MCP Server with REST API for Recon & Bug Hunting Workflows

Bugbounty MCP Server

An MCP server focused on bug bounty hunting, providing professional workflows such as reconnaissance, vulnerability mining, and business logic testing, as well as a REST API interface

Security Developer tools #Bug Bounty #Security Testing #Workflow Generation #API Interface .Python

rating : 2 points

downloads : 6.3K

update time : 2025-09-18

Open Site

What is Bug Bounty MCP Server?

Bug Bounty MCP Server is an automated tool server specifically designed for bug bounty hunters. It provides various security testing workflows through REST API, helping researchers automate tasks such as reconnaissance, vulnerability scanning, and business logic testing, significantly improving the efficiency of vulnerability discovery.

How to use Bug Bounty MCP Server?

You can use various security testing functions through simple HTTP API calls. Users only need to send a request containing the target domain name and test type, and the server will return detailed security testing workflows and commands, supporting multiple testing scenarios such as web applications and API interfaces.

Use Cases

Suitable for security researchers, bug bounty hunters, and penetration testers. Especially applicable to scenarios such as web application security testing, API security assessment, file upload vulnerability detection, and business logic vulnerability discovery.

Main Features

Automated Reconnaissance

Provides a complete reconnaissance workflow, including techniques such as subdomain discovery, port scanning, and service identification, to help quickly understand the target attack surface.

Vulnerability Scanning

Integrates multiple vulnerability scanning tools, supporting security detection of various types such as web vulnerabilities, API security vulnerabilities, and configuration errors.

Business Logic Testing

A testing framework specifically for business logic vulnerabilities, helping to discover complex vulnerabilities such as authentication bypass and privilege escalation.

File Upload Detection

A professional toolset for testing file upload vulnerabilities, supporting bypass detection and exploitation of multiple file types.

OSINT Integration

Integrates open-source intelligence collection tools to automatically collect information related to the target and provide intelligence support for attacks.

REST API Interface

Provides a simple HTTP API interface for easy integration with other tools and calls by automated scripts.

Advantages

Ready to use without complex configuration

Focused on the bug bounty scenario with strong functionality targeting

Supports multiple types of security testing and workflows

Good tool integration and extensibility

Detailed documentation and examples

Limitations

Requires basic knowledge of command-line operations

Some advanced features require additional tool installations

Automated tools may generate a large amount of network traffic

Need to comply with ethical hacking guidelines and authorized testing

How to Use

Install Dependencies

Use the uv package manager to install project dependencies and ensure a Python 3.11+ environment.

Start the Server

Run the server script, supporting debug mode and custom port configuration.

Test the API Interface

Use curl or Postman to test whether the API interface works properly.

Start Security Testing

Execute security testing tasks according to the returned workflow guide.

Usage Examples

Web Application Reconnaissance

Conduct comprehensive information collection and reconnaissance on the target web application to discover potential attack surfaces.

API Security Testing

Conduct security testing on REST API interfaces to discover authentication, authorization, and data validation vulnerabilities.

File Upload Vulnerability Detection

Test the security of the file upload function, attempting to bypass file type detection and execute malicious files.

Frequently Asked Questions

What technical background is required to use this server?

What types of vulnerability testing are supported?

Are additional tool installations required?

How to ensure the legality of testing?

Does it support custom workflows?

Related Resources

Official Documentation

Complete API documentation and usage guide

GitHub Code Repository

Source code and issue tracking

Bug Bounty Best Practices

Best practice guide for bug bounty hunting

Security Testing Toolset

Recommended security testing tools and resources

🚀 Bug Bounty MCP Server

A clean, focused server containing bug bounty hunting workflows and REST API endpoints.

🚀 Quick Start

1. Install Dependencies & Start the Server

# Install dependencies with uv
uv sync

# Install development dependencies (optional)
uv sync --dev

# Set up pre-commit hooks (recommended for development)
uv run pre-commit install

# Start the server
uv run src/server.py

# Or with environment variables
DEBUG=true BUGBOUNTY_MCP_PORT=8888 uv run src/server.py

# Or use the launcher script
./start-server.sh --debug --port 8888

2. Test the API

# Create reconnaissance workflow
curl -X POST http://127.0.0.1:8888/api/bugbounty/reconnaissance-workflow \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com", "program_type": "web"}'

✨ Features

Clean Architecture: Removed bloat and unnecessary dependencies while maintaining core functionality
Bug Bounty Focused: Specialized workflows for reconnaissance, vulnerability hunting, business logic testing, OSINT, and file upload testing
REST API Endpoints: Simple HTTP API for workflow generation and management
Comprehensive Assessments: Combine multiple workflows for complete bug bounty assessments

🔧 Technical Details

Architecture

Core Components

REST API Server (src/server.py) - Flask-based HTTP API server with bug bounty workflow endpoints
MCP Server (src/mcp_server.py) - FastMCP-based server for AI agent communication
Bug Bounty Workflows - Specialized workflow generation for different phases of testing
Tool Integration - Comprehensive collection of security testing tools

📦 Installation

Environment Variables

BUGBOUNTY_MCP_PORT: Server port (default: 8888)
BUGBOUNTY_MCP_HOST: Server host (default: 127.0.0.1)
DEBUG: Enable debug mode (default: false)

Usage Examples

# Start with default configuration
uv run src/server.py

# Start with custom configuration
DEBUG=true BUGBOUNTY_MCP_PORT=9999 BUGBOUNTY_MCP_HOST=0.0.0.0 uv run src/server.py

🔑 Key Features

Bug Bounty Workflow Management: Complete workflow generation for different phases of bug bounty hunting
Vulnerability Prioritization: Intelligence-driven prioritization based on impact and bounty potential
File Upload Testing: Specialized framework for file upload vulnerability testing
OSINT Integration: Comprehensive OSINT gathering workflows
Business Logic Testing: Structured approach to business logic vulnerability discovery

📚 Dependencies

Project uses uv for fast, reliable dependency management:

Core Dependencies

Flask: Web framework for REST API
FastMCP: MCP server framework
Requests: HTTP client library
Python 3.11+: Core runtime (supports Python 3.11, 3.12, 3.13)

Development Dependencies

Ruff: Fast Python linter and formatter
Bandit: Security vulnerability scanner
Pydocstyle: Documentation quality checker
Pyright: Static type checker
Pre-commit: Git pre-commit hooks framework

Install dependencies:

uv sync                # Core dependencies only
uv sync --dev         # Include development tools

Add new dependencies:

uv add package-name

📈 Code Quality

This project enforces code quality through automated pre-commit hooks:

# Install pre-commit hooks
uv run pre-commit install

# Run checks on all files
uv run pre-commit run --all-files

# Run specific checks
uv run ruff check          # Linting
uv run ruff format         # Formatting
uv run bandit -c pyproject.toml # Security scan
uv run pydocstyle          # Documentation check

Standards: