Skip to main content
Glama
deenesjakoruzh
IAZENT

HuntX

Official
by IAZENT
OverviewSchemaRelated ServersScoreDiscussions
Python
Local

HuntX

Personal MCP (Model Context Protocol) server giving Claude Code (or any MCP-compatible client) direct tool-access to security-testing primitives for bug bounty hunting: recon querying/triggering, HTTP request replay, IDOR/BOLA fuzzing, SQLi/XSS/SSTI/SSRF detection, JWT/OAuth testing, secrets scanning, misconfiguration/exposure checks, and persistent hunt memory with confidence-scored findings across sessions.

Every finding gets a confidence level (confirmed/likely/ needs_review) and nothing auto-escalates without explicit human review — see AGENTS.md for the full design principles.

Requirements

  • Python 3.12+

  • uv

Optional external tools

Most adapters work standalone. A few shell out to external CLI tools — install these only if you need the corresponding adapter:

Adapter

Needs

secrets_scan

gitleaks, trufflehog on PATH

nuclei_scanner

nuclei on PATH (with templates: nuclei -update-templates)

recon_bridge / recon_trigger

reconFTW installed — recon_bridge reads its Recon/<domain>/ output, recon_trigger runs it directly

Related MCP server: recon-mcp

Setup

uv sync
uv run huntx

Then add HuntX as an MCP server in your Claude Code config, pointing at this project's huntx entrypoint.

Configuration (environment variables)

Variable

Default

Purpose

HUNTX_DB_PATH

~/.huntx/memory.db

SQLite database for request history and findings

HUNTX_OOB_SERVER

public interactsh pool (oast.pro)

Interactsh server for ssrf_scanner's out-of-band detection. Set this to a self-hosted interactsh-server instance before testing anything sensitive — the public pool's "zero logging" claim is unaudited, and any data a target leaks via SSRF transits that third-party server. Without this set, ssrf_scan logs a warning and flags oob_is_public_pool: true in its results so it's never silent.

Install Server
F
license - not found
A
quality
C
maintenance

How are these scores calculated?

Maintenance

–Maintainers
–Response time
–Release cycle
–Releases (12mo)
Commit activity

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Tools

View all tools

Related MCP Servers

  • Bug Bounty MCP Server

    akinabudu
    F
    license
    -
    quality
    D
    maintenance
    A comprehensive MCP server for automated bug bounty hunting and security reconnaissance, featuring over 28 specialized tools for subdomain discovery, vulnerability scanning, and traffic analysis. It integrates automated scope validation and professional reporting across multiple platforms like HackerOne and Bugcrowd to streamline security testing.
    5

  • recon-mcp

    tobiasGuta
    A
    license
    -
    quality
    B
    maintenance
    A local Python MCP server for safe, human-led bug bounty recon, providing lightweight helpers for scope checks, headers, robots.txt, sitemap.xml, JavaScript URL collection, endpoint extraction, URL deduplication, evidence notes, and manual test planning.
    MIT

  • Bug Bounty Assistant MCP

    rohitprasad-code
    A
    license
    A
    quality
    B
    maintenance
    An MCP server that provides passive and low-impact active reconnaissance tools for authorized bug bounty and security assessments, enabling LLMs to perform structured recon and generate reports.
    11
    Apache 2.0

  • BountyProof MCP

    skyxtools
    A
    license
    B
    quality
    C
    maintenance
    An MCP server for authorized bug bounty work that enforces an evidence-driven workflow with session management, preflight checks, surface discovery, and verified scanning.
    12
    MIT

View all related MCP servers

Related MCP Connectors

  • mcp-server

    MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.

  • MCP Fortress

    Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.

  • govern

    Hosted MCP server for agent governance: MCP config audits, injection scans, scope-policy checks.

View all MCP Connectors

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/IAZENT/HuntX'

If you have feedback or need assistance with the MCP directory API, please join our Discord server