HuntX

Personal MCP (Model Context Protocol) server giving Claude Code (or any MCP-compatible client) direct tool-access to security-testing primitives for bug bounty hunting: recon querying/triggering, HTTP request replay, IDOR/BOLA fuzzing, SQLi/XSS/SSTI/SSRF detection, JWT/OAuth testing, secrets scanning, misconfiguration/exposure checks, and persistent hunt memory with confidence-scored findings across sessions.

Every finding gets a confidence level (confirmed/likely/ needs_review) and nothing auto-escalates without explicit human review — see AGENTS.md for the full design principles.

Requirements

Python 3.12+
uv

Optional external tools

Most adapters work standalone. A few shell out to external CLI tools — install these only if you need the corresponding adapter:

Adapter	Needs
`secrets_scan`	`gitleaks`, `trufflehog` on PATH
`nuclei_scanner`	`nuclei` on PATH (with templates: `nuclei -update-templates`)
`recon_bridge` / `recon_trigger`	reconFTW installed — `recon_bridge` reads its `Recon/<domain>/` output, `recon_trigger` runs it directly

Setup

uv sync
uv run huntx

Then add HuntX as an MCP server in your Claude Code config, pointing at this project's huntx entrypoint.

Configuration (environment variables)

Variable	Default	Purpose
`HUNTX_DB_PATH`	`~/.huntx/memory.db`	SQLite database for request history and findings
`HUNTX_OOB_SERVER`	public interactsh pool (`oast.pro`)	Interactsh server for `ssrf_scanner`'s out-of-band detection. Set this to a self-hosted interactsh-server instance before testing anything sensitive — the public pool's "zero logging" claim is unaudited, and any data a target leaks via SSRF transits that third-party server. Without this set, `ssrf_scan` logs a warning and flags `oob_is_public_pool: true` in its results so it's never silent.

HuntX

HuntX

Requirements

Optional external tools

Setup

Configuration (environment variables)

Latest Blog Posts

MCP directory API