HuntX
MCP server providing direct tool-access to security-testing primitives for bug bounty hunting, including recon, request replay, IDOR/BOLA fuzzing, vulnerability detection, secrets scanning, and persistent hunt memory with confidence-scored findings.
README
HuntX
Personal MCP (Model Context Protocol) server giving Claude Code (or any MCP-compatible client) direct tool-access to security-testing primitives for bug bounty hunting: recon querying/triggering, HTTP request replay, IDOR/BOLA fuzzing, SQLi/XSS/SSTI/SSRF detection, JWT/OAuth testing, secrets scanning, misconfiguration/exposure checks, and persistent hunt memory with confidence-scored findings across sessions.
Every finding gets a confidence level (confirmed/likely/
needs_review) and nothing auto-escalates without explicit human
review — see AGENTS.md for the full design principles.
Requirements
- Python 3.12+
- uv
Optional external tools
Most adapters work standalone. A few shell out to external CLI tools — install these only if you need the corresponding adapter:
| Adapter | Needs |
|---|---|
secrets_scan |
gitleaks, trufflehog on PATH |
nuclei_scanner |
nuclei on PATH (with templates: nuclei -update-templates) |
recon_bridge / recon_trigger |
reconFTW installed — recon_bridge reads its Recon/<domain>/ output, recon_trigger runs it directly |
Setup
uv sync
uv run huntx
Then add HuntX as an MCP server in your Claude Code config, pointing at
this project's huntx entrypoint.
Configuration (environment variables)
| Variable | Default | Purpose |
|---|---|---|
HUNTX_DB_PATH |
~/.huntx/memory.db |
SQLite database for request history and findings |
HUNTX_OOB_SERVER |
public interactsh pool (oast.pro) |
Interactsh server for ssrf_scanner's out-of-band detection. Set this to a self-hosted interactsh-server instance before testing anything sensitive — the public pool's "zero logging" claim is unaudited, and any data a target leaks via SSRF transits that third-party server. Without this set, ssrf_scan logs a warning and flags oob_is_public_pool: true in its results so it's never silent. |
Recommended Servers
playwright-mcp
A Model Context Protocol server that enables LLMs to interact with web pages through structured accessibility snapshots without requiring vision models or screenshots.
Audiense Insights MCP Server
Enables interaction with Audiense Insights accounts via the Model Context Protocol, facilitating the extraction and analysis of marketing insights and audience data including demographics, behavior, and influencer engagement.
Magic Component Platform (MCP)
An AI-powered tool that generates modern UI components from natural language descriptions, integrating with popular IDEs to streamline UI development workflow.
VeyraX MCP
Single MCP tool to connect all your favorite tools: Gmail, Calendar and 40 more.
graphlit-mcp-server
The Model Context Protocol (MCP) Server enables integration between MCP clients and the Graphlit service. Ingest anything from Slack to Gmail to podcast feeds, in addition to web crawling, into a Graphlit project - and then retrieve relevant contents from the MCP client.
Kagi MCP Server
An MCP server that integrates Kagi search capabilities with Claude AI, enabling Claude to perform real-time web searches when answering questions that require up-to-date information.
Neon Database
MCP server for interacting with Neon Management API and databases
Exa Search
A Model Context Protocol (MCP) server lets AI assistants like Claude use the Exa AI Search API for web searches. This setup allows AI models to get real-time web information in a safe and controlled way.
Qdrant Server
This repository is an example of how to create a MCP server for Qdrant, a vector search engine.
E2B
Using MCP to run code via e2b.