inti-brain

An MCP server that connects your AI assistant (Claude Code / Desktop, or any MCP client) to Intigriti. It pulls the programs you can access, their scopes (domains) and rules of engagement into a local SQLite database, then exposes tools to search programs, pull scope, and generate an actionable attack briefing via hack(handle).

It's the Intigriti equivalent of h1-brain.

Authorized testing only. Use this against programs you are permitted to test, and follow each program's scope and rules of engagement.

What it does

• Syncs every Intigriti program you can access (handle, name, bounty range, status, industry).
• Pulls each program's scope broken down by bounty tier, plus the rules of engagement — including the required request header (e.g. X-Intigriti-Username: {you}), safe-harbour status, and whether automated tooling is allowed.
• hack(handle) returns a full briefing: bounty-eligible assets first, no-bounty assets, an explicit out-of-scope section, the required header, the ROE, and (optionally) weakness-pattern hits from a disclosed-report KB.

Requirements

• Python 3.10+
• An Intigriti Researcher API personal access token (generate at https://app.intigriti.com/researcher/personal-access-tokens).

Setup

git clone https://github.com/<you>/inti-brain.git
cd inti-brain
python3 -m venv venv
./venv/bin/pip install -r requirements.txt

cp .intienv.example .intienv   # then edit .intienv with your token

.intienv:

INTI_USERNAME=your_intigriti_username
INTI_API_TOKEN=your_researcher_api_token

Connect to Claude Code

claude mcp add inti-brain \
  -e INTI_USERNAME=your_username \
  -e INTI_API_TOKEN=your_token \
  -- /absolute/path/to/inti-brain/venv/bin/python \
     /absolute/path/to/inti-brain/server.py

For Claude Desktop, add an equivalent mcpServers entry pointing at venv/bin/python server.py with the two env vars.

First run

1. fetch_programs — sync every program you can access.
2. sync_all_scopes(bounty_only=True) — optional bulk scope pull for paying programs.
3. hack(handle) — full attack briefing for one program (auto-pulls fresh scope).

Tools

Tool	Description
fetch_programs()	Sync all accessible programs into the DB
fetch_program_scope(handle)	Fetch one program's domains + ROE
sync_all_scopes(bounty_only, limit)	Bulk scope sync (one API call each — heavy)
search_programs(query, bounty_only, status, industry, min_max_bounty, limit)	Search synced programs
search_scopes(program, asset, bounty_only, asset_type, limit)	Search scope entries
get_program(handle)	Full program detail incl. ROE + scope (auto-syncs)
hack(handle)	Attack briefing: scope by bounty tier, required header, safe-harbour/tooling flags, out-of-scope section, ROE, KB hits
search_disclosed_reports(query, weakness, limit)	Full-text pattern-KB search (needs optional KB, below)
get_disclosed_report(id)	Full write-up from the pattern KB (needs optional KB)

Optional: weakness-pattern KB

The two *_disclosed_report* tools and the "Pattern KB hits" section of hack() read an optional SQLite corpus of public disclosed bug-bounty reports. Drop a disclosed_reports.db into this folder (the schema from h1-brain works as-is), or point DISCLOSED_DB_FILE at one. If absent, those tools degrade gracefully and the rest of the server works normally.

API

• Base: https://api.intigriti.com/external/researcher/v1
• Auth: Authorization: Bearer <researcher-api-token>
• Programs: GET /programs?limit=&offset= (offset pagination)
• Program detail / scope: GET /programs/{programId}

Notes

• inti_data.db, .intienv, and disclosed_reports.db are git-ignored — your token and local data never get committed.
• Always send the program's required header on in-scope requests, or you risk being flagged / out of scope.

License

MIT