Provides secure access to the Bugcrowd bug bounty platform API, enabling tools for managing organizations, programs, vulnerability submissions, reports, assets, rewards, and users.
Enables OpenAI Codex to interact with the Bugcrowd bug bounty platform for security research and vulnerability management.
BugcrowdMCP: Server & Agents for the Bugcrowd API
A high-performance MCP (Model Context Protocol) server that provides secure, tool-based access to the Bugcrowd API, allowing for natural language interaction through various AI agent platforms.
Features
- Broad API Coverage: Provides tools for interacting with Organizations, Programs, Submissions, Assets, and more.
- Multi-Agent Support: Includes ready-to-use agents for OpenAI, Anthropic (Claude), Google (Gemini), and FastMCP.
- Extensible & Customizable: Easily switch between AI providers, configure different models, and integrate with platform-specific CLIs.
- Secure: Uses environment variables for API credentials and performs input validation.
- Dynamic Help: Includes a
help()
tool that provides real-time documentation for all available tools.
Quick Start
This guide will get you up and running with the default agent (openai
).
1. Prerequisites
- Python 3.10+
uv
for package installation.
2. Installation
Clone the repository, create a virtual environment, and install dependencies.
3. Configuration
Export your Bugcrowd and OpenAI API credentials as environment variables.
4. Run the Agent
Start the interactive agent.
You can now interact with the Bugcrowd API using natural language.
Example Prompts:
- "Show me available bug bounty programs"
- "What are the 5 most recent vulnerability submissions?"
- "Use the help tool to see all available commands"
Advanced Usage
Switching Agents
The true power of this server lies in its flexibility. You can easily switch between supported AI platforms by setting the AGENT_PLATFORM
environment variable.
- Supported platforms:
openai
(default),claude
,gemini
,fastmcp
.
Remember to set the appropriate API key for the agent you choose.
Example: Running the Gemini Agent
Example: Running the Claude Agent
Using the FastMCP Agent
The fastmcp
agent is a versatile client that can use different LLM backends. Configure it by setting the FASTMCP_PROVIDER
environment variable.
- Supported providers:
anthropic
(default),google
,openai
.
Example: Running FastMCP with the Google (Gemini) Backend
Customizing Agent Models
You can override the default models for each agent by setting environment variables:
- Claude:
CLAUDE_MAIN_MODEL
,CLAUDE_SUMMARY_MODEL
- Gemini:
GEMINI_MAIN_MODEL
,GEMINI_SUMMARY_MODEL
- OpenAI:
OPENAI_MODEL
Available Tools
The server provides the following tools. For detailed parameter information, run the agent and use the help()
tool (e.g., help('get_submission')
).
Category | Tool | Description |
---|---|---|
Organizations | get_organizations | List all accessible organizations |
get_organization | Get specific organization details | |
Programs | get_programs | List bug bounty programs |
get_program | Get specific program details | |
Submissions | get_submissions | List vulnerability submissions |
get_submission | Get specific submission details | |
create_submission | Create a new vulnerability report | |
update_submission | Update an existing submission | |
create_comment | Add a comment to a submission | |
Teams | get_teams | List all teams in an organization |
create_team | Create a new team | |
delete_team | Delete a team | |
Rewards | get_monetary_rewards | List bounty rewards |
create_monetary_reward | Create a new monetary reward | |
update_monetary_reward | Update an existing monetary reward | |
Users | get_users | List users in an organization |
get_user | Get specific user details | |
Health | server_health | Check server and API connectivity |
Help | help | Get detailed help for any tool |
Direct Integration
For integration with platform-specific CLIs (bypassing the included agent handlers), use the provided configuration templates.
- For OpenAI (
codex
): Usedocs/config.toml
. - For Gemini, Claude, etc.: Use
docs/config.json
.
Instructions:
- Copy the appropriate template file to your tool's configuration directory (e.g.,
~/.codex/config.toml
). - In the copied file, update the
cwd
variable to the absolute path of theBugcrowd_MCP_Server
project directory.
Documentation
- API Reference: A static reference for all tool and endpoint details.
- Architecture Diagram: An overview of the system architecture.
- Bugcrowd REST API: The official API documentation that this server is built upon.
For more detailed information on MCP server configuration, refer to the official documentation for your platform:
- OpenAI: Codex MCP Server Configuration
- Google Gemini: Configure MCP Servers
- Anthropic Claude: MCP for Claude
- FastMCP: JSON Configuration and Running a Server
remote-capable server
The server can be hosted and run remotely because it primarily relies on remote services or has no dependency on the local environment.
Tools
Provides secure access to the Bugcrowd bug bounty platform API, optimized for OpenAI's Agents SDK integration to enable vulnerability management and security research.
Related MCP Servers
- -securityFlicense-qualityEnables AI agent and task management using the CrewAI framework, allowing users to create and run agents and tasks in an automated workflow environment.Last updated -03JavaScript
- -securityAlicense-qualityA proxy server that bridges AI agents and external APIs by dynamically translating OpenAPI specifications into standardized MCP tools, enabling seamless interaction without custom integration code.Last updated -53PythonMIT License
- AsecurityFlicenseAqualityA modern AI service proxy that enables interaction with multiple AI providers (Anthropic Claude, OpenAI) through a unified API, deployed globally using Cloudflare Workers.Last updated -5423TypeScript
- -securityFlicense-qualityEnables searching for AI agents by keywords or categories, allowing users to discover tools like coding agents, GUI agents, or industry-specific assistants across marketplaces.Last updated -34Python