Bug Bounty MCP Server

A comprehensive Model Context Protocol (MCP) server for automated bug bounty hunting and security reconnaissance.

🚀 Quick Start

# Clone and install
git clone https://github.com/akinabudu/bug-bounty-mcp.git
cd bug-bounty-mcp

# Complete installation (dependencies + 25+ security tools)
./setup.sh install

# Start the MCP server
./setup.sh start

Related MCP server: operant-mcp

✨ Features

• 28+ Security Tools - Comprehensive reconnaissance to vulnerability scanning

• Automated Scope Validation - Never test out-of-scope targets

• Multiple Platforms - HackerOne, Bugcrowd, Intigriti, YesWeHack support

• Intelligent Caching - Avoid duplicate work with smart caching

• Complete Audit Trail - Track all testing activities

• Professional Reports - Generate detailed findings reports

• Traffic Interception - Real-time HTTP/HTTPS traffic analysis with mitmproxy

🛠️ Available Tools

Management (5 tools)

Program management, scope validation, statistics

Reconnaissance (14 tools)

• subdomain_enum - Fast subdomain discovery (subfinder)

• advanced_subdomain_enum - Advanced enumeration (amass)

• web_crawl - Web crawling (gospider + katana)

• network_scan - Fast network scanning (masscan)

• screenshot_recon - Visual reconnaissance (gowitness)

• git_recon - Git repository and secret scanning

• cloud_asset_enum - Cloud asset discovery (AWS/Azure/GCP)

• cert_transparency_search - Certificate transparency logs

• email_harvest - Email harvesting (theHarvester)

• ldap_enum - LDAP/Active Directory enumeration

• api_discovery - API endpoint discovery

• port_scan - Port scanning with nmap

• technology_detection - Web technology detection

• dns_enumeration - DNS record discovery

Vulnerability Scanning (3 tools)

• nuclei_scan - Comprehensive vulnerability scanning

• xss_scan - Cross-Site Scripting detection

• ssl_analysis - SSL/TLS configuration analysis

Fuzzing (2 tools)

• path_fuzzing - Directory and file fuzzing

• parameter_fuzzing - HTTP parameter fuzzing

Traffic Analysis (3 tools) NEW!

• start_traffic_intercept - Start mitmproxy for traffic capture

• analyze_traffic_flows - Analyze captured HTTP/HTTPS traffic

• extract_api_endpoints - Extract API endpoints from traffic

Reporting (3 tools)

• generate_report - Comprehensive reports

• export_findings - Export in multiple formats

• get_statistics - Detailed metrics

📋 Requirements

• Python 3.8+

• Go 1.19+ (for reconnaissance tools)

• Linux/macOS (Ubuntu 20.04+ recommended)

• 4GB+ RAM, 10GB+ disk space

🔧 Installation Options

# Full installation
./setup.sh install

# Install dependencies only
./setup.sh install-deps

# Install reconnaissance tools only  
./setup.sh install-tools

# Setup configuration
./setup.sh setup

# Test installation
./setup.sh test

# Verify tools are working
./setup.sh verify

# Clean temporary files
./setup.sh clean

🎯 Usage Example

# 1. Add bug bounty program
await add_program(
    program_name="Example Corp",
    platform="hackerone", 
    scope_domains=["*.example.com"]
)

# 2. Comprehensive reconnaissance
subdomains = await advanced_subdomain_enum(
    program_id="example",
    domain="example.com",
    mode="passive"
)

# 3. Web application testing
crawl_data = await web_crawl(
    program_id="example",
    url="https://example.com",
    depth=3,
    js_analysis=True
)

# 4. Vulnerability scanning  
vulns = await nuclei_scan(
    program_id="example",
    target="https://example.com"
)

# 5. Generate professional report
report = await generate_report(
    program_id="example",
    scan_ids=["scan1", "scan2"],
    format="markdown"
)

📖 Documentation

For complete documentation, see DOCUMENTATION.md:

• Installation Guide - Detailed setup instructions

• Configuration - Program and tool configuration

• Tool Reference - Complete tool documentation

• Usage Examples - Real-world usage patterns

• Troubleshooting - Common issues and solutions

• Contributing - Development and contribution guide

🔒 Security & Ethics

• Scope Validation: All tools automatically validate targets against program scope

• Rate Limiting: Built-in rate limiting to avoid overwhelming targets

• Audit Logging: Complete audit trail of all testing activities

• Responsible Disclosure: Always follow program rules and responsible disclosure

⚠️ Important: This tool is for authorized security testing only. Always ensure you have proper authorization before testing any targets.

📁 Project Structure

bug-bounty-mcp/
├── src/bugbounty_mcp/     # Main source code
├── config/                # Configuration files
├── data/                  # Nuclei templates, payloads
├── reports/               # Generated reports and findings
├── logs/                  # Audit logs and debugging
├── cache/                 # Cached scan results
├── setup.sh              # Installation and management script
├── DOCUMENTATION.md       # Complete documentation
└── README.md             # This file

🤝 Contributing

Contributions welcome! See CONTRIBUTING.md for guidelines.

📄 License

MIT License - see LICENSE for details.

🙏 Acknowledgments

• ProjectDiscovery for excellent Go tools (subfinder, katana, nuclei)

• OWASP Amass team for advanced subdomain enumeration

• Security research community for tool development and feedback

Made with ❤️ for the bug bounty community