Submit Log in

HackerOne

by HackerOne

Docs

Featured Developer Tools

securitybug-bountyvulnerability-managementappsec

Summary

Official read-only MCP server for HackerOne bug bounty reports, programs, and remediation data.

Features

Read-only access to HackerOne reports, programs, assets, and bounty data
OAuth account-linked authentication (no static API keys)
AI-generated report summaries and severity assessments
Duplicate and semantic-similarity detection across reports
Bounty-amount suggestions and remediation-plan generation
Cross-report insight extraction and diagram generation

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

Open your agent's MCP configuration file.
Merge the snippet below into it.
Restart the agent — the "HackerOne" tools will be available.

{
  "mcpServers": {
    "hackerone": {
      "command": "claude",
      "args": [
        "mcp",
        "add-json",
        "hackerone",
        "--scope",
        "user",
        "{\"type\":\"http\",\"url\":\"https://hackerone.com/mcp\",\"oauth\":{\"scopes\":\"h1:graphql\"}}"
      ]
    }
  }
}

Claude Code

Add the server with a single CLI command.

claude mcp add hackerone -- claude mcp add-json hackerone --scope user {"type":"http","url":"https://hackerone.com/mcp","oauth":{"scopes":"h1:graphql"}}

Claude Desktop

Add the server to claude_desktop_config.json (Settings → Developer → Edit Config).

{
  "mcpServers": {
    "hackerone": {
      "command": "claude",
      "args": [
        "mcp",
        "add-json",
        "hackerone",
        "--scope",
        "user",
        "{\"type\":\"http\",\"url\":\"https://hackerone.com/mcp\",\"oauth\":{\"scopes\":\"h1:graphql\"}}"
      ]
    }
  }
}

Description

The HackerOne MCP server is HackerOne's own, platform-hosted connector that lets Claude and other MCP clients read directly from a team's HackerOne account: vulnerability reports, programs, in-scope assets, bounty tables, and remediation plans. Rather than copy-pasting report text into a chat window, a security or engineering team can ask an agent to summarize a report, compare a new finding against past duplicates by semantic similarity, pull bounty-amount suggestions, or draft a remediation plan, all grounded in live program data.

It authenticates through a standard OAuth redirect flow against a user's HackerOne account rather than a static API key, and every tool it exposes is read-only: agents can query and analyze reports, assets, and payouts, but cannot modify tickets, assets, or program settings through the server. Available tools span discovery (current user, accessible programs, asset listing), report search and AI-generated summaries and assessments, duplicate and similarity detection, bounty and remediation suggestions, and cross-report insight extraction.

Access requires a HackerOne account on the Professional or Enterprise plan (Legacy or CTEM packaging); it's aimed at AppSec and vulnerability-management teams who want an agent that can reason over a real bug bounty program's history instead of a generic security assistant with no access to that data.