Skip to content
HackerOne

HackerOneMCP Server

by HackerOne
Added to Onei
Docs
Featured Developer Tools

Summary

Official read-only MCP server for HackerOne bug bounty reports, programs, and remediation data.

Features

  • Read-only access to HackerOne reports, programs, assets, and bounty data
  • OAuth account-linked authentication (no static API keys)
  • AI-generated report summaries and severity assessments
  • Duplicate and semantic-similarity detection across reports
  • Bounty-amount suggestions and remediation-plan generation
  • Cross-report insight extraction and diagram generation

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

  1. Open your agent's MCP configuration file.
  2. Merge the snippet below into it.
  3. Restart the agent — the "HackerOne" tools will be available.
{
  "mcpServers": {
    "hackerone": {
      "command": "claude",
      "args": [
        "mcp",
        "add-json",
        "hackerone",
        "--scope",
        "user",
        "{\"type\":\"http\",\"url\":\"https://hackerone.com/mcp\",\"oauth\":{\"scopes\":\"h1:graphql\"}}"
      ]
    }
  }
}

Description

The HackerOne MCP server is HackerOne's own, platform-hosted connector that lets Claude and other MCP clients read directly from a team's HackerOne account: vulnerability reports, programs, in-scope assets, bounty tables, and remediation plans. Rather than copy-pasting report text into a chat window, a security or engineering team can ask an agent to summarize a report, compare a new finding against past duplicates by semantic similarity, pull bounty-amount suggestions, or draft a remediation plan, all grounded in live program data.

It authenticates through a standard OAuth redirect flow against a user's HackerOne account rather than a static API key, and every tool it exposes is read-only: agents can query and analyze reports, assets, and payouts, but cannot modify tickets, assets, or program settings through the server. Available tools span discovery (current user, accessible programs, asset listing), report search and AI-generated summaries and assessments, duplicate and similarity detection, bounty and remediation suggestions, and cross-report insight extraction.

Access requires a HackerOne account on the Professional or Enterprise plan (Legacy or CTEM packaging); it's aimed at AppSec and vulnerability-management teams who want an agent that can reason over a real bug bounty program's history instead of a generic security assistant with no access to that data.

Related MCP Servers

MCP: CVE MCP Server

by mukul975

Vulnerability triage for AI agents: 28 security tools across 24 free intelligence sources — NVD, EPSS, CISA KEV, MITRE ATT&CK, Shodan and VirusTotal — behind a single triage_cve call.

Developer Tools

MCP: E2B

by E2B

Featured

Run AI-generated code safely in an isolated cloud sandbox, with results returned as data rather than text.

Developer Tools

MCP: x64dbg MCP Server

by duty1g

A native x64dbg plugin exposing 84 debugging tools and 22 event callbacks over HTTP, so an AI assistant can drive breakpoints, memory and disassembly directly.

Developer Tools

MCP: JFrog MCP Server

by JFrog

JFrog's official remote MCP server: 100+ tools across Artifactory, Xray and Curation, hosted on JFrog Cloud with OAuth and no client install.

Developer Tools
Browse all MCP servers →