MCP server intelligence profile

Bug Bounty MCP Server

Provides Claude Code with access to a comprehensive bug bounty knowledge base including techniques, payloads, wordlists, and real-world reports through 14 tools for searching, retrieving payloads, and assessing report quality

Local OnlyR-s0n
Awaiting current scanSource Git · 75811d634b29710c9471dd1d2022fd7b2c1bb2c7

The selected current version does not yet have completed public verification. Unknown does not mean clean or vulnerable.

1Distribution channel
14Independently observed tools
0Linked remote endpoints
AvailableVersion intelligence

Detailed security scan evidence is not public for this MCP yet. Public identity, registry metadata, and independently observed protocol inventory remain available.

Install and connect

Installation and connection instructions are shown only when supported by retained package, repository, or endpoint evidence.

No verified installation or connection method is available in the retained evidence yet.

Identity

Canonical slugbug-bounty-mcp-server-194bf725DeploymentLocal Only
Canonical package—RepositoryR-s0n/rs0n-bug-bounty-mcp-server
First published—Latest release—
Last security verification—Classification confidence35%
PublicationDraftOfficial distributionNot verified

Distributions

ChannelIdentifierCurrent versionVersionsSource
source_gitr-s0n/rs0n-bug-bounty-mcp-server75811d634b29710c9471dd1d2022fd7b2c1bb2c71Repository

Current release

PackageVersionPublished / observedInventorySecurity scan
source_gitr-s0n/rs0n-bug-bounty-mcp-server75811d634b29710c9471dd1d2022fd7b2c1bb2c7CurrentAug 25, 202614 toolsSucceeded · 0 resources · 0 promptsEvidence restricted
Enterprise protection

Continuously monitor this MCP for security risk

Independently scan the exact version your agents use, receive alerts when its risk changes, and investigate every finding with retained version evidence.

  • Independent exact-version security scans
  • Continuous release and vulnerability monitoring
  • Risk-change alerts with capability context
  • Historical evidence and API exports
Custom pricingContact salesTailored to your organization, integrations, data needs, and support requirements.

Current version evidence

No public current-version evidence is available yet.

Current protocol inventory

2025-06-18Negotiated protocol
bug-bounty-knowledgeServer-reported name
1Capability groups
Aug 25, 2026Observed

