- Cached per source on a warm Worker instance: 10 minutes for Superteam bounties, 30 minutes for the others. `sources[].fetchedAt` tells you how old each source is.
- At most 100 items per call (default 25).
- Deadlines from Devpost are dates only (`deadlinePrecision: "date"`, no time zone).
- Superteam grants are rolling (`deadline: null`).