Skip to main content
Glama
167,709 tools. Last updated 2026-06-03 01:25

"A server for finding bug bounty programs and cybersecurity vulnerability rewards" matching MCP tools:

  • Fetch a public URL and inspect security-relevant response headers before you claim that a product or endpoint has a strong browser-facing security baseline. Use this for quick due diligence on public apps and docs sites. It checks for common headers such as HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, and X-Content-Type-Options. It does not replace a real security review, authenticated testing, or vulnerability scanning.
    Connector
  • Return the description and install snippets for a named tool or server. For tools: the description and the server it belongs to. For servers: local (stdio, via npx) install snippets for every published server, plus remote (HTTP) connection snippets when a hosted endpoint exists — for every supported client, or one client via the client parameter. Call cyanheads_search first to find valid names.
    Connector
  • Get Lenny Zeltser's cybersecurity-writing rating sheet(s) so your AI can apply the rubric. Returns the structured rubric (groups, items, scoring bands) WITHOUT computing a score. Use `rating_score_writing` if you also want a numeric score, gap analysis, or rubric-anchored feedback. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructions flow to your AI.
    Connector
  • Get the cost to buy points/miles for a loyalty program. Returns tiered base purchase pricing and any active bonus promotion. Use to answer 'how much does it cost to buy X Avios/miles/points?' If no program specified, returns all programs with pricing data. Free — no account needed.
    Connector
  • List all compliance pillars in the Bidda Sovereign Intelligence registry with node counts. Use this first to discover available compliance domains before searching. Bidda has 7,766 cryptographically-verified nodes across 34 pillars, including a MITRE layer spanning 6 frameworks (ATT&CK Enterprise/Mobile/ICS, D3FEND, ATLAS, CAPEC) plus Banking, AI Governance, Cybersecurity, Healthcare, Legal, ESG and more.
    Connector

Matching MCP Servers

  • F
    license
    -
    quality
    C
    maintenance
    A comprehensive MCP server for automated bug bounty hunting and security reconnaissance, featuring over 28 specialized tools for subdomain discovery, vulnerability scanning, and traffic analysis. It integrates automated scope validation and professional reporting across multiple platforms like HackerOne and Bugcrowd to streamline security testing.
    Last updated
    5
  • A
    license
    A
    quality
    C
    maintenance
    Provides Claude Code with access to a comprehensive bug bounty knowledge base including techniques, payloads, wordlists, and real-world reports through 14 tools for searching, retrieving payloads, and assessing report quality.
    Last updated
    14
    11
    GPL 3.0