Tools 14

ToolCategoryAnnotationsRisk
assess_report_qualityEvaluate whether a potential bug bounty finding is likely to be accepted or rejected, based on historical patterns of accepted and rejected reports. Provide vulnerability details to get an assessment.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "vulnerability_type": {
      "type": "string",
      "description": "Type of vulnerability found, e.g., 'Reflected XSS', 'Open Redirect', 'IDOR'"
    },
    "description": {
      "type": "string",
      "description": "Description of the finding"
    },
    "impact": {
      "type": "string",
      "description": "Described impact of the vulnerability"
    },
    "requires_user_interaction": {
      "default": false,
      "description": "Whether exploitation requires user interaction",
      "type": "boolean"
    },
    "requires_authentication": {
      "default": false,
      "description": "Whether the attacker needs to be authenticated",
      "type": "boolean"
    }
  },
  "required": [
    "vulnerability_type",
    "description",
    "impact"
  ]
}
——
browse_knowledge_baseBrowse the directory structure of the bug bounty knowledge base. Use this to discover what topics and categories are available.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "path": {
      "default": "/",
      "description": "Directory path to browse, e.g., '/' for root, '/PayloadsAllTheThings' for payloads",
      "type": "string"
    }
  }
}
——
get_bounty_reportsGet real-world bug bounty reports, both accepted and rejected. Use accepted reports for methodology and impact examples. Use rejected reports to understand what NOT to submit.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "type": {
      "type": "string",
      "enum": [
        "accepted",
        "rejected"
      ],
      "description": "Whether to get accepted (valid) or rejected (invalid/informational) reports"
    },
    "vulnerability_class": {
      "description": "Optional: filter by vulnerability class, e.g., 'xss', 'ssrf', 'idor'",
      "type": "string"
    }
  },
  "required": [
    "type"
  ]
}
——
get_cloud_securityGet cloud-specific security testing information for AWS, Azure, GCP, and other cloud platforms.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "provider": {
      "type": "string",
      "enum": [
        "aws",
        "azure",
        "gcp",
        "kubernetes",
        "docker",
        "terraform",
        "general"
      ],
      "description": "Cloud provider or technology"
    },
    "topic": {
      "description": "Specific topic, e.g., 'privilege escalation', 'S3 misconfiguration', 'IAM'",
      "type": "string"
    }
  },
  "required": [
    "provider"
  ]
}
——
get_methodologyGet structured bug bounty testing methodology and checklists. Returns step-by-step approaches for testing specific vulnerability types or general web application testing.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "target_type": {
      "type": "string",
      "enum": [
        "web-app",
        "api",
        "mobile",
        "cloud",
        "network",
        "recon",
        "authentication",
        "authorization",
        "injection",
        "file-handling",
        "business-logic",
        "client-side"
      ],
      "description": "Type of target or testing phase"
    }
  },
  "required": [
    "target_type"
  ]
}
——
get_payloadsGet payloads and attack vectors for a specific vulnerability category. Returns relevant payload lists, bypass techniques, and exploitation methods from PayloadsAllTheThings and HackTricks.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "category": {
      "type": "string",
      "enum": [
        "xss",
        "sqli",
        "ssrf",
        "rce",
        "idor",
        "csrf",
        "xxe",
        "ssti",
        "lfi",
        "upload",
        "auth",
        "deserialization",
        "race-condition",
        "open-redirect",
        "cors",
        "crlf",
        "graphql",
        "api",
        "subdomain-takeover",
        "oauth",
        "websocket",
        "prototype-pollution",
        "nosql",
        "ldap",
        "xpath"
      ],
      "description": "Vulnerability category"
    },
    "specific_topic": {
      "description": "Optional: narrow down to a specific sub-topic, e.g., 'blind' for blind SQLi, 'DOM' for DOM XSS",
      "type": "string"
    }
  },
  "required": [
    "category"
  ]
}
——
get_recommended_wordlistGet a recommended wordlist for a specific testing task. Returns the best SecLists wordlist based on common bug bounty use cases.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "task": {
      "type": "string",
      "enum": [
        "directory-bruteforce",
        "directory-bruteforce-large",
        "subdomain-enum",
        "subdomain-enum-large",
        "api-endpoints",
        "api-fuzzing",
        "parameter-discovery",
        "parameter-bruteforce",
        "vhost-discovery",
        "sqli-fuzzing",
        "xss-fuzzing",
        "lfi-fuzzing",
        "ssti-fuzzing",
        "password-common",
        "password-large",
        "username-enum",
        "backup-files",
        "config-files",
        "jwt-secrets",
        "general-fuzzing"
      ],
      "description": "The testing task you need a wordlist for"
    },
    "head": {
      "description": "Only return the first N lines (useful for large lists)",
