🎯 HackerOne MCP Server

Hey there! 👋 Welcome to the HackerOne MCP Server.

This tool seamlessly connects your favorite AI assistants (Claude Code, Claude Desktop, Cursor, Windsurf) directly to your HackerOne account.

Whether you want to search your past reports, manage draft report intents, check program scope rules & exclusions, analyze bounty payouts, draft vulnerability write-ups, or reply to triagers — your AI can now help you do it all right from your chat window! 🚀

---

⚡ Quick Start (60 Seconds)

1. Grab your HackerOne API Token

Head over to HackerOne > Settings > API Token and generate your token.

2. Build the project

git clone https://github.com/Sicks3c/hackerone-mcp-server.git
cd hackerone-mcp-server
npm install
npm run build

3. Add to your AI Client

🌐 Via Smithery.ai (Easiest)

npx -y @smithery/cli mcp add hackerone-mcp-server

💻 Claude Code (Local)

claude mcp add hackerone \
  -e H1_USERNAME="your-h1-username" \
  -e H1_API_TOKEN="your-h1-api-token" \
  -s user \
  -- node /path/to/hackerone-mcp-server/dist/index.js

🖥️ Claude Desktop

Add this to your claude_desktop_config.json:

{
  "mcpServers": {
    "hackerone": {
      "command": "node",
      "args": ["/path/to/hackerone-mcp-server/dist/index.js"],
      "env": {
        "H1_USERNAME": "your-h1-username",
        "H1_API_TOKEN": "your-h1-api-token"
      }
    }
  }
}

🖱️ Cursor / Windsurf

In your editor's MCP Settings, add a new server:

• Type: stdio
• Command: node /path/to/hackerone-mcp-server/dist/index.js
• Env: Set H1_USERNAME and H1_API_TOKEN

---

💡 Cool Things You Can Ask Your AI

Here are a few fun prompts to try out:

• 🔍 Recon & Scope: "Show me the in-scope assets and scope exclusions for uber. What are their response times and accepted vulnerability types?"
• 📝 Report Intents (Drafts): "Create a new report intent draft for program gitlab titled 'XSS in search endpoint'. Let's refine the write-up before submitting."
• 💬 Triage Assistance: "The triager on report #123456 requested an updated PoC. Help me write a friendly technical response."
• 💰 Check Stats & Payouts: "How much unpaid balance do I have on HackerOne right now, and show my payout history via PayPal?"
• 📊 Analyze Patterns: "Analyze my report history — what severity gets resolved the fastest for me?"
• 🔎 Hacktivity Research: "Search disclosed reports on github for IDOR vulnerabilities to see what they usually pay."

---

🧰 What's Included?

🛠️ Tools (Actions your AI can take)

Category	Tool	What it does
Reports	search_reports	Search your reports by keyword, program, severity, or state
	get_report	View full report details (CVSS score, bounty, attachments)
	get_report_with_conversation	View report details along with full triage conversation
	get_report_activities	View timeline of comments, bounties, and status changes
	submit_report	Submit a brand new report to a program
	add_comment	Post a comment or reply to a triager
	close_report	Withdraw or close a report
	generate_report_template	Build a clean Markdown template for your report write-up
Report Intents (Drafts)	get_report_intents	List all draft report intents and AI processing job statuses
	get_report_intent	Get details of a specific draft report intent
	create_report_intent	Create a new draft report intent
	update_report_intent	Update draft report intent title or write-up
	delete_report_intent	Delete a draft report intent
	submit_report_intent	Finalize and submit a draft intent as an official report
	get_report_intent_attachments	List attachments for a draft report intent
	delete_report_intent_attachment	Delete an attachment from a draft report intent
Programs	find_best_programs	Discover & rank the best programs by fast payouts, bounties, or open scope
	list_programs	List all bug bounty programs you have access to
	get_program_details	Check program policy, response metrics, and average pay times
	get_program_scope	List all in-scope assets for a target program
	get_scope_exclusions	List report categories specifically excluded from rewards
	get_program_weaknesses	List accepted weakness/CWE categories for a program
Profile & Financials	get_hacker_profile	Check your reputation score, signal, impact, and rank
	get_earnings	See your bounty earnings history
	get_payouts	Check completed payouts history (PayPal, Wire, status)
	get_balance	Check your current unpaid bounty balance
	analyze_report_patterns	Get stats on your report severities, states, and top programs
Hacktivity	search_disclosed_reports	Search publicly disclosed hacktivity reports for research

---

📌 Resources (Instant context for your AI)

Your AI can instantly look up these hackerone:// URIs:

• 👤 hackerone://profile — Your live reputation, signal, impact, and rank.
• 💵 hackerone://balance — Your unpaid balance.
• 📈 hackerone://earnings/recent — Your latest bounty payouts.
• 📋 hackerone://reports/recent — Your 10 latest submitted reports.
• 🔥 hackerone://hacktivity/trending — Top upvoted public reports on Hacktivity.

---

💬 Prompts (Guided workflows)

• find-best-bounty-program: Automated strategy prompt to find & rank the highest-paying, fast-response target programs.
• draft-vulnerability-report: Step-by-step guide to draft a top-tier report.
• triage-response-assistant: Craft polite, effective replies to triagers.
• analyze-program-scope: Break down a program's assets to find high-yield targets.
• summarize-hunting-profile: Create a neat summary dashboard of your research stats.

---

⚙️ Configuration Options

Setting	Required?	Default	Description
H1_USERNAME	Yes	—	Your HackerOne API Username
H1_API_TOKEN	Yes	—	Your HackerOne API Token
H1_BASE_URL	No	https://api.hackerone.com/v1	Base API URL
CACHE_TTL_MS	No	60000 (1 min)	Response caching speed booster
LOG_LEVEL	No	info	Verbosity (debug, info, warn, error)

---

🔒 Security & Privacy

• 100% Local: Runs completely on your local machine using stdio transport.
• Your Credentials Stay Yours: Your API keys are kept strictly in your local environment variables and never sent anywhere except directly to HackerOne's official API.

---

📜 License

MIT License — Feel free to use, modify, and share! Happy hunting! 🎯