MCP 服务器

inti-brain

Connects AI assistants to Intigriti by syncing programs, scopes, and rules of engagement, then provides tools to search and generate actionable attack briefings.

README

inti-brain

An MCP server that connects your AI assistant (Claude Code / Desktop, or any MCP client) to Intigriti. It pulls the programs you can access, their scopes (domains) and rules of engagement into a local SQLite database, then exposes tools to search programs, pull scope, and generate an actionable attack briefing via hack(handle).

It's the Intigriti equivalent of h1-brain.

Authorized testing only. Use this against programs you are permitted to test, and follow each program's scope and rules of engagement.

What it does

Syncs every Intigriti program you can access (handle, name, bounty range, status, industry).
Pulls each program's scope broken down by bounty tier, plus the rules of engagement — including the required request header (e.g. X-Intigriti-Username: {you}), safe-harbour status, and whether automated tooling is allowed.
hack(handle) returns a full briefing: bounty-eligible assets first, no-bounty assets, an explicit out-of-scope section, the required header, the ROE, and (optionally) weakness-pattern hits from a disclosed-report KB.

Requirements

Python 3.10+
An Intigriti Researcher API personal access token (generate at https://app.intigriti.com/researcher/personal-access-tokens).

Setup

git clone https://github.com/<you>/inti-brain.git
cd inti-brain
python3 -m venv venv
./venv/bin/pip install -r requirements.txt

cp .intienv.example .intienv   # then edit .intienv with your token

.intienv:

INTI_USERNAME=your_intigriti_username
INTI_API_TOKEN=your_researcher_api_token

Connect to Claude Code

claude mcp add inti-brain \
  -e INTI_USERNAME=your_username \
  -e INTI_API_TOKEN=your_token \
  -- /absolute/path/to/inti-brain/venv/bin/python \
     /absolute/path/to/inti-brain/server.py

For Claude Desktop, add an equivalent mcpServers entry pointing at venv/bin/python server.py with the two env vars.

First run

fetch_programs — sync every program you can access.
sync_all_scopes(bounty_only=True) — optional bulk scope pull for paying programs.
hack(handle) — full attack briefing for one program (auto-pulls fresh scope).

Tools

Tool	Description
`fetch_programs()`	Sync all accessible programs into the DB
`fetch_program_scope(handle)`	Fetch one program's domains + ROE
`sync_all_scopes(bounty_only, limit)`	Bulk scope sync (one API call each — heavy)
`search_programs(query, bounty_only, status, industry, min_max_bounty, limit)`	Search synced programs
`search_scopes(program, asset, bounty_only, asset_type, limit)`	Search scope entries
`get_program(handle)`	Full program detail incl. ROE + scope (auto-syncs)
`hack(handle)`	Attack briefing: scope by bounty tier, required header, safe-harbour/tooling flags, out-of-scope section, ROE, KB hits
`search_disclosed_reports(query, weakness, limit)`	Full-text pattern-KB search (needs optional KB, below)
`get_disclosed_report(id)`	Full write-up from the pattern KB (needs optional KB)

Optional: weakness-pattern KB

The two *_disclosed_report* tools and the "Pattern KB hits" section of hack() read an optional SQLite corpus of public disclosed bug-bounty reports. Drop a disclosed_reports.db into this folder (the schema from h1-brain works as-is), or point DISCLOSED_DB_FILE at one. If absent, those tools degrade gracefully and the rest of the server works normally.

API

Base: https://api.intigriti.com/external/researcher/v1
Auth: Authorization: Bearer <researcher-api-token>
Programs: GET /programs?limit=&offset= (offset pagination)
Program detail / scope: GET /programs/{programId}

Notes

inti_data.db, .intienv, and disclosed_reports.db are git-ignored — your token and local data never get committed.
Always send the program's required header on in-scope requests, or you risk being flagged / out of scope.