MCP server for BountyLens — connect Claude Code to your Hunter Tracker.
Push findings, leads, tested endpoints, and full report drafts directly from your terminal to the BountyLens dashboard. Everything you log during a hunt session appears in real-time in the web UI with an MCP badge.
Go to bountylens.com/dashboard/settings → Integrations → Generate New API Key.
Copy the key — it's only shown once.
Add to your MCP config at ~/.claude/.mcp.json:
{
"mcpServers": {
"bountylens": {
"command": "npx",
"args": ["-y", "@bountylens/mcp"],
"env": {
"BOUNTYLENS_API_KEY": "bl_your_key_here"
}
}
}
}The BountyLens tools will be available immediately. No other setup needed.
| Tool | Description |
|---|---|
bountylens_list_sessions |
List hunt sessions — filter by status (active/paused/completed) or program_id |
bountylens_create_session |
Start a new hunt session with a title and optional program |
bountylens_get_session |
Get a session with all its entries and counts |
bountylens_update_session |
Update title, status, or notes |
bountylens_delete_session |
Permanently delete a session and all its entries and reports |
| Tool | Description |
|---|---|
bountylens_list_entries |
List entries in a session — filter by type (tested/lead/finding/note) |
bountylens_add_finding |
Log a validated finding with severity, endpoint, method, and description |
bountylens_add_lead |
Log a promising lead that needs further investigation |
bountylens_add_tested |
Mark an endpoint or feature as tested |
bountylens_add_note |
Add a freeform note to the session |
bountylens_update_entry |
Update an entry's title, description, status, or severity |
bountylens_delete_entry |
Remove an entry |
bountylens_bulk_add_entries |
Add up to 50 entries in one call — for batch logging findings, leads, or tested endpoints |
| Tool | Description |
|---|---|
bountylens_draft_report |
Create a report draft — include summary, steps to reproduce, impact, and remediation |
bountylens_list_reports |
List all report drafts in a session |
bountylens_update_report |
Edit a report's title, body, or status (draft/ready/submitted) |
bountylens_delete_report |
Permanently delete a report |
| Tool | Description |
|---|---|
bountylens_search_programs |
Search bug bounty programs by name or handle |
During a hunt in Claude Code, the LLM uses these tools automatically based on your instructions:
"List my active sessions"
→ bountylens_list_sessions with status=active
"Save this XSS finding to my Shopify session"
→ bountylens_add_finding with title, severity, endpoint, description
"What leads do I have open on the Uber hunt?"
→ bountylens_list_entries with type=lead
"Mark /api/auth as tested, CSRF tokens are present"
→ bountylens_add_tested with endpoint and description
"Draft a report for the SSRF finding"
→ bountylens_draft_report with full report body
"Push reports/ssrf-uber.md to my Uber session"
→ reads the file, calls bountylens_draft_report with contents
| Variable | Required | Default | Description |
|---|---|---|---|
BOUNTYLENS_API_KEY |
Yes | — | API key from dashboard settings |
BOUNTYLENS_URL |
No | https://bountylens.com |
Custom instance URL (self-hosted) |
The MCP server wraps the BountyLens API v1. All endpoints require a Bearer token in the Authorization header.
GET /api/v1/sessions — list sessions
POST /api/v1/sessions — create session
GET /api/v1/sessions/:id — get session + entries
PUT /api/v1/sessions/:id — update session
DELETE /api/v1/sessions/:id — delete session
GET /api/v1/sessions/:id/entries — list entries
POST /api/v1/sessions/:id/entries — create entry
POST /api/v1/sessions/:id/entries/bulk — bulk create entries (max 50)
PUT /api/v1/sessions/:id/entries/:entryId — update entry
DELETE /api/v1/sessions/:id/entries/:entryId — delete entry
GET /api/v1/sessions/:id/reports — list reports
POST /api/v1/sessions/:id/reports — create report
PUT /api/v1/sessions/:id/reports/:reportId — update report
DELETE /api/v1/sessions/:id/reports/:reportId — delete report
GET /api/v1/programs?q=search — search programs
Rate limit: 60 requests/minute per API key.
- API keys are SHA-256 hashed in the database — never stored in plaintext
- Keys are shown once on creation and cannot be retrieved
- All queries are parameterized — no SQL injection
- Every request verifies resource ownership — no IDOR
- Pro subscription is validated on every API call
- Rate limited to prevent abuse
- Node.js 18+
- BountyLens Pro subscription
- API key from the dashboard
We welcome contributions. See CONTRIBUTING.md for guidelines.
MIT — see LICENSE