Skip to main content
Glama

Decepticon v3.1 — Autonomous Bug Bounty Hunt Bundle

One command, full pipeline. Skill methodology + MCP server + H1 auto-submit + profit tracking. Works with OpenCode, Claude Desktop, and any MCP-compatible AI agent.

Quick Install

npx decepticon           # Interactive setup wizard

or via npm:

npm install -g decepticon
decepticon setup

Related MCP server: BugBounty MCP Server

What You Get

Component

Purpose

Skill

Complete H1 bug bounty methodology — 3-wave pipeline, reasoning engine, 20+ exploitation playbooks

MCP Server

Real-time state coordination, credential vault, session management, payload generation

H1 Auto-Submit

Generate H1-ready reports with CVSS/CWE → auto-submit via REST API

Profit Tracking

Bounty ledger with 75%/15%/10% split — every dollar tracked

Dashboard

Live web dashboard at http://127.0.0.1:9999

Setup Wizard

Interactive CLI that configures everything in 3 prompts

Usage

# Setup (first time)
npx decepticon setup

# Start a hunt
opencode hunter
# Then type: HACK https://hackerone.com/program-handle

# View earnings
npx decepticon status

# Launch dashboard
npx decepticon dashboard

Profit Split

  • 75% — You (the hunter)

  • 15% — Decepticon platform

  • 10% — Referral partner

All tracked automatically in ~/.opencode/decepticon-state/bounty_ledger.json.

Requirements

  • Python 3.7+ (for MCP server)

  • OpenCode or Claude Desktop

  • Python 3.11+ recommended

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Related MCP Connectors

    Related MCP Servers

    • F
      license
      Not graded
      quality
      D
      maintenance
      A comprehensive MCP server for automated bug bounty hunting and security reconnaissance, featuring over 28 specialized tools for subdomain discovery, vulnerability scanning, and traffic analysis. It integrates automated scope validation and professional reporting across multiple platforms like HackerOne and Bugcrowd to streamline security testing.
      5
      -
    • A
      license
      Not graded
      quality
      D
      maintenance
      Enables automated bug bounty hunting and security research with tools for reconnaissance, web vulnerability scanning, API testing, binary analysis, and mobile app analysis through an MCP interface.
      MIT
    • A
      license
      B
      quality
      B
      maintenance
      Enables AI agents to conduct authorized pentests and bug-bounty workflows with scope enforcement, audit logging, reconnaissance, safe vulnerability checks, payload/wordlist generation, and professional report generation.
      14
      MIT
    • A
      license
      Not graded
      quality
      A
      maintenance
      Enables AI clients to drive professional penetration-testing workflows—subdomain enumeration, host probing, content fuzzing, vulnerability scanning, brute-force, traffic capture, and exploitation sweeps—through a single MCP interface with stdio, Streamable HTTP, and legacy SSE transports plus bearer/OIDC auth. It also records engagement artifacts and generates client-ready reports with scope handling, cutting manual pentest administration.
      165 npm
      GPL 3.0