██████╗  ██████╗ ██╗   ██╗███╗   ██╗████████╗██╗   ██╗
██╔══██╗██╔═══██╗██║   ██║████╗  ██║╚══██╔══╝╚██╗ ██╔╝
██████╔╝██║   ██║██║   ██║██╔██╗ ██║   ██║    ╚████╔╝
██╔══██╗██║   ██║██║   ██║██║╚██╗██║   ██║     ╚██╔╝
██████╔╝╚██████╔╝╚██████╔╝██║ ╚████║   ██║      ██║
╚═════╝  ╚═════╝  ╚═════╝ ╚═╝  ╚═══╝   ╚═╝      ╚═╝
        ██╗  ██╗██╗   ██╗███╗   ██╗████████╗███████╗██████╗
        ██║  ██║██║   ██║████╗  ██║╚══██╔══╝██╔════╝██╔══██╗
        ███████║██║   ██║██╔██╗ ██║   ██║   █████╗  ██████╔╝
        ██╔══██║██║   ██║██║╚██╗██║   ██║   ██╔══╝  ██╔══██╗
        ██║  ██║╚██████╔╝██║ ╚████║   ██║   ███████╗██║  ██║
        ╚═╝  ╚═╝ ╚═════╝ ╚═╝  ╚═══╝   ╚═╝   ╚══════╝╚═╝  ╚═╝

Give your AI superpowers for bug bounty hunting.

An MCP server that turns Claude Code into a structured bug bounty toolkit — recon, live testing, intelligence, and report generation in single tool calls.

tools 10 prompts 2 frameworks 9 CVSS 3.1 MIT

$ git clone https://github.com/L-ubu/bounty-hunter-mcp.git && cd bounty-hunter-mcp && uv sync

GitHub· The problem· Features· Tools· Why

01Spend tokens on thinking, not plumbing

Bug bounty hunting with AI burns tokens on repetitive grunt work. This toolkit compresses each workflow into one structured call.

before / after

WITHOUT                              WITH
10+ Read/Grep calls to map surface   1 map_surface call
Manual curl for CORS/headers/auth    1 test_endpoint call
Browsing NVD + advisories by hand    1 check_vulns call
Reports written from scratch         1 make_report call, auto CVSS
Context lost between sessions        note tool persists across sessions
Re-cloning repos manually            auto-clone to ~/Projects/bounty-targets/

02What you get

◆ Structured recon

map_surface returns routes, sinks and dependencies as structured data — not raw file dumps your model drowns in.

◆ Live endpoint testing

CORS, headers, auth and SSRF checks via test_endpoint — one call instead of a dozen curl incantations.

◆ Vulnerability intel

NVD and GitHub advisories queried together by check_vulns, cached in a local SQLite store.

◆ Auto-CVSS reports

make_report turns findings into a submission-ready report with CVSS 3.1 scoring baked in.

◆ Persistent memory

The note tool keeps investigation context across sessions. Pick up Tuesday's hunt on Friday.

◆ Auto-clone targets

Point it at a repo and it lands in ~/Projects/bounty-targets/, indexed and ready to hunt.

03The toolkit

Recon, testing, and intel — wired into one SQLite-backed brain.

Tool	One call replaces
`map_surface`	Reading a whole repo to find routes, sinks, attack surface
`test_endpoint`	Manual CORS, header and auth probing with curl
`check_vulns`	Cross-referencing NVD and GitHub advisories by hand
`make_report`	Writing up findings + calculating CVSS from scratch
`note`	Losing your investigation state between sessions

04Why it exists

The decisions worth knowing about, written down.

AI is a great hunter with bad habits

Left alone, an agent greps itself into context bankruptcy. Structured tools keep its budget aimed at actual analysis.

Everything lands in SQLite

Notes, cache, repos, vulns — one local store. No cloud, no account, and your target data never leaves the machine.

Built on real hunts

The workflow mirrors actual Intigriti/HackerOne methodology: recon → test → verify → report. Nothing decorative.