M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
B

BountyLens MCP Server

Official
Connect Claude Code to your BountyLens Hunter Tracker
How to install ↓ Compare GitHub source repository ↗
Category
Other #101 of 230
Stars
★ 65 Popular
Transport
stdio (local process)
Runtime
Node.js 18+
Credentials
API key / credential required
License
MIT
Last commit
Tools
23
56FMRS · C

The README describes this as BountyLens' own MCP server (matching repo bountylens/mcp and package @bountylens/mcp), launched via npx over stdio, exposing 23 tools across sessions, entries, reports, search, programs, and intelligence categories. It requires API key auth and an active Pro subscription; the docs note security measures like hashed key storage, parameterized queries, and per-request ownership checks, but deletion operations are irreversible and should be used carefully.

Strongest · Documentation 16/20 Weakest · Reliability 6/20

Reliability
6/20
Security and permissions
12/20
Maintenance
9/20
Documentation
16/20
Setup experience
13/20
Why each score
Reliability 6/20
The server manifest is uncached, so there is no way to cross-check the 23 tools described in the README against actual server behavior, and no test files, CI workflows, or documented error-handling/retry behavior are present. The README's tool/parameter descriptions are internally consistent and plausible, but there is no reviewable execution evidence (no scripts, tests, or sample logs). Per the static calibration rule this cannot exceed 12, and the missing manifest pushes it lower still.
Security and permissions 12/20
Authentication uses a Bearer API key supplied via environment variable; the install example uses a placeholder key, not a real secret. The README claims SHA-256 hashed key storage, parameterized queries, per-request ownership verification, subscription gating, and rate limiting (60 req/min), but these are unverified self-reported claims with no supporting code shown. More notably, bountylens_delete_session/delete_entry/delete_report are irreversible delete operations (delete_session cascades to all entries and reports in that session) with no explicit confirmation parameter or soft-delete/undo path described — a real risk of accidental data loss. Because the blast radius is scoped to the user's own data and not system-level/payment/remote-execution, this falls short of a full red-line but still warrants a meaningful deduction.
Maintenance 9/20
The repo is MIT licensed and not archived, with 64 stars and 0 open issues, but the supplied material contains no commit history, release cadence, changelog, or security-response channel information, so maintenance activity and versioning maturity cannot be verified — only a mid-low score is justified.
Documentation 16/20
The README is well organized: quick start, an environment variable table, all 23 tools described by category with parameters, a full REST API endpoint listing, tag conventions, usage examples, and a security section. Gaps include no troubleshooting section, no documented error codes/failure modes, and the hard requirement of a paid Pro subscription is only briefly noted near the end rather than surfaced as a prerequisite up front.
Setup experience 13/20
Setup is simple on paper: run via npx, configure a single required environment variable, and a ready-made Claude Code JSON config is provided. However, as this is a purely static review with no CI or committed tests demonstrating the config actually works, the setup score is capped at 15 per the calibration rule. The server also depends on an external paid (Pro) subscription to function at all, adding a hidden barrier to reaching a genuinely working connection.

Static review · not runListed 2026-08-26

Read the FMRS scoring method →

Fit and risk

What it can accessUses the networkChanges third-party account data

Best for

  • Security researchers with a BountyLens Pro subscription who run bug bounty hunts or authorized pentests from the terminal using Claude Code
  • Individual hunters or teams who want findings, leads, testing notes, and report drafting tied directly into their AI assistant workflow

Not for

  • Users without a BountyLens account or Pro subscription
  • Teams that need to work with a different vulnerability-management platform outside the BountyLens ecosystem
  • Anyone looking for automated scanning or exploitation tooling — this server only logs, searches, and surfaces intelligence, it doesn't perform any active scanning or attacks

Required permissions

  • Requires a BountyLens API key (via the BOUNTYLENS_API_KEY environment variable) that has read/write access to your account's sessions, entries, reports, and program intelligence
  • Network access to call the BountyLens API (default bountylens.com, or a self-hosted BOUNTYLENS_URL)

Risks and side effects

  • If the API key leaks, an attacker could read or tamper with all your hunt sessions, findings, and unsubmitted report drafts — which may contain sensitive vulnerability details
  • delete_session, delete_entry, and delete_report actions are permanent and unrecoverable, so accidental use can destroy hunt work
  • Draft reports and other content sync in real time to the web dashboard, so local terminal access should be controlled
  • The API is rate limited to 60 requests/minute per key, so heavy bulk operations can be throttled

Setup

Before you start

Runtime：Node.js 18+

BOUNTYLENS_API_KEY requiredsecret BountyLens API key, generated at bountylens.com/dashboard/settings under Integrations; shown only once, required.
Other optional settings (1)
BOUNTYLENS_URL optional Optional, custom instance URL (self-hosted); defaults to https://bountylens.com.
  1. Go to bountylens.com/dashboard/settings → Integrations → Generate New API Key, and copy it immediately (it's shown only once).
  2. Add a bountylens entry to ~/.claude/.mcp.json with command "npx", args ["-y", "@bountylens/mcp"], and env BOUNTYLENS_API_KEY set to your key; optionally set BOUNTYLENS_URL for a self-hosted instance.
  3. Restart Claude Code — the tools become available immediately, no other setup needed.
  4. Requires Node.js 18+ and an active BountyLens Pro subscription.
.mcp.json 
{"mcpServers":{"bountylens":{"command":"npx","args":["-y","@bountylens/mcp"],"env":{"BOUNTYLENS_API_KEY":"bl_your_key_here"}}}}

