Skip to content
HackerOne

HackerOneMCP Server

by HackerOne
Added to Onei
11 views
Docs
Featured Developer Tools

Summary

Official read-only MCP server for HackerOne bug bounty reports, programs, and remediation data.

Features

  • Read-only access to HackerOne reports, programs, assets, and bounty data
  • OAuth account-linked authentication (no static API keys)
  • AI-generated report summaries and severity assessments
  • Duplicate and semantic-similarity detection across reports
  • Bounty-amount suggestions and remediation-plan generation
  • Cross-report insight extraction and diagram generation

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

  1. Open your agent's MCP configuration file.
  2. Merge the snippet below into it.
  3. Restart the agent — the "HackerOne" tools will be available.
{
  "mcpServers": {
    "hackerone": {
      "command": "claude",
      "args": [
        "mcp",
        "add-json",
        "hackerone",
        "--scope",
        "user",
        "{\"type\":\"http\",\"url\":\"https://hackerone.com/mcp\",\"oauth\":{\"scopes\":\"h1:graphql\"}}"
      ]
    }
  }
}

Description

The HackerOne MCP server is HackerOne's own, platform-hosted connector that lets Claude and other MCP clients read directly from a team's HackerOne account: vulnerability reports, programs, in-scope assets, bounty tables, and remediation plans. Rather than copy-pasting report text into a chat window, a security or engineering team can ask an agent to summarize a report, compare a new finding against past duplicates by semantic similarity, pull bounty-amount suggestions, or draft a remediation plan, all grounded in live program data.

It authenticates through a standard OAuth redirect flow against a user's HackerOne account rather than a static API key, and every tool it exposes is read-only: agents can query and analyze reports, assets, and payouts, but cannot modify tickets, assets, or program settings through the server. Available tools span discovery (current user, accessible programs, asset listing), report search and AI-generated summaries and assessments, duplicate and similarity detection, bounty and remediation suggestions, and cross-report insight extraction.

Access requires a HackerOne account on the Professional or Enterprise plan (Legacy or CTEM packaging); it's aimed at AppSec and vulnerability-management teams who want an agent that can reason over a real bug bounty program's history instead of a generic security assistant with no access to that data.

Related MCP Servers

MCP: Qase MCP Server

by Qase

New

Qase test management over MCP: 36 task-oriented tools for cases, runs, results, defects and QQL search, hosted at mcp.qase.io or self-run with your own API token.

Developer Tools

MCP: Arm MCP Server

by Arm

New

Arm's official MCP server for porting and tuning software on Arm — semantic docs search, codebase migration scanning, container architecture checks and LLVM-MCA assembly analysis.

Developer Tools
2 views

MCP: AntV Chart MCP

by AntV

New

Official AntV MCP server that turns a description of your data into a rendered chart — 26 visualization types from bar and line to sankey, mind-map, fishbone and geographic maps.

Developer ToolsDatabases & Data
1 views

MCP: Headroom

by Headroom Labs

New

Context-compression MCP server that shrinks tool outputs, logs, files and RAG chunks before they reach the model, cutting 60-95% of tokens on JSON payloads.

Developer Tools
4 views
Browse all MCP servers →