FBDL Goes Agentic: AI Agents Can Now Build Your Test Environments
Bringing FBDL into your AI-powered security research workflow
13 July 2026
By Meta Bug Bounty
We're excited to announce the release of an open-source Model Context Protocol (MCP) server for Facebook Bug Description Language (FBDL).
FBDL is a tool designed to help you quickly and efficiently set up security bug reproduction steps using a standard "bug" description language. FBDL is a solution to the long-standing challenge of reproducing the scenarios needed to demonstrate security issues.
This release, along with new API endpoints, will let security researchers manage FBDL runs programmatically. Together, these tools let you generate, validate and submit FBDL scripts entirely from your own AI environment, whether that's Claude Code, OpenAI Codex or any other MCP-compatible agent.
FBDL is a tool designed to help you quickly and efficiently set up security bug reproduction steps using a standard "bug" description language. FBDL is a solution to the long-standing challenge of reproducing the scenarios needed to demonstrate security issues.
This release, along with new API endpoints, will let security researchers manage FBDL runs programmatically. Together, these tools let you generate, validate and submit FBDL scripts entirely from your own AI environment, whether that's Claude Code, OpenAI Codex or any other MCP-compatible agent.
Automating the FBDL workflow
FBDL has always been about saving researchers time: instead of manually creating test users, Pages, groups and permissions through our UI, you write a short script and get a complete test environment in seconds. With this release, we're taking that a step further by making the entire FBDL workflow accessible to AI agents.
The MCP server runs locally on your machine and gives your AI assistant direct access to the FBDL language. You can ask it to generate scripts from natural language descriptions, validate them against the full grammar, explore available entities and actions, or explain what an existing script does. Combined with the new API endpoints, your agent can also submit scripts, check on run status and archive completed runs, all without opening a browser.
Here's what that looks like in practice: you describe the test environment you need ("two users who are friends, one owns a page, the other comments on a post and gets blocked"), your AI generates valid FBDL, validates it, submits it to Meta's infrastructure and reports back when the environment is ready.
The MCP server runs locally on your machine and gives your AI assistant direct access to the FBDL language. You can ask it to generate scripts from natural language descriptions, validate them against the full grammar, explore available entities and actions, or explain what an existing script does. Combined with the new API endpoints, your agent can also submit scripts, check on run status and archive completed runs, all without opening a browser.
Here's what that looks like in practice: you describe the test environment you need ("two users who are friends, one owns a page, the other comments on a post and gets blocked"), your AI generates valid FBDL, validates it, submits it to Meta's infrastructure and reports back when the environment is ready.
New API endpoints
We've added REST endpoints at /bug_bounty/fbdl_runs that support:
Full documentation with request examples is available on the FBDL token management page within your Bug Bounty settings.
- Creating new runs from validated FBDL scripts
- Listing your runs with cursor-based pagination
- Fetching individual run details including status and results
- Archiving completed runs
Full documentation with request examples is available on the FBDL token management page within your Bug Bounty settings.
Getting access
To use the FBDL API, you'll need an access token. Eligible researchers can generate one from the FBDL section. Access to FBDL requires meeting at least one of the following criteria within the last year:
As a reminder, we offer a 20% bonus (up to USDÂ 500) on eligible bug reports that include a useful FBDL script. Using the MCP to generate scripts for your submissions is a great way to qualify.
Once you have a token, pass it to the MCP server via the FBDL_API_TOKEN environment variable and you're ready to go.
- Reported a valid vulnerability to Meta
- Participated in a private bounty
- Participated in a Meta live hacking event
- Redeemed a Meta Bug Bounty engagement coupon
As a reminder, we offer a 20% bonus (up to USDÂ 500) on eligible bug reports that include a useful FBDL script. Using the MCP to generate scripts for your submissions is a great way to qualify.
Once you have a token, pass it to the MCP server via the FBDL_API_TOKEN environment variable and you're ready to go.
Getting started with the MCP server
The server is open source and available on GitHub. Install it, add it to your AI tool's MCP configuration and start asking your agent to write FBDL:
GitHub: https://github.com/GangGreenTemperTatum/fbdl-mcp
The repository includes setup instructions for Claude Code, OpenAI Codex and generic MCP agents. It also includes stand-alone Claude Code skills (/generate-fbdl and /validate-fbdl) that work without running the server, embedding the full FBDL spec as prompt context.
GitHub: https://github.com/GangGreenTemperTatum/fbdl-mcp
The repository includes setup instructions for Claude Code, OpenAI Codex and generic MCP agents. It also includes stand-alone Claude Code skills (/generate-fbdl and /validate-fbdl) that work without running the server, embedding the full FBDL spec as prompt context.
Retiring the FBDL web UI chatbot
With this release, we're retiring the built-in AI chatbot in the FBDL web editor. The MCP approach gives you more flexibility: you choose your own AI tool, you work in your own environment with full context of your research and you can chain FBDL generation into automated workflows. More importantly, this opens the door to fully agentic, automated security testing: your pentesting agents can now create test environments, execute research scenarios and manage runs autonomously without any manual intervention. The FBDL web editor itself remains available for manual use.
Built with the community
This project originated as an open-source initiative by researcher Ads Dawson during our 2026 Meta Bug Bounty Researcher Conference (MBBRC). Ads built the initial MCP server to help researchers generate and validate FBDL scripts with AI agents. We collaborated to extend the project with API integration, token management and full run lifecycle support, turning it into the end-to-end tool available today.
As recognition for this contribution, we awarded Ads a USD 1,000 bonus for enabling better testing capabilities for the entire community. We may occasionally recognise researchers who collaborate with us on tooling that meaningfully improves the ecosystem. When a collaboration produces real impact, we want to acknowledge it.
We believe that community-driven tooling like this makes the entire ecosystem stronger. If you have ideas for tools or integrations that would improve the security research experience on Meta, we'd love to hear from you.
We look forward to seeing how you put these tools to use. Happy hacking.
As recognition for this contribution, we awarded Ads a USD 1,000 bonus for enabling better testing capabilities for the entire community. We may occasionally recognise researchers who collaborate with us on tooling that meaningfully improves the ecosystem. When a collaboration produces real impact, we want to acknowledge it.
We believe that community-driven tooling like this makes the entire ecosystem stronger. If you have ideas for tools or integrations that would improve the security research experience on Meta, we'd love to hear from you.
We look forward to seeing how you put these tools to use. Happy hacking.