Bug Bounty MCP Server

An MCP (Model Context Protocol) server that gives Claude Code access to a comprehensive bug bounty hunting knowledge base. Includes techniques, payloads, wordlists, real-world reports, and structured methodology.

Quick Start

# Install dependencies
npm install

# Clone knowledge base repos (PayloadsAllTheThings, HackTricks, HackTricks-Cloud, SecLists, DEFCON32 workshop)
npm run clone-repos

# Build
npm run build

# Run (stdio mode, default)
npm start

Add to Claude Code

Add to your Claude Code MCP config (~/.claude/settings.json or project .claude/settings.json):

{
  "mcpServers": {
    "bug-bounty-knowledge": {
      "command": "node",
      "args": ["/path/to/rs0n-bug-bounty-mcp-server/dist/index.js"]
    }
  }
}

The server uses stdio transport (no port needed), so there are no port conflicts with other MCP servers.

Tools (14)

Knowledge Base Sources

• PayloadsAllTheThings - Payload lists and bypass techniques

• HackTricks - Comprehensive pentesting wiki

• HackTricks-Cloud - Cloud security testing

• SecLists - Wordlists for fuzzing, brute-forcing, and enumeration

• DEFCON32 Workshop - rs0n's battle-tested methodology

• 778+ curated bug bounty reports (accepted) with detailed writeups

• Rejected report patterns - What NOT to submit

Updating Knowledge Base

# Pull latest from all repos
npm run clone-repos