Bug Bounty Assistant MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| GITHUB_TOKEN | No | Optional GitHub token for GitHub dork search. | |
| ALLOWED_SCOPE | Yes | Comma-separated list of domains this server is allowed to scan. Required for scope guard. | |
| CENSYS_API_ID | No | Optional Censys API ID. | |
| SHODAN_API_KEY | No | Optional API key for Shodan enrichment. | |
| HTTP_TIMEOUT_MS | No | Timeout (ms) for outbound HTTP requests. Default is 10000. | 10000 |
| CENSYS_API_SECRET | No | Optional Censys API secret. | |
| MAX_REQUESTS_PER_SECOND | No | Requests per second ceiling applied globally (politeness). Default is 2. | 2 |
Capabilities
Features and capabilities supported by this server
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get_dns_recordsB | Resolves A/AAAA/MX/TXT/NS/CNAME/SOA records for a domain |
| find_subdomainsB | Enumerates subdomains via certificate transparency logs (crt.sh) |
| check_security_headersB | Audits HTTP response headers (CSP, HSTS, X-Frame-Options, etc.) |
| analyze_cookiesB | Inspects cookies for Secure, HttpOnly, SameSite flags |
| ssl_scanA | Checks TLS/SSL certificate validity, chain, protocol versions, and cipher suites |
| discover_robotsB | Fetches and parses robots.txt for disallowed paths and sitemaps |
| discover_sitemapA | Fetches and parses sitemap.xml for site structure and URLs |
| detect_technologiesB | Fingerprints frameworks, CMS, JS libraries, and web servers |
| find_interesting_endpointsA | Scans the main page and linked scripts for links, forms, and API routes |
| take_screenshotC | Captures a browser snapshot of a page using Playwright |
| generate_reportA | Aggregates all tool outputs into a structured Markdown recon report |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
Latest Blog Posts
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/rohitprasad-code/recon-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server