← Bug Bounty MCP Server

Bug Bounty MCP Server 75811d634b29710c9471dd1d2022fd7b2c1bb2c7

source_git · r-s0n/rs0n-bug-bounty-mcp-server · current release

14
Tools
0
Resources
0
Templates
0
Prompts

Observation

Observed 2026-08-25T09:03:12.722Z using mcpSecurity-inventory. Status: succeeded. Negotiated protocol: 2025-06-18.

Server capabilities
{
  "tools": {
    "listChanged": true
  }
}

Tools 14

ToolCategoryAnnotationsRisk
assess_report_qualityEvaluate whether a potential bug bounty finding is likely to be accepted or rejected, based on historical patterns of accepted and rejected reports. Provide vulnerability details to get an assessment.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "vulnerability_type": {
      "type": "string",
      "description": "Type of vulnerability found, e.g., 'Reflected XSS', 'Open Redirect', 'IDOR'"
    },
    "description": {
      "type": "string",
      "description": "Description of the finding"
    },
    "impact": {
      "type": "string",
      "description": "Described impact of the vulnerability"
    },
    "requires_user_interaction": {
      "default": false,
      "description": "Whether exploitation requires user interaction",
      "type": "boolean"
    },
    "requires_authentication": {
      "default": false,
      "description": "Whether the attacker needs to be authenticated",
      "type": "boolean"
    }
  },
  "required": [
    "vulnerability_type",
    "description",
    "impact"
  ]
}
—— · ——
browse_knowledge_baseBrowse the directory structure of the bug bounty knowledge base. Use this to discover what topics and categories are available.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "path": {
      "default": "/",
      "description": "Directory path to browse, e.g., '/' for root, '/PayloadsAllTheThings' for payloads",
      "type": "string"
    }
  }
}
—— · ——
get_bounty_reportsGet real-world bug bounty reports, both accepted and rejected. Use accepted reports for methodology and impact examples. Use rejected reports to understand what NOT to submit.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "type": {
      "type": "string",
      "enum": [
        "accepted",
        "rejected"
      ],
      "description": "Whether to get accepted (valid) or rejected (invalid/informational) reports"
    },
    "vulnerability_class": {
      "description": "Optional: filter by vulnerability class, e.g., 'xss', 'ssrf', 'idor'",
      "type": "string"
    }
  },
  "required": [
    "type"
  ]
}
—— · ——
get_cloud_securityGet cloud-specific security testing information for AWS, Azure, GCP, and other cloud platforms.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "provider": {
      "type": "string",
      "enum": [
        "aws",
        "azure",
        "gcp",
        "kubernetes",
        "docker",
        "terraform",
        "general"
      ],
      "description": "Cloud provider or technology"
    },
    "topic": {
      "description": "Specific topic, e.g., 'privilege escalation', 'S3 misconfiguration', 'IAM'",
      "type": "string"
    }
  },
  "required": [
    "provider"
  ]
}
—— · ——
get_methodologyGet structured bug bounty testing methodology and checklists. Returns step-by-step approaches for testing specific vulnerability types or general web application testing.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "target_type": {
      "type": "string",
      "enum": [
        "web-app",
        "api",
        "mobile",
        "cloud",
        "network",
        "recon",
        "authentication",
        "authorization",
        "injection",
        "file-handling",
        "business-logic",
        "client-side"
      ],
      "description": "Type of target or testing phase"
    }
  },
  "required": [
    "target_type"
  ]
}
—— · ——
get_payloadsGet payloads and attack vectors for a specific vulnerability category. Returns relevant payload lists, bypass techniques, and exploitation methods from PayloadsAllTheThings and HackTricks.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "category": {
      "type": "string",
      "enum": [
        "xss",
        "sqli",
        "ssrf",
        "rce",
        "idor",
        "csrf",
        "xxe",
        "ssti",
        "lfi",
        "upload",
        "auth",
        "deserialization",
        "race-condition",
        "open-redirect",
        "cors",
        "crlf",
        "graphql",
        "api",
        "subdomain-takeover",
        "oauth",
        "websocket",
        "prototype-pollution",
        "nosql",
        "ldap",
        "xpath"
      ],
      "description": "Vulnerability category"
    },
    "specific_topic": {
      "description": "Optional: narrow down to a specific sub-topic, e.g., 'blind' for blind SQLi, 'DOM' for DOM XSS",
      "type": "string"
    }
  },
  "required": [
    "category"
  ]
}
—— · ——
get_recommended_wordlistGet a recommended wordlist for a specific testing task. Returns the best SecLists wordlist based on common bug bounty use cases.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "task": {
      "type": "string",
      "enum": [
        "directory-bruteforce",
