← Back to directory

BountyLens MCP Server

Official

Connect Claude Code to your BountyLens Hunter Tracker

GitHub source repository ↗

★ 64 Stars Category · Other Popular Source revision 912dce311f0c

56FMRS · C

Reliability

6/20

Security and permissions

12/20

Maintenance

9/20

Documentation

16/20

Setup experience

13/20

The README describes this as BountyLens' own MCP server (matching repo bountylens/mcp and package @bountylens/mcp), launched via npx over stdio, exposing 23 tools across sessions, entries, reports, search, programs, and intelligence categories. It requires API key auth and an active Pro subscription; the docs note security measures like hashed key storage, parameterized queries, and per-request ownership checks, but deletion operations are irreversible and should be used carefully.

Read the FMRS scoring method →

The BountyLens MCP server connects Claude Code to BountyLens' (bountylens.com) Hunter Tracker. From the terminal you can log findings, leads, and tested endpoints, draft full vulnerability reports, search across all your hunt sessions, pull bug bounty program intelligence, and check your hunt stats — everything you log shows up in real time in the web dashboard with an MCP badge. It runs locally via npx over stdio, authenticates with a BOUNTYLENS_API_KEY, and talks to the BountyLens API v1 (default https://bountylens.com, with support for a self-hosted BOUNTYLENS_URL).

Tools

bountylens_list_sessions

List hunt sessions, filterable by status (active/paused/completed), program ID, or program handle

bountylens_create_session

Start a new hunt session with a title and an optional linked program (by ID or handle)

bountylens_get_session

Get a session along with all its entries and counts

bountylens_update_session

Update a session's title, status, or notes

bountylens_delete_session

Permanently delete a session and all its entries and reports

bountylens_list_entries

List entries in a session, filterable by type (tested/lead/finding/note) and/or tag

bountylens_add_finding

Log a validated finding with severity, endpoint, method, description, tags, and chain_id

bountylens_add_lead

Log a promising lead, with support for tags, chain_id, and retest_at

bountylens_add_tested

Mark an endpoint or feature as tested, with support for tags and retest_at

bountylens_add_note

Add a freeform note to a session, with support for tags

bountylens_update_entry

Update an entry's title, description, status, severity, type, endpoint, method, tags, chain_id, or retest_at (passing tags replaces the existing set)

bountylens_delete_entry

Remove an entry

bountylens_bulk_add_entries

Add up to 50 entries in a single call, each supporting tags, chain_id, and retest_at

bountylens_draft_report

Create a report draft with a summary, steps to reproduce, impact, and remediation

bountylens_list_reports

List all report drafts in a session

bountylens_update_report

Edit a report's title, body, severity, or status (draft/ready/submitted lifecycle, or a closed outcome such as resolved/duplicate/informative/not_applicable)

bountylens_delete_report

Permanently delete a report

bountylens_search_entries

Search across all sessions for entries matching a query, to find past findings, leads, or tested endpoints without knowing which session they're in

bountylens_search_programs

Search bug bounty programs by name or handle

bountylens_get_program

Get full program details — bounties, dupe risk, health score, scope list, and recent scope changes

bountylens_recommend_programs

Get program recommendations ranked by opportunity score, filterable by platform or minimum bounty

bountylens_get_watchlist

Get your watched programs with metrics — bounties, dupe risk, health, scope changes, and session count

bountylens_get_my_stats

Get your hunt statistics — sessions, findings, leads, tested endpoints, time spent, and a per-program breakdown

Setup

Go to bountylens.com/dashboard/settings → Integrations → Generate New API Key, and copy it immediately (it's shown only once).
Add a bountylens entry to ~/.claude/.mcp.json with command "npx", args ["-y", "@bountylens/mcp"], and env BOUNTYLENS_API_KEY set to your key; optionally set BOUNTYLENS_URL for a self-hosted instance.
Restart Claude Code — the tools become available immediately, no other setup needed.
Requires Node.js 18+ and an active BountyLens Pro subscription.

claude_desktop_config.json

{"mcpServers":{"bountylens":{"command":"npx","args":["-y","@bountylens/mcp"],"env":{"BOUNTYLENS_API_KEY":"bl_your_key_here"}}}}

Generate and validate client config

Fit and risk

Best for

Security researchers with a BountyLens Pro subscription who run bug bounty hunts or authorized pentests from the terminal using Claude Code
Individual hunters or teams who want findings, leads, testing notes, and report drafting tied directly into their AI assistant workflow

Not for

Users without a BountyLens account or Pro subscription
Teams that need to work with a different vulnerability-management platform outside the BountyLens ecosystem
Anyone looking for automated scanning or exploitation tooling — this server only logs, searches, and surfaces intelligence, it doesn't perform any active scanning or attacks

Required permissions

Requires a BountyLens API key (via the BOUNTYLENS_API_KEY environment variable) that has read/write access to your account's sessions, entries, reports, and program intelligence
Network access to call the BountyLens API (default bountylens.com, or a self-hosted BOUNTYLENS_URL)

Risks and side effects

If the API key leaks, an attacker could read or tamper with all your hunt sessions, findings, and unsubmitted report drafts — which may contain sensitive vulnerability details
delete_session, delete_entry, and delete_report actions are permanent and unrecoverable, so accidental use can destroy hunt work
Draft reports and other content sync in real time to the web dashboard, so local terminal access should be controlled
The API is rate limited to 60 requests/minute per key, so heavy bulk operations can be throttled

Troubleshooting

Tools not showing up: confirm ~/.claude/.mcp.json is configured correctly and Claude Code has been restarted
Authentication failures: verify BOUNTYLENS_API_KEY is correct and current — keys are shown only once at creation and must be regenerated if lost
Can't reach a self-hosted instance: confirm BOUNTYLENS_URL is set and reachable
Calls being rejected or features limited: confirm the BountyLens account has an active Pro subscription, since it's validated on every API call
Requests failing or slowing down: check whether you've hit the 60 requests/minute rate limit

Use cases

Logging findings, leads, and tested endpoints into the right session by natural language during a live pentest or bug bounty hunt

Searching across all past sessions to check whether a vulnerability class (e.g. SSRF) was already tested on any target

Looking up a program's scope, bounties, dupe risk, and health score to decide what to hunt next

Pushing a locally-written report draft file straight into a BountyLens report draft

Reviewing personal hunt statistics — time spent and per-program output — for the current month

Supported clients

Claude CodeFull support

Related MCP servers

Compare with other MCP servers