      "type": "number"
    }
  },
  "required": [
    "task"
  ]
}
——
get_rs0n_methodologyGet rs0n's (Harrison Richardson) battle-tested bug bounty methodology from the DEFCON 32 Bug Bounty Village workshop. This is the PRIMARY methodology that should guide all testing. Covers four pillars: Recon, Injection, Logic, and Cloud.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "pillar": {
      "type": "string",
      "enum": [
        "recon",
        "injection",
        "logic",
        "cloud",
        "overview",
        "skills"
      ],
      "description": "Which pillar of the methodology to retrieve"
    }
  },
  "required": [
    "pillar"
  ]
}
——
get_waf_bypassGet WAF (Web Application Firewall) bypass techniques for specific vulnerability types.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "vulnerability_type": {
      "type": "string",
      "description": "The vulnerability type to bypass WAF for, e.g., 'xss', 'sqli', 'ssrf'"
    }
  },
  "required": [
    "vulnerability_type"
  ]
}
——
get_wordlistGet the contents of a specific SecLists wordlist file. Use this to retrieve wordlists for directory brute-forcing, fuzzing, subdomain enumeration, or other testing tasks.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "path": {
      "type": "string",
      "description": "Path to the wordlist relative to SecLists root, e.g., 'Discovery/Web-Content/common.txt' or 'Fuzzing/SQLi/Generic-SQLi.txt'"
    },
    "head": {
      "description": "Only return the first N lines of the wordlist (useful for large files)",
      "type": "number"
    }
  },
  "required": [
    "path"
  ]
}
——
list_wordlistsBrowse available SecLists wordlists by category. Returns directory listings of available wordlists for directory brute-forcing, subdomain enumeration, fuzzing, password testing, and more.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "category": {
      "type": "string",
      "enum": [
        "Discovery/Web-Content",
        "Discovery/DNS",
        "Discovery/Infrastructure",
        "Fuzzing",
        "Passwords",
        "Usernames",
        "Pattern-Matching",
        "Payloads",
        "Miscellaneous"
      ],
      "description": "SecLists category to browse"
    },
    "subdirectory": {
      "description": "Optional subdirectory within the category to drill into",
      "type": "string"
    }
  },
  "required": [
    "category"
  ]
}
——
read_knowledge_fileRead a specific file from the bug bounty knowledge base. Use this after searching to read the full content of a relevant file.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "path": {
      "type": "string",
      "description": "Relative path within the knowledge base, e.g., '/PayloadsAllTheThings/XSS Injection/README.md'"
    }
  },
  "required": [
    "path"
  ]
}
——
search_techniquesSearch the entire bug bounty knowledge base for techniques, payloads, and methodologies. Use this to find information about specific vulnerability types, attack techniques, bypass methods, or security testing approaches.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "query": {
      "type": "string",
      "description": "Search query - e.g., 'XSS WAF bypass', 'SSRF cloud metadata', 'JWT none algorithm'"
    },
    "source": {
      "default": "all",
      "description": "Which knowledge source to search",
      "type": "string",
      "enum": [
        "all",
        "payloads",
        "hacktricks",
        "hacktricks-cloud",
        "reports",
        "methodology",
        "rs0n-methodology"
      ]
    },
    "maxResults": {
      "default": 10,
      "description": "Maximum number of results to return",
      "type": "number"
    }
  },
  "required": [
    "query"
  ]
}
——
search_wordlistsSearch for wordlists across SecLists by filename or keyword. Use this to find the right wordlist for a specific testing task.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "query": {
      "type": "string",
      "description": "Search query to match against wordlist filenames, e.g., 'common', 'api', 'subdomain', 'sqli', 'traversal'"
    },
    "category": {
      "description": "Optional: limit search to a specific top-level category like 'Discovery', 'Fuzzing', 'Passwords'",
      "type": "string"
    }
  },
  "required": [
    "query"
  ]
}
——

Resources 0

  • None observed.

Resource templates 0

  • None observed.

Prompts 0

  • None observed.

Remote endpoints

EndpointTransportAuthenticationHealthObserved
No verified remote endpoint is linked.

Bug Bounty MCP Server questions

How do I install Bug Bounty MCP Server?

No verified package installation command is available in the retained catalog evidence.

What tools does Bug Bounty MCP Server provide?

Bug Bounty MCP Server exposed 14 tools during independent protocol observation, including assess_report_quality, browse_knowledge_base, get_bounty_reports, get_cloud_security, get_methodology, get_payloads, get_recommended_wordlist, get_rs0n_methodology, and others.

Is Bug Bounty MCP Server secure?

The selected current version does not yet have completed public verification. Unknown does not mean clean or vulnerable.

Explore related MCP server guides

Curated product and capability guides containing this catalog record.

Official vs Community MCP Servers

Let’s talk about MCP security.

Share your details and our security team will contact you.