The HackerOne MCP Server enables bug bounty hunters to manage their HackerOne activities through Claude Code or other MCP clients, providing read and write access to reports, programs, earnings, and scope data via the HackerOne API.
Report Management:
Search and filter reports by keyword, program, severity, or state
Retrieve full report details (title, CVSS vectors, bounty amounts, timestamps, attachments)
View complete triage conversation threads
Browse activity timelines (comments, state changes, bounty awards)
Submit new vulnerability reports, add comments, or withdraw/close your own reports
Program Exploration:
List all bug bounty programs you have access to
Retrieve in-scope assets (asset types, bounty eligibility, severity caps)
Get accepted vulnerability/weakness types (CWEs) for a specific program
Earnings & Profile:
View bounty earnings history (amounts, currency, dates) and current balance
Retrieve your hacker profile (reputation, signal, impact, rank)
Analytics:
Analyze your hunting patterns: severity distribution, top programs, common weakness types, and resolution rates
Search publicly disclosed reports on HackerOne's hacktivity for reconnaissance and learning
Technical Highlights:
Connects via the HackerOne Hacker API v1 using a personal API token; credentials stay local
Auto-paginates results, uses server-side filters for faster searches
Built-in retry with exponential backoff for rate limiting and a 60-second response cache
Provides tools for interacting with the HackerOne API to manage vulnerability reports, bug bounty programs, and earnings, including capabilities to submit findings, respond to triage, and analyze hunting patterns.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@HackerOne MCP Server What assets are in scope for the Uber bug bounty program?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Disclaimer: This is an unofficial, community-built project. It is not affiliated with, endorsed by, or maintained by HackerOne. "HackerOne" is a trademark of HackerOne, Inc. This project simply integrates with their publicly documented Hacker API.
MCP server that gives Claude Code (or any MCP client) full access to your HackerOne reports, programs, earnings, and scope data via the HackerOne API — including submitting reports and responding to triage.
Go to HackerOne > Settings > API Token and generate one.
git clone https://github.com/Sicks3c/hackerone-mcp-server.git
cd hackerone-mcp-server
npm install
npm run buildclaude mcp add hackerone \
-e H1_USERNAME=your-username \
-e H1_API_TOKEN=your-api-token \
-s user \
-- node /path/to/hackerone-mcp-server/dist/index.jsOr add manually to ~/.claude.json:
{
"mcpServers": {
"hackerone": {
"command": "node",
"args": ["/path/to/hackerone-mcp-server/dist/index.js"],
"env": {
"H1_USERNAME": "your-username",
"H1_API_TOKEN": "your-api-token"
}
}
}
}claude
> /mcp
# You should see "hackerone" listed with 16 toolsRelated MCP server: h1-brain
Tool | Description |
| Search and filter your reports by keyword, program, severity, or state |
| Get full report details including CVSS vector, bounty amounts, and attachments |
| Get a report with its triage conversation thread |
| Get activity timeline (comments, state changes, bounties) |
| List all bug bounty programs you have access to (auto-paginates) |
| Get single program info: policy, response times, metrics |
| Get all in-scope assets for a program (auto-paginates) |
| Get accepted CWE/weakness types for a program (auto-paginates) |
| Get your bounty earnings history (amounts, dates, programs) |
| Get your reputation, signal, impact, and rank |
| Get your current unpaid bounty balance |
| Analyze your hunting patterns (severity distribution, top programs, weakness types) |
| Search publicly disclosed reports on hacktivity — great for recon and learning |
Tool | Description |
| Submit a new vulnerability report to a program |
| Add a comment to an existing report (respond to triage) |
| Withdraw/close one of your own reports |
Submit a report directly:
Submit this SSRF finding to the uber program with critical severity. Here's my writeup: [paste]Respond to triage:
Add a comment to report #2345678: "Here's the updated PoC with the new endpoint..."Draft a report matching your style:
Find my resolved critical reports and use the same structure to draft a new report for this SSRF I found.Learn from triage conversations:
Show me the triage conversation on report #2345678. What questions did they ask?Research what gets paid:
Search disclosed reports on the uber program for SSRF — what did they pay?Check program details before hunting:
Show me the uber program details — what are their response times?Check your stats:
Show my hacker profile — what's my current reputation and signal?Track earnings:
Show my recent bounty earnings and current balanceAnalyze patterns:
Analyze my report patterns — what severity gets resolved most?Connects to the HackerOne Hacker API v1 using your personal API token
Runs locally over stdio — your credentials never leave your machine
Supports both read and write operations (submit reports, add comments, close reports)
Auto-paginates programs, scope, and weakness endpoints so nothing gets silently truncated
Uses server-side API filters where available (program, severity, state) for faster searches
Built-in retry with exponential backoff for rate limit handling
60-second response cache to reduce redundant API calls
MIT
Fetch your recent reports and analyze patterns: most common vulnerability types, severity distribution, resolution rates, and programs. Useful for understanding your hunting profile.
Inputs: page_size.
Get your bounty earnings history. Shows amounts, currency, dates, and which programs paid out.
Inputs: page_size.
Get the in-scope assets for a bug bounty program. Returns asset types, identifiers, bounty eligibility, and severity caps. Useful when drafting reports to pick the correct asset.
Inputs: program_handle (required), page_size.
Get the accepted vulnerability/weakness types for a program. Helps frame reports using the right CWE categories the program cares about.
Inputs: program_handle (required), page_size.
Get the full details of a specific HackerOne report by ID. Returns title, vulnerability details, impact, severity, CVSS, timestamps, and program info.
Inputs: report_id (required).
Get the activity timeline of a report: comments, state changes, bounty awards, and triage responses.
Inputs: report_id (required), page_size.
Get a report with its full triage conversation. Useful for understanding what questions triage asked, how you responded, and what led to resolution. Great for learning what works.
Inputs: report_id (required).
List bug bounty programs you have access to on HackerOne.
Inputs: page_size.
Search and list your HackerOne reports. Filter by keyword, program, severity, or state. Great for finding past reports to reference when drafting new ones.
Inputs: query, program, severity, state, +3 more.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 9 tools
Most tools have distinct purposes, such as get_earnings for bounty history and get_program_scope for program assets, but get_report, get_report_activities, and get_report_with_conversation overlap in focusing on report details, which could cause minor confusion in selection. The descriptions help clarify the differences, but the boundaries are not entirely clear.
All tool names follow a consistent verb_noun pattern with snake_case, such as analyze_report_patterns, get_earnings, and list_programs. There are no deviations in naming conventions, making the set predictable and easy to parse for agents.
With 9 tools, the server is well-scoped for managing HackerOne bug bounty activities, covering key areas like program info, reports, and earnings. Each tool earns its place without feeling excessive or insufficient for the domain.
The tool surface provides comprehensive coverage for bug bounty hunters, including program listing, scope and weakness details, report retrieval and search, and earnings tracking. A minor gap exists in lacking tools for creating or submitting new reports, but agents can work around this with the available tools for drafting and referencing.
Analyze authorized assets and read security findings through your Hackaiz account.
Search and monitor bug bounty programs and audit contests across ten platforms.
Bug Bounty Programs - HackerOne + Bugcrowd Lookup | Bulk
AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets.
