Skip to main content
Glama

Related Servers

Alternatives to BugSecure MCP

No user-submitted related servers found.

    Related Servers

    • A
      license
      Not graded
      quality
      B
      maintenance
      Enables authorized bug bounty automation via a scope-enforced MCP bridge, supporting web, secrets, mobile, and LLM red-team scanning, with reporting and advisory.
      MIT
    • A
      license
      Not graded
      quality
      D
      maintenance
      Enables automated bug bounty hunting and security research with tools for reconnaissance, web vulnerability scanning, API testing, binary analysis, and mobile app analysis through an MCP interface.
      MIT
    • A
      license
      Not graded
      quality
      B
      maintenance
      Enables MCP clients to carry out a compliant, non-destructive, auditable authorized security-testing workflow — project intake, scope reading, asset discovery, non-destructive verification, evidence collection, and report-draft generation with manual submission tracking — where every outbound action is gated by scope checks, one-time human confirmation tokens, rate limits, and append-only audit logging.
      MIT
    • A
      license
      B
      quality
      D
      maintenance
      An MCP server for authorized bug bounty work that enforces an evidence-driven workflow with session management, preflight checks, surface discovery, and verified scanning.
      12
      MIT
    • A
      license
      C
      quality
      B
      maintenance
      Enables authorized pentest and bug bounty workflows from any MCP client, with scoped recon, per-host rate limits, and scanner output turned into deduplicated, triaged finding cards.
      9
      22 PyPI
      2
      MIT
    • F
      license
      Not graded
      quality
      D
      maintenance
      Wraps multiple bug bounty platform APIs (HackerOne, Bugcrowd, etc.) behind a uniform MCP tool surface, enabling LLM agents to query programs, scope, and briefs across platforms through a single interface.
      -

    TDQS

    A4/5.0

    Scored across 33 tools

    Disambiguation3/5

    Several tool pairs overlap by naming and purpose, such as get_report vs get_org_report, list_my_reports vs list_org_reports, and add_report_comment vs add_triage_comment. The descriptions do clearly distinguish researcher-side, organisation-side, and opt-in scopes, but an agent skimming names could misselect without reading them carefully.

    Naming Consistency4/5

    Most tools follow a consistent snake_case verb_noun pattern (list_, get_, add_, update_, assign_, verify_, etc.) with useful my/org/triage scope prefixes. Minor deviations like the bare search tool and compound names such as mark_notifications_read keep it from being perfect.

    Tool Count2/5

    At 33 tools, the surface is heavy and includes many near-duplicate list/get variants for reports, certificates, profiles, programmes, and stats. The dual researcher/organisation scope explains some breadth, but the count exceeds a well-scoped set and raises misselection risk.

    Completeness4/5

    The set covers core researcher workflows (submit, read, comment, appeal, disclose, certificates, notifications, profile) and organisation triage workflows (read, grade, comment, assign, status, stats, certificates). Some operations are intentionally website-only, such as attachments, disclosure publishing/approval, programme creation, settlement claims, and organisation-side appeals, leaving minor but real gaps.

    Maintenance

    ActivityMaintained
    ResponsivenessNo issues