"A server for finding bug bounty programs and cybersecurity vulnerability rewards" matching MCP tools:

• lookup_security_contact

  lookup-disclose-io

  Find security reporting channels for responsible vulnerability disclosure. Takes a domain, IP, URL, package name, repository, container image, mobile app, hardware device, browser extension, desktop app, or organization name. Returns bug bounty programs, security.txt contacts, VDP links, abuse contacts, and national CERT fallbacks sorted by confidence. This is informational only — not legal advice.

  Connector

• rsnc_agent_brand_rankings

  Resonance Reward Agent

  See which brands offer the most rewards, have the most active programs, or the best cashback rates. Useful for finding where to shop for maximum value.

  Connector

• search_open_grants

  foundation-discovery

  Search open grant opportunities from Kindora's active foundation-program corpus and federal government grants. FOR-PROFIT APPLICANTS: pass for_profit_applicant=true to search capital a for-profit can take (PRIs, loans, revenue-based financing, patient equity) from CDFIs, impact investors, and PRI-active foundations. The default pool is 501(c)(3)-shaped and will NOT contain those programs. Searches both private foundation grant programs (from IRS data and funder websites) and federal government grant opportunities (from Grants.gov). Uses full-text search with natural language understanding — queries are parsed into individual terms with stemming, so "youth after school programs" matches programs about youth, after-school, and programming even if those exact words don't appear together. Search covers program names, descriptions, focus areas, beneficiary types, and geographic focus fields. Use the state parameter to focus on geographically relevant opportunities. Query syntax: - Natural language: "affordable housing for seniors" (matches any of these terms) - Quoted phrases: '"after school"' (matches exact phrase) - Exclusion: "education -higher" (matches education, excludes higher education) - Combine: '"mental health" youth -adult' (phrase + term + exclusion) - No query: returns broadly open programs sorted by upcoming deadlines (browsing mode)

  Connector

• vuln_get_brief_template

  website-search

  Get Lenny Zeltser's Vuln one-page executive brief template. Standalone variant of `vuln_get_template` for callers that only want the brief without the long-form report. This server never requests your vulnerability notes and instructs your AI to keep them local—the brief template and guidelines flow to your AI for local analysis.

  Connector

• frantic.claim_bounty

  frantic

  Claim a bounty through POST /v1/claims with bounty, agent_kid, and agent_token. On success, the response includes claim_id, claim_ref, fuse_expires_at, fuse_minutes, and current state; deliver before the fuse expires or the claim can be released. fuse_minutes is the platform fuse after applying worker standing and any poster claimWindowMinutes floor from the bounty. Common blockers include unauthorized, claim_unavailable, active_claim_exists, claim_limit_reached, rate_limited, payout_required, email_unverified, and github_signal_required. Call frantic.get_agent_status first when blocked. $0 goodwill requires a registered agent token. Paid bounties up to $10 require verified contact identity; paid bounties over $10 require a GitHub account at least 90 days old with visible public activity or one successful paid bounty.

  Connector

• vulnerability_info

  ZEN SecDB

  Get detailed information about a specific CVE. ## What this tool does Retrieves the full vulnerability record for a CVE from SecDB, including: - official description and summary - CVSS metrics (all versions available) - EPSS metadata (if present) - affected products and versions - vendor/security advisories - references and upstream sources - weakness classification (CWE) - exploit and patch information (if included in the record) All information is returned in a structured Markdown format suitable for direct display. ## When to use this tool Use this tool when the user asks: - "Give me details about CVE-XYZ." - "Which products are affected by this vulnerability?" - "Show me advisories or references for this CVE." - "Explain what this vulnerability is and how serious it is." This tool is ideal for **deep inspection of a single vulnerability**. For multiple CVEs, call the tool once per CVE. ## Inputs - **cve_id**: valid CVE identifier (`CVE-YYYY-NNNNN`). ## Outputs Markdown-formatted vulnerability information including: - detailed description - severity metrics (CVSS, vectors) - affected products list - advisory list - references - weakness (CWE) details - additional structured metadata from SecDB ## LLM usage guidelines - Always prefer this tool when the user needs factual information about a specific CVE. - If multiple CVEs are mentioned, call the tool once per CVE. - Combine with: - **`vulnerability_score`** - to enrich output with numerical CVSS/EPSS metrics - **`sightings_search`** - to check real-world exploitation, PoCs, plugins, advisories - **`ssvc_calculator`** - to compute prioritization based on the vulnerability data - Do not hallucinate product lists, advisories, or details—use what the tool returns.

  Connector

• check_incentives

  solar-home-incentives

  Clean-energy incentive guidance for any address WORLDWIDE. US ZIP → federal status + state/utility programs (via DSIRE). Any other country (pass country=<ISO code>) → qualitative, officially-sourced national program guidance. Use whenever a user asks what rebates, tax credits, or utility programs apply to solar, batteries, heat pumps, or efficiency work. [free — no API key required]

  Connector

• rating_get_sheet

  website-search

  Get Lenny Zeltser's cybersecurity-writing rating sheet(s) so your AI can apply the rubric. Returns the structured rubric (groups, items, scoring bands) WITHOUT computing a score. Use `rating_score_writing` if you also want a numeric score, gap analysis, or rubric-anchored feedback. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructions flow to your AI.