Matching MCP Connectors

  • Returns combined position across both staking venues: MoggerStaking (stake MEGACHAD → earn MEGAGOONER) and JESTERGOONER V4 (stake MC/MG LP → earn MEGAGOONER). Includes balances, allowances, earned rewards, NFT boost, APR, and global pool stats. Without address, returns global stats only.
    Connector
  • Get entry page settings for a sweepstakes. Use fetch_sweepstakes first to get the sweepstakes_token. Returns all configuration: display, colors, spacing, entry settings, compliance, confirmation page, winners page, age gate, AMOE, geolocation, analytics, social media follows, sharing rewards, bonus entries, and sponsor profiles. Use this before update_entry_settings to see current values. # get_entry_settings ## When to use Get entry page settings for a sweepstakes. Use fetch_sweepstakes first to get the sweepstakes_token. Returns all configuration: display, colors, spacing, entry settings, compliance, confirmation page, winners page, age gate, AMOE, geolocation, analytics, social media follows, sharing rewards, bonus entries, and sponsor profiles. Use this before update_entry_settings to see current values. ## Pre-calls required 1. fetch_sweepstakes if the user gave you a sweepstakes name instead of a token ## Parameters to validate before calling - sweepstakes_token (string, required) — The sweepstakes token (UUID format)
    Connector
  • Return a curated snapshot of currently-live audit competitions and bug-bounty programs across Code4rena, Cantina, Sherlock, and direct-protocol channels. Useful for solo wardens triaging which contests to enter. Snapshot updates with each cipher-x402-mcp release; treat the data as a hint, always cross-check the platform before submitting. Free, no payment required.
    Connector
  • Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass an array of {name, ecosystem, version} tuples (up to 1000). Each entry in the response corresponds positionally to the input. Each finding includes CVE aliases for chaining to nist-nvd-mcp-server for CVSS scoring. Invalid ecosystem strings are rejected before querying — call osv_list_ecosystems to validate.
    Connector
  • Get Lenny Zeltser's scoring playbook so your AI can score a draft locally against a cybersecurity-writing rating sheet. THIS IS THE ONLY TOOL THAT PRODUCES NUMERIC SCORES — the writing-coach tools (`get_security_writing_guidelines`, `ir_*`, `product_*`) never score. Returns the rubric plus step-by-step instructions for applying it. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructions flow to your AI.
    Connector
  • Mutating. Report a problem or observation encountered during gameplay. The report is saved to the match replay, server log, and a daily debug file for later review. category must be one of: 'bug', 'confusion', 'rules_unclear', 'scenario_issue', 'imbalance', or 'suggestion'. Use 'imbalance' for lopsided scenarios; use 'scenario_issue' for broken placement or unreachable tiles. summary is a short description (max 500 chars, required). details is an optional longer explanation (max 10,000 chars). Requires state=in_game.
    Connector
  • Submit a trading-edge idea to the governed edge-idea bounty. You are paid a FLAT sats bounty for the IDEA if it survives the same backtest gate (Monte-Carlo permutation p-value + Deflated Sharpe) our own live Bitcoin bot is held to — no capital is pooled, you keep your funds, we buy the idea. Tiers auto-detected from `spec`: parameter (a search grid on an existing strategy family), code (a novel signal function — run only in a hardened, network-off Docker sandbox), or concept (a free-text idea). A code-tier signal_code must define generate_signals(candles).
    Connector
  • Inventory mode. List all 19 AXIS programs, their generators, pricing tier, and artifact paths. Free, no auth, and no side effects. Use search_and_discover_tools instead when you only have a keyword, or discover_commerce_tools when you need install and onboarding metadata.
    Connector
  • Load Lenny Zeltser's complete cybersecurity-writing rating toolkit: all 7 sheets, scoring policy, scoring playbook, and cross-references to the writing guidelines. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructions flow to your AI.
    Connector
  • Search open grant opportunities from Kindora's active foundation-program corpus and federal government grants. Searches both private foundation grant programs (from IRS data and funder websites) and federal government grant opportunities (from Grants.gov). Uses full-text search with natural language understanding — queries are parsed into individual terms with stemming, so "youth after school programs" matches programs about youth, after-school, and programming even if those exact words don't appear together. Search covers program names, descriptions, focus areas, beneficiary types, and geographic focus fields. Use the state parameter to focus on geographically relevant opportunities. Query syntax: - Natural language: "affordable housing for seniors" (matches any of these terms) - Quoted phrases: '"after school"' (matches exact phrase) - Exclusion: "education -higher" (matches education, excludes higher education) - Combine: '"mental health" youth -adult' (phrase + term + exclusion) - No query: returns broadly open programs sorted by upcoming deadlines (browsing mode) Args: query: Natural language search query. Searches across program names, descriptions, focus areas, beneficiary types, and geographic focus. Supports quoted phrases for exact matching and -term for exclusion. Example: "youth outdoor education", "affordable housing", "STEM education for girls", "food bank hunger", "climate change environment", "domestic violence women" focus_area: Filter foundation programs by focus area (matches values in focus_areas array). Example: "Education", "Health", "Environment" agency: Filter government grants by agency name (case-insensitive). Example: "Department of Education", "NSF", "NIH" state: Two-letter US state code to filter by geographic relevance. Returns programs focused on that state plus nationally available programs. Example: "CA", "NY", "TX" country: Country name for non-US geographic filtering. Returns programs whose geographic_focus is tagged for that country plus any tagged Global / International / Worldwide. Use this instead of state for international queries — passing "India" via state would error because state requires a US code. Mixing state with a non-US country is rejected. Example: "India", "Kenya", "Mexico", "Global" deadline_days: How far ahead to search for deadlines, in days. Default: 90 (3 months). Maximum: 365 (1 year). Rolling/always-open programs are always included regardless. min_award: Minimum grant size filter in dollars. Example: 50000 (grants of $50K+) max_award: Maximum grant size filter in dollars. Example: 500000 (grants up to $500K) nonprofit_only: Only show nonprofit-eligible government grants. Default: True source: Filter by grant source type. Options: "foundation" (private foundation programs only), "government" (federal grants only), or omit for both sources combined. PREFER omitting this — the foundation corpus is much larger, and filtering to government-only often returns few or zero results. limit: Maximum number of results to return. Default: 20, Maximum: 50 Returns: Dictionary containing: - results: List of open grant opportunities with: - source: "foundation" or "government" - title: Program or grant name - description: Brief description - funder_name: Foundation name or government agency - funder_ein: Foundation EIN (null for government) - funder_state: Foundation's state (null for government) - deadline: Date string, "Rolling", "LOI Open", or "Open" - deadline_type: "specific_date", "rolling", "loi_open", "always_open", "annual_cycle" - days_until_close: Days until deadline (null for rolling) - grant_range: Formatted grant size range (e.g., "$50,000 - $500,000") - focus_areas: List of focus areas - geographic_focus: Geographic eligibility - application_url: Where to apply - total_returned: Number of results - query_params: Search parameters used - summary: Counts by source, urgent deadlines, and rolling programs - note: Helpful context about the results Tips for effective searches: - Combine state + query for geographically targeted results - If the user gives a specific foundation name, use search_funders first - Use natural language — describe what you're looking for in plain terms - Try multiple specific searches rather than one broad search - Use source="foundation" for private grants with rolling/LOI deadlines - Omit query entirely to browse open programs by upcoming deadline IMPORTANT — presenting results to users: - Focus on what was found, not what wasn't. Present results positively. - Do NOT comment on corpus size, data limitations, or coverage gaps. - If few results are returned, suggest trying related keywords or using search_funders to find aligned foundations — many accept unsolicited inquiries or run annual grant cycles that may not have an open window right now. Frame this as "here are additional prospects to explore" not "the search didn't find enough." - Many excellent funders don't post public open calls — they fund through relationships, LOIs, and nominations. Use search_funders and get_funder_profile to identify these funders as proactive prospects. Examples: search_open_grants(query="youth outdoor education", state="CA") search_open_grants(query="affordable housing", state="NY", source="foundation") search_open_grants(query="STEM education for girls", state="TX") search_open_grants(query="food bank hunger", min_award=10000) search_open_grants(query="mental health services", state="CA") search_open_grants(query="climate change environment", source="foundation") search_open_grants(source="government", nonprofit_only=True, state="NY") search_open_grants(focus_area="Environment", source="foundation") search_open_grants(query="community health workers", country="India") search_open_grants(query="climate resilience", country="Global") search_open_grants() # Browse open programs by upcoming deadline Related tools: - search_funders: Find grantmaking organizations by name or location — use this alongside search_open_grants to identify foundations that may be a good fit even if they don't have a posted open grant right now - get_funder_profile: Get detailed profile for a specific foundation - get_foundation_grants: See past grants made by a foundation
    Connector
  • Get available Australian government grants, incentives, and funding programs for starting or growing a trade business. Filter by category: apprenticeship, small-business, export, digital, training.
    Connector
  • Get Lenny Zeltser's Vuln cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `vuln_load_context`. This server never requests your vulnerability notes and instructs your AI to keep them local—the brief template and guidelines flow to your AI for local analysis.
    Connector
  • Top Hyperliquid perps ranked by absolute funding rate, with OI and annualized yield. Useful for finding the most overcrowded longs/shorts and carry opportunities.
    Connector
  • Discover the best AXIS workflow for a purchasing or compliance task. Free, no auth, and logs lightweight task metadata for intent analytics. Example: task_description='prepare for autonomous Visa checkout'. Use this when you need commerce-specific triage and next-step guidance. Use search_and_discover_tools instead for non-commerce keyword routing across all programs.
    Connector