@bountylens/mcp

MCP server for BountyLens — connect Claude Code to your Hunter Tracker.

Push findings, leads, tested endpoints, and full report drafts directly from your terminal to the BountyLens dashboard. Everything you log during a hunt session appears in real-time in the web UI with an MCP badge.

Quick Start

1. Get an API key

Go to bountylens.com/dashboard/settings → Integrations → Generate New API Key.

Copy the key — it's only shown once.

2. Add to Claude Code

Add to your MCP config at ~/.claude/.mcp.json:

{
  "mcpServers": {
    "bountylens": {
      "command": "npx",
      "args": ["-y", "@bountylens/mcp"],
      "env": {
        "BOUNTYLENS_API_KEY": "bl_your_key_here"
      }
    }
  }
}

3. Restart Claude Code

The BountyLens tools will be available immediately. No other setup needed.

Tools

Sessions

Tool	Description
bountylens_list_sessions	List hunt sessions — filter by status (active/paused/completed) or program_id
bountylens_create_session	Start a new hunt session with a title and optional program
bountylens_get_session	Get a session with all its entries and counts
bountylens_update_session	Update title, status, or notes

Entries

Tool	Description
bountylens_list_entries	List entries in a session — filter by type (tested/lead/finding/note)
bountylens_add_finding	Log a validated finding with severity, endpoint, method, and description
bountylens_add_lead	Log a promising lead that needs further investigation
bountylens_add_tested	Mark an endpoint or feature as tested
bountylens_add_note	Add a freeform note to the session
bountylens_update_entry	Update an entry's title, description, status, or severity
bountylens_delete_entry	Remove an entry

Reports

Tool	Description
bountylens_draft_report	Create a report draft — include summary, steps to reproduce, impact, and remediation
bountylens_list_reports	List all report drafts in a session
bountylens_update_report	Edit a report's title, body, or status (draft/ready/submitted)

Programs

Tool	Description
bountylens_search_programs	Search bug bounty programs by name or handle

Usage Examples

During a hunt in Claude Code, the LLM uses these tools automatically based on your instructions:

"List my active sessions"
→ bountylens_list_sessions with status=active

"Save this XSS finding to my Shopify session"
→ bountylens_add_finding with title, severity, endpoint, description

"What leads do I have open on the Uber hunt?"
→ bountylens_list_entries with type=lead

"Mark /api/auth as tested, CSRF tokens are present"
→ bountylens_add_tested with endpoint and description

"Draft a report for the SSRF finding"
→ bountylens_draft_report with full report body

"Push reports/ssrf-uber.md to my Uber session"
→ reads the file, calls bountylens_draft_report with contents

Environment Variables

Variable	Required	Default	Description
BOUNTYLENS_API_KEY	Yes	—	API key from dashboard settings
BOUNTYLENS_URL	No	https://bountylens.com	Custom instance URL (self-hosted)

API Reference

The MCP server wraps the BountyLens API v1. All endpoints require a Bearer token in the Authorization header.

GET    /api/v1/sessions                         — list sessions
POST   /api/v1/sessions                         — create session
GET    /api/v1/sessions/:id                      — get session + entries
PUT    /api/v1/sessions/:id                      — update session
DELETE /api/v1/sessions/:id                      — delete session
GET    /api/v1/sessions/:id/entries              — list entries
POST   /api/v1/sessions/:id/entries              — create entry
PUT    /api/v1/sessions/:id/entries/:entryId     — update entry
DELETE /api/v1/sessions/:id/entries/:entryId     — delete entry
GET    /api/v1/sessions/:id/reports              — list reports
POST   /api/v1/sessions/:id/reports              — create report
PUT    /api/v1/sessions/:id/reports/:reportId    — update report
DELETE /api/v1/sessions/:id/reports/:reportId    — delete report
GET    /api/v1/programs?q=search                 — search programs

Rate limit: 60 requests/minute per API key.

Security

• API keys are SHA-256 hashed in the database — never stored in plaintext
• Keys are shown once on creation and cannot be retrieved
• All queries are parameterized — no SQL injection
• Every request verifies resource ownership — no IDOR
• Pro subscription is validated on every API call
• Rate limited to prevent abuse

Requirements

• Node.js 18+
• BountyLens Pro subscription
• API key from the dashboard

Contributing

We welcome contributions. See CONTRIBUTING.md for guidelines.

License

MIT — see LICENSE