  Connector

• vuln_get_template

  website-search

  Get Lenny Zeltser's one-page Vulnerability Advisory Brief template. Covers Bottom Line, Quick Facts, Are We Affected?, Defensive Actions (with What/Why/When/Who), What We Don't Know, and More Information. This server never requests your vulnerability notes and instructs your AI to keep them local—the brief template and guidelines flow to your AI for local analysis.

  Connector

• get_platform_stats

  mcp-archimedes

  Aggregate counters for Archimedes Market as a whole: number of published assets, funded bounties, verified engineers, and total USD paid out across asset sales and bounty payouts. Useful for: evaluating whether Archimedes is worth recommending, sizing the engineering-talent pool, or surfacing platform momentum to a user. Counters are cached upstream (60s).

  Connector

• list_bounties

  DeskCrew

  Read-only: list the OPEN, PUBLIC arena contests any agent can compete in, richest bounty first. This is the agent bounty board: each row is a real support ticket whose workspace has attached a cash bounty, and the agent whose drafted ending a human approves takes the agent share. Unlike the other tools this is NOT limited to your own workspace, because it lists the same public contests shown on the arena page. Each row gives the ticketId to act on, the bounty in USD, the per-attempt entry fee in USD, and how many entrants have already tried out of the maximum. To enter, call draft_reply or propose_resolution on that ticketId and pay the attempt fee; a human then approves one ending and the bounty pays out. Returns nothing that is not already public, and never creates or modifies anything. [free]

  Connector

• fund_research_bounty

  RigorLoop Research Bounties

  Return the verified Stripe-hosted Base/USDC Checkout for a draft created by this same Bearer agent key. Opening the URL and completing wallet payment funds the bounty; this tool never claims payment succeeded before Stripe's webhook confirms it.

  Connector

• rating_score_writing

  website-search

  Get Lenny Zeltser's scoring playbook so your AI can score a draft locally against a cybersecurity-writing rating sheet. THIS IS THE ONLY TOOL THAT PRODUCES NUMERIC SCORES — the writing-coach tools (`get_security_writing_guidelines`, `ir_*`, `product_*`) never score. Returns the rubric plus step-by-step instructions for applying it. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructions flow to your AI.

  Connector

• vuln_get_frameworks

  website-search

  Get Lenny Zeltser's Vuln frameworks (primary frameworks the brief structurally derives from) plus optional sibling frames (adjacent frameworks that aren't the structural backbone). Pass `include_siblings: false` to skip sibling blocks. This server never requests your vulnerability notes and instructs your AI to keep them local—the brief template and guidelines flow to your AI for local analysis.

  Connector

• vulnerability_search

  ZEN SecDB

  Perform a full-text vulnerability search in SecDB. ## What this tool does Searches across: - CVE entries - Security advisories - Exploit references - Product and vendor vulnerability data Results are formatted in Markdown and include a search summary. ## When to use this tool Use this tool when the user asks: - to look up a CVE, advisory, exploit, or product - "show vulnerabilities for X" - "search for advisories about Y" - exploratory or broad vulnerability discovery ## Inputs - **query**: free-text search term (CVE ID, advisory ID, product name, exploit name, vendor, keyword, etc.) ## Outputs - **results**: array of Markdown-formatted search hits - **summary**: Markdown summary with counts and a link to continue searching on SecDB ## LLM usage guidelines - Use this tool instead of assuming whether a CVE/advisory/exploit exists. - Present `results` and `summary` directly to the user-they are already Markdown. - Combine with `vulnerability_score`, `epss_timeseries`, or `sightings_search` for deeper analysis.

  Connector

• get_loyalty_info

  Vila Buarque

  Get the loyalty/rewards program details for this site (Wix Loyalty). Returns program name, points currency name, and tier structure with required points per tier.

  Connector

• list_cwes

  Exploit Intelligence Platform — CVE, Vulnerability and Exploit Database

  List CWE (Common Weakness Enumeration) categories ranked by vulnerability count. Returns CWE IDs, names, short labels, exploit likelihood, and how many CVEs have that weakness. Use this when asked 'what are the most common vulnerability types?'

  Connector

• generate_finding

  Exploit Intelligence Platform — CVE, Vulnerability and Exploit Database

  Generate a pentest report finding in Markdown format for a specific vulnerability. Fetches full detail and formats it as a professional finding with severity, CVSS, description, affected products, exploit availability, and references. Accepts both CVE-IDs and EIP-IDs. Optionally include the target system tested and tester notes. The output is ready to paste into a pentest report. Example: cve_id='CVE-2024-3400', target='fw.corp.example.com', notes='Confirmed RCE via GlobalProtect gateway'.

  Connector

• get_mission_stats

  mcp-server

  Get aggregate statistics about missions on the HomeVisto platform. Returns total counts, status breakdown, and average bounty information. Useful for understanding platform activity.

  Connector

• proofrelay.scan_mcp_risk

  GENESIS ProofRelay MCP Verifier

  Return a read-only, public-metadata MCP risk score from tool descriptors, schemas, and registry claims. Use before listing, integrating, or wrapping another MCP server; it does not fetch network data, require auth, mutate systems, inspect source code, or certify vulnerability status.

  Connector