Shown for Claude Code. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "bountylens": {
      "command": "npx",
      "args": [
        "-y",
        "@bountylens/mcp"
      ],
      "env": {
        "BOUNTYLENS_API_KEY": "bl_your_key_here"
      }
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add bountylens -e BOUNTYLENS_API_KEY=bl_your_key_here -- npx -y @bountylens/mcp

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

After restarting Claude Code, the tool list should show the 23 tools prefixed with bountylens_; alternatively ask "List my active sessions" — a returned session list proves the connection works.

Troubleshooting

  1. Tools not showing up: confirm ~/.claude/.mcp.json is configured correctly and Claude Code has been restarted
  2. Authentication failures: verify BOUNTYLENS_API_KEY is correct and current — keys are shown only once at creation and must be regenerated if lost
  3. Can't reach a self-hosted instance: confirm BOUNTYLENS_URL is set and reachable
  4. Calls being rejected or features limited: confirm the BountyLens account has an active Pro subscription, since it's validated on every API call
  5. Requests failing or slowing down: check whether you've hit the 60 requests/minute rate limit

Things to try

Once connected, you can ask your AI assistant things like:

  • List my active sessions
  • Save this XSS finding to my Shopify session
  • Have I tested SSRF on any target before?
  • How much time have I spent hunting this month?

Tools 23

bountylens_list_sessions read-only
List hunt sessions, filterable by status (active/paused/completed), program ID, or program handle
bountylens_create_session writes
Start a new hunt session with a title and an optional linked program (by ID or handle)
bountylens_get_session read-only
Get a session along with all its entries and counts
bountylens_update_session writes
Update a session's title, status, or notes
bountylens_delete_session destructive
Permanently delete a session and all its entries and reports
bountylens_list_entries read-only
List entries in a session, filterable by type (tested/lead/finding/note) and/or tag
bountylens_add_finding writes
Log a validated finding with severity, endpoint, method, description, tags, and chain_id
bountylens_add_lead writes
Log a promising lead, with support for tags, chain_id, and retest_at
Show 15 more tools
bountylens_add_tested writes
Mark an endpoint or feature as tested, with support for tags and retest_at
bountylens_add_note writes
Add a freeform note to a session, with support for tags
bountylens_update_entry writes
Update an entry's title, description, status, severity, type, endpoint, method, tags, chain_id, or retest_at (passing tags replaces the existing set)
bountylens_delete_entry destructive
Remove an entry
bountylens_bulk_add_entries writes
Add up to 50 entries in a single call, each supporting tags, chain_id, and retest_at
bountylens_draft_report writes
Create a report draft with a summary, steps to reproduce, impact, and remediation
bountylens_list_reports read-only
List all report drafts in a session
bountylens_update_report writes
Edit a report's title, body, severity, or status (draft/ready/submitted lifecycle, or a closed outcome such as resolved/duplicate/informative/not_applicable)
bountylens_delete_report destructive
Permanently delete a report
bountylens_search_entries read-only
Search across all sessions for entries matching a query, to find past findings, leads, or tested endpoints without knowing which session they're in
bountylens_search_programs read-only
Search bug bounty programs by name or handle
bountylens_get_program read-only
Get full program details — bounties, dupe risk, health score, scope list, and recent scope changes
bountylens_recommend_programs read-only
Get program recommendations ranked by opportunity score, filterable by platform or minimum bounty
bountylens_get_watchlist read-only
Get your watched programs with metrics — bounties, dupe risk, health, scope changes, and session count
bountylens_get_my_stats read-only
Get your hunt statistics — sessions, findings, leads, tested endpoints, time spent, and a per-program breakdown

Use cases

Logging findings, leads, and tested endpoints into the right session by natural language during a live pentest or bug bounty hunt
Searching across all past sessions to check whether a vulnerability class (e.g. SSRF) was already tested on any target
Looking up a program's scope, bounties, dupe risk, and health score to decide what to hunt next
Pushing a locally-written report draft file straight into a BountyLens report draft
Reviewing personal hunt statistics — time spent and per-program output — for the current month

Supported clients

Claude Code

Listed from the project's documentation, not tested by this site.

Overview

The BountyLens MCP server connects Claude Code to BountyLens' (bountylens.com) Hunter Tracker. From the terminal you can log findings, leads, and tested endpoints, draft full vulnerability reports, search across all your hunt sessions, pull bug bounty program intelligence, and check your hunt stats — everything you log shows up in real time in the web dashboard with an MCP badge. It runs locally via npx over stdio, authenticates with a BOUNTYLENS_API_KEY, and talks to the BountyLens API v1 (default https://bountylens.com, with support for a self-hosted BOUNTYLENS_URL).

Similar servers

BioMCP 75 · B

One binary. One grammar. Evidence from the biomedical sources you already trust.

★ 654 · Tools 11 Compare with this →
Compare with other MCP servers

Source revision 912dce311f0c Data synced 2026-10-12 Read the FMRS scoring method