Which integrations are available for this server?

Provides Android APK decompilation, static analysis, and security assessment. Integrates with Burp Suite for passive and active scanning, request repeater, target scope management, and finding export. Performs GraphQL security testing including query analysis, mutation testing, and schema introspection. Supports iOS class dumping and security research. Analyzes OpenAPI/Swagger specifications for security vulnerabilities and misconfigurations.

How do I use BugBounty MCP Server?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@BugBounty MCP Server find subdomains for example.com" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

BugBounty MCP Server

by rifqy354

Overview Schema Related Servers Score Discussions

Python

BugBounty MCP Server

A modern, modular MCP server for bug bounty hunting and security research.

Features

Recon Module - Subdomain enumeration, port scanning, URL discovery
Web Module - Fuzzing, vulnerability scanning, parameter discovery
API Module - REST/GraphQL testing, OpenAPI analysis
Burp Integration - Passive/active scanning, repeater, scope management
Ghidra Integration - Binary analysis, decompilation, reverse engineering
Mobile Module - APK analysis, iOS research
Binary Module - Checksec, ROP gadgets, string analysis
AI Orchestrator - Intelligent workflow automation
Reporting - Auto-generate Markdown/HTML/PDF reports

Related MCP server: Bug Bounty MCP Server

Architecture

┌─────────────────────────────────────────────────────────────┐
│                        Claude Code                          │
│                     VSCode / Cursor                         │
└─────────────────────────────────────────────────────────────┘
                              │ MCP
                              ▼
┌─────────────────────────────────────────────────────────────┐
│                      BugBounty MCP Server                    │
├─────────────────────────────────────────────────────────────┤
│  ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────────────┐   │
│  │  Recon  │ │   Web   │ │   API   │ │     Burp        │   │
│  │         │ │         │ │         │ │                 │   │
│  │•subfinder│ │•ffuf   │ │•graphql │ │•passive_scan   │   │
│  │•httpx   │ │•nuclei  │ │•openapi │ │•active_scan    │   │
│  │•naabu   │ │•dalfox  │ │•jwt     │ │•repeater       │   │
│  │•katana  │ │•sqlmap  │ │•rest    │ │•scope          │   │
│  │•gau     │ │•arjun   │ │         │ │                 │   │
│  └─────────┘ └─────────┘ └─────────┘ └─────────────────┘   │
│  ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────────────┐   │
│  │ Ghidra  │ │ Binary  │ │ Mobile  │ │     AI          │   │
│  │         │ │         │ │         │ │                 │   │
│  │•analyze │ │•checksec│ │•jadx    │ │•workflow        │   │
│  │•decompile│ │•ropgadget│ │•apktool│ │•recommend      │   │
│  │•strings │ │•objdump │ │•frida   │ │•prioritize      │   │
│  │•xrefs   │ │•strings │ │•classdump│ │                 │   │
│  └─────────┘ └─────────┘ └─────────┘ └─────────────────┘   │
│  ┌─────────────────────────────────────────────────────┐    │
│  │                  Reporting Module                     │    │
│  │         Markdown / HTML / PDF / JSON                 │    │
│  └─────────────────────────────────────────────────────┘    │
└─────────────────────────────────────────────────────────────┘

Tech Stack

FastMCP - MCP framework
Pydantic - Data validation
AsyncIO - Concurrent execution
ProjectDiscovery Tools - Recon foundation
Burp Suite Professional API - Web testing
Ghidra Headless - Binary analysis
SQLite - Results caching
Docker Compose - Easy deployment

Quick Start

Prerequisites

Python 3.11+
Docker & Docker Compose
Burp Suite Professional (for Burp integration)
Ghidra (for reverse engineering)
Go 1.21+ (for ProjectDiscovery tools)

Installation

# Clone the repository
git clone https://github.com/YOUR_USERNAME/bugbounty-mcp.git
cd bugbounty-mcp

# Install Python dependencies
pip install -e .

# Build Docker containers
docker-compose build

# Run the MCP server
python -m bugbounty_mcp.server

Configuration

Copy and edit the config file:

cp config/config.yaml.example config/config.yaml

Edit config/config.yaml:

mcp:
  host: "0.0.0.0"
  port: 8765

burp:
  host: "localhost"
  port: 1337
  api_key: "your-burp-api-key"

ghidra:
  install_path: "/opt/ghidra"
  projects_dir: "/tmp/ghidra_projects"

tools:
  projectdiscovery:
    install_path: "/opt/pdtm"
  nuclei:
    templates: "/opt/nuclei-templates"

Usage with Claude Code

Add to your ~/.config/claude/code.json:

{
  "mcpServers": {
    "bugbounty": {
      "command": "python",
      "args": ["-m", "bugbounty_mcp.server"],
      "env": {
        "PYTHONPATH": "/path/to/bugbounty-mcp"
      }
    }
  }
}

Available Tools

Recon Module

Tool	Description
`subdomain_enum`	Passive subdomain enumeration
`port_scan`	Fast port scanning with naabu
`probe_urls`	HTTP probing with httpx
`crawl_urls`	Web crawling with katana
`url_discovery`	Historical URL discovery
`dns_enum`	DNS enumeration