        "directory-bruteforce-large",
        "subdomain-enum",
        "subdomain-enum-large",
        "api-endpoints",
        "api-fuzzing",
        "parameter-discovery",
        "parameter-bruteforce",
        "vhost-discovery",
        "sqli-fuzzing",
        "xss-fuzzing",
        "lfi-fuzzing",
        "ssti-fuzzing",
        "password-common",
        "password-large",
        "username-enum",
        "backup-files",
        "config-files",
        "jwt-secrets",
        "general-fuzzing"
      ],
      "description": "The testing task you need a wordlist for"
    },
    "head": {
      "description": "Only return the first N lines (useful for large lists)",
      "type": "number"
    }
  },
  "required": [
    "task"
  ]
}
—— · ——
get_rs0n_methodologyGet rs0n's (Harrison Richardson) battle-tested bug bounty methodology from the DEFCON 32 Bug Bounty Village workshop. This is the PRIMARY methodology that should guide all testing. Covers four pillars: Recon, Injection, Logic, and Cloud.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "pillar": {
      "type": "string",
      "enum": [
        "recon",
        "injection",
        "logic",
        "cloud",
        "overview",
        "skills"
      ],
      "description": "Which pillar of the methodology to retrieve"
    }
  },
  "required": [
    "pillar"
  ]
}
—— · ——
get_waf_bypassGet WAF (Web Application Firewall) bypass techniques for specific vulnerability types.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "vulnerability_type": {
      "type": "string",
      "description": "The vulnerability type to bypass WAF for, e.g., 'xss', 'sqli', 'ssrf'"
    }
  },
  "required": [
    "vulnerability_type"
  ]
}
—— · ——
get_wordlistGet the contents of a specific SecLists wordlist file. Use this to retrieve wordlists for directory brute-forcing, fuzzing, subdomain enumeration, or other testing tasks.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "path": {
      "type": "string",
      "description": "Path to the wordlist relative to SecLists root, e.g., 'Discovery/Web-Content/common.txt' or 'Fuzzing/SQLi/Generic-SQLi.txt'"
    },
    "head": {
      "description": "Only return the first N lines of the wordlist (useful for large files)",
      "type": "number"
    }
  },
  "required": [
    "path"
  ]
}
—— · ——
list_wordlistsBrowse available SecLists wordlists by category. Returns directory listings of available wordlists for directory brute-forcing, subdomain enumeration, fuzzing, password testing, and more.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "category": {
      "type": "string",
      "enum": [
        "Discovery/Web-Content",
        "Discovery/DNS",
        "Discovery/Infrastructure",
        "Fuzzing",
        "Passwords",
        "Usernames",
        "Pattern-Matching",
        "Payloads",
        "Miscellaneous"
      ],
      "description": "SecLists category to browse"
    },
    "subdirectory": {
      "description": "Optional subdirectory within the category to drill into",
      "type": "string"
    }
  },
  "required": [
    "category"
  ]
}
—— · ——
read_knowledge_fileRead a specific file from the bug bounty knowledge base. Use this after searching to read the full content of a relevant file.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "path": {
      "type": "string",
      "description": "Relative path within the knowledge base, e.g., '/PayloadsAllTheThings/XSS Injection/README.md'"
    }
  },
  "required": [
    "path"
  ]
}
—— · ——
search_techniquesSearch the entire bug bounty knowledge base for techniques, payloads, and methodologies. Use this to find information about specific vulnerability types, attack techniques, bypass methods, or security testing approaches.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "query": {
      "type": "string",
      "description": "Search query - e.g., 'XSS WAF bypass', 'SSRF cloud metadata', 'JWT none algorithm'"
    },
    "source": {
      "default": "all",
      "description": "Which knowledge source to search",
      "type": "string",
      "enum": [
        "all",
        "payloads",
        "hacktricks",
        "hacktricks-cloud",
        "reports",
        "methodology",
        "rs0n-methodology"
      ]
    },
    "maxResults": {
      "default": 10,
      "description": "Maximum number of results to return",
      "type": "number"
    }
  },
  "required": [
    "query"
  ]
}
—— · ——
search_wordlistsSearch for wordlists across SecLists by filename or keyword. Use this to find the right wordlist for a specific testing task.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "query": {
      "type": "string",
      "description": "Search query to match against wordlist filenames, e.g., 'common', 'api', 'subdomain', 'sqli', 'traversal'"
    },
    "category": {
      "description": "Optional: limit search to a specific top-level category like 'Discovery', 'Fuzzing', 'Passwords'",
      "type": "string"
    }
  },
  "required": [
    "query"
  ]
}
—— · ——

Resources 0

Resource templates 0

Prompts 0

Let’s talk about MCP security.

Share your details and our security team will contact you.