# Bugcrowd MCP for AI Agents AI Agent Connect

> Bugcrowd MCP connects your crowdsourced security platform to your AI agent. Track bug bounty submissions, manage security programs, and inspect assets in scope without switching tabs. It turns your AI into a security operations hub for managing vulnerability reports and crowdsourced engagements.

## Overview
- **Category:** fort-knox
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_pOcsQxZr13X2rNcGUbtE04FMIHfX8vBhvP2v43C1/ai-agent-connect
- **Tags:** bug-bounty, vulnerability-management, security-testing, crowdsourced-security, incident-response, cybersecurity

## Description

Most security teams spend half their day jumping between their bug bounty dashboard and internal communication tools. You have to log in, find the right program, scroll through dozens of submissions, and copy-paste IDs just to give your team a status update. This Connector changes that by letting your AI agent do the heavy lifting. You can just ask for a summary of new submissions or a status update on a specific engagement, getting the info you need in seconds without ever opening a browser tab. 

It brings the entire Bugcrowd workspace into your existing workflow. You can check the status of every submission across your active programs or ask for a summary of a specific bug bounty. If you need to add a new target to a program's scope, you just tell your agent what the asset is. Since Vinkius hosts this Connector, you can plug it into your favorite tools and start managing your security posture through simple conversation. You get a way to keep your team updated on crowd executions and ensure no vulnerability report falls through the cracks, all without leaving your workspace.

## Tools

### create_submission
Create a new vulnerability report from an external source using natural language. This helps you log findings quickly.

### get_engagement
Get the specific details and status of a bug bounty or pen test. Use this to track active crowd work.

### get_organization_info
Retrieve your core organization settings and workspace details. This is useful for quick configuration audits.

### get_program
Get specific metadata, rewards, and scopes for a security program. Use this to verify program details.

### get_submission
Get the full details of a single vulnerability report. This helps you inspect specific bug findings.

### get_target
Get details on a specific asset or target in scope. This helps you confirm if a target is valid.

### list_engagements
List all active crowd engagements like bounties and pen tests. Use this to see all current work.

### list_programs
List all security programs currently active in your workspace. This provides a high-level program overview.

### list_submissions
List all vulnerability submissions across your programs. This helps you see all incoming reports at once.

### list_targets
List all assets currently in scope for your organization. Use this to audit your current target list.

## Prompt Examples

**Prompt:** 
```
What's the status of our current bug bounty programs?
```

**Response:** 
```
I've pulled your active programs. Here is the current status:

| Program Name | ID | Reward | Status |
| :--- | :--- | :--- | :--- |
| Web App Bounty | `prog_123` | $50,000 | Active |
| Mobile API | `prog_456` | $25,000 | Paused |
| Legacy Systems | `prog_789` | $10,000 | Active |
```

**Prompt:** 
```
List the latest 5 reports for the web app program.
```

**Response:** 
```
Retrieving the 5 most recent submissions for the Web App Bounty (`prog_123`):

* **SQL Injection in /api** - Status: Triaged
* **XSS on Login Page** - Status: Unresolved
* **Broken Auth** - Status: Resolved
* **Rate Limiting Issue** - Status: New
* **Information Disclosure** - Status: New
```

**Prompt:** 
```
Is the api.example.com domain in scope for our main program?
```

**Response:** 
```
I've checked the targets for your main program (`prog_123`). 

Yes, **api.example.com** is currently listed as an in-scope asset. You can find it in the target list under the 'Production' category.
```

## Capabilities

### List all active security programs
See every security program currently active in your workspace at once.

### Retrieve specific vulnerability report metadata
Get the full details of any individual bug report.

### Monitor bug bounty and pen test execution status
Check the progress of active crowd engagements like bounties or pen tests.

### Inspect assets in scope for specific programs
Verify which targets and assets are included in your program scope.

### Create new vulnerability submissions from external sources
Log new vulnerability reports into Bugcrowd using natural language.

### Pull core organization settings and workspace info
Access your organization's core settings and workspace details instantly.

## Use Cases

### Triage Overflow
A manager asks for the last 10 submissions to see if any high-severity bugs need immediate attention.

### Scope Verification
An engineer asks to list targets for a specific program to see if a reported URL is actually in scope.

### Program Audit
A security lead wants to see all active programs and their rewards to prepare for a quarterly review.

### Rapid Logging
A researcher sends a report and the manager uses create_submission to log it into Bugcrowd instantly.

## Benefits

- Stop switching tabs by using list_submissions to see all reports in one place.
- Quickly verify program scopes using list_targets to ensure researchers stay within bounds.
- Speed up report creation by using create_submission to log external findings immediately.
- Get instant context on specific findings using get_submission to triage issues faster.
- Keep a pulse on all active work by using list_engagements to see every bounty and pen test.
- Access your organization's core settings instantly with get_organization_info for quick audits.

## How It Works

The bottom line is you get a direct line to your Bugcrowd data without manual dashboard navigation.

1. Subscribe to the Bugcrowd MCP on Vinkius.
2. Provide your Bugcrowd API Access Token.
3. Ask your AI agent to list programs or check submission statuses.

## Frequently Asked Questions

**Can I use the Bugcrowd MCP to see my bug bounty reports?**
Yes, this Connector lets you view all vulnerability submissions across your programs. You can ask your agent to list them all or pull details on a specific report.

**Does the Bugcrowd MCP work with Cursor?**
Yes, you can connect this Connector to Cursor or any other compatible client. Once connected, you can manage your security programs directly from your code editor.

**How do I add a new report to Bugcrowd using this?**
You can use the create_submission tool to log new findings. Just tell your agent the details of the vulnerability, and it will create the report for you.

**Can my agent check which assets are in scope?**
Yes, it can list all targets in your programs. This is great for quickly verifying if a researcher's finding is within your authorized scope.

**Is this Connector for managing my Bugcrowd payments?**
No, this Connector focuses on vulnerability management, programs, and targets. It does not handle financial transactions or payment processing.

**Can I see all my active pen tests?**
Yes, you can list all active crowd engagements. This includes both bug bounty programs and professional penetration tests.

**Can I check the scope of a security program using the agent?**
Yes! Use the `get_program` tool with the Program ID. Your agent will fetch the detailed metadata, including targets and scope descriptions, from Bugcrowd.

**How do I list all the vulnerability submissions for my account?**
Simply ask the agent to `list_submissions`. It will retrieve the latest vulnerability reports from your Bugcrowd account, including titles and statuses like 'triaged' or 'resolved'.

**Does the integration allow creating a new submission?**
Yes. Use the `create_submission` action and provide the title and description. You can also associate it with a specific program by providing the `program_id`.