Web Module

Tool	Description
`web_fuzz`	Directory/parameter fuzzing
`vuln_scan`	Vulnerability scanning with Nuclei
`xss_scan`	XSS detection
`sql_scan`	SQL injection testing
`param_discovery`	HTTP parameter discovery

API Module

Tool	Description
`graphql_test`	GraphQL security testing
`openapi_analyze`	OpenAPI/Swagger analysis
`jwt_analyze`	JWT token analysis
`rest_fuzz`	REST API fuzzing

Burp Integration

Tool	Description
`burp_passive_scan`	Run passive scan
`burp_active_scan`	Run active scan on target
`burp_repeater`	Send custom request
`burp_scope`	Manage target scope
`burp_sitemap`	Get sitemap
`burp_export`	Export findings

Ghidra Integration

Tool	Description
`ghidra_analyze`	Analyze binary
`ghidra_decompile`	Decompile function
`ghidra_strings`	Extract strings
`ghidra_functions`	List functions
`ghidra_xrefs`	Cross references
`ghidra_imports`	List imports

Binary Module

Tool	Description
`checksec`	Check security features
`rop_gadgets`	Find ROP gadgets
`one_gadget`	Find one-gadget RCE
`binary_strings`	Extract strings
`elf_analysis`	ELF binary analysis

Mobile Module

Tool	Description
`apk_decompile`	Decompile Android APK
`apk_analyze`	Static APK analysis
`ios_classdump`	Dump Objective-C classes

Reporting Module

Tool	Description
`generate_report`	Generate vulnerability report
`export_json`	Export findings as JSON
`export_markdown`	Export as Markdown

Example Sessions

Recon on a Target

You: "Do recon on swisspost.com"

MCP:
1. subfinder -d swisspost.com
2. httpx -l subdomains.txt -ports 80,443
3. katana -list alive_urls.txt
4. nuclei -list targets.txt

Binary Analysis

You: "Analyze the binary /tmp/vuln"

MCP:
1. checksec /tmp/vuln
2. ghidra_analyze /tmp/vuln
3. ghidra_decompile main
4. ropgadget /tmp/vuln

Web Vulnerability Scan

You: "Scan https://target.com for vulnerabilities"

MCP:
1. ffuf -u https://target.com/FUZZ
2. nuclei -t cves -u https://target.com
3. dalfox url https://target.com
4. arjun -u https://target.com

Development

Run Tests

pytest tests/ -v

Type Checking

mypy src/

Format Code

ruff format src/

Contributing

Fork the repository
Create a feature branch
Make your changes
Run tests
Submit a pull request

License

MIT License - see LICENSE

Roadmap

Core MCP server with basic tools
Burp Suite integration
Ghidra integration
AI workflow orchestrator
Mobile analysis module
Advanced reporting
Web UI for results

Note: This project is for educational and authorized security testing purposes only.

This server cannot be installed

license - permissive license

quality - not tested

maintenance

How are these scores calculated?

Maintenance

–Maintainers

–Response time

–Release cycle

–Releases (12mo)

Commit activity

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Servers

SecOps MCP
Penetration Testing Security App Automation
aisacAdmin
-
license
-
quality
-
maintenance
Provides access to 13+ penetration testing and security audit tools through a unified MCP interface. Enables security professionals to perform vulnerability scanning, web fuzzing, network reconnaissance, and other security assessments through containerized tools like Nuclei, Nmap, SQLMap, and FFUF.
Updated a year ago (2025-09-04 15:03 UTC)
Bug Bounty MCP Server
Penetration Testing Security Autonomous Agents
akinabudu
F
license
-
quality
D
maintenance
A comprehensive MCP server for automated bug bounty hunting and security reconnaissance, featuring over 28 specialized tools for subdomain discovery, vulnerability scanning, and traffic analysis. It integrates automated scope validation and professional reporting across multiple platforms like HackerOne and Bugcrowd to streamline security testing.
Updated 10 months ago (2025-10-12 22:04 UTC)
5
pentest-ai
Penetration Testing Autonomous Agents
0xSteph
A
license
-
quality
B
maintenance
Autonomous pentests from one command: real security tools, working PoCs, and audit-ready reports, all driven via MCP.
Updated 6 days ago (2026-08-08 10:55 UTC)
1,572
MIT
AI-Pentest-MCP
Penetration Testing Command Line
yassserhabib
F
license
-
quality
D
maintenance
Enables natural-language-driven security testing by orchestrating multiple pen-testing tools through MCP, with automated scan execution and AI-assisted vulnerability summarization.
Updated 4 months ago (2026-04-06 08:00 UTC)

View all related MCP servers

Related MCP Connectors

pentest-mcp-server
Offline methodology engine for authorized penetration testing, CTF, and security research.
Frogeye Security Scanner
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
mcp-server
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.

View all MCP Connectors

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/rifqy354/garuda-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

BugBounty MCP Server

Features

Architecture

Tech Stack

Quick Start

Prerequisites

Installation

Configuration

Usage with Claude Code

Available Tools

Recon Module

Web Module

API Module

Burp Integration

Ghidra Integration

Binary Module

Mobile Module

Reporting Module

Example Sessions

Recon on a Target

Binary Analysis

Web Vulnerability Scan

Development

Run Tests

Type Checking

Format Code

Contributing

License

Roadmap

Maintenance

Resources

Looking for Admin?

Related MCP Servers

SecOps MCP