# HackerOne MCP for AI Agents AI Agent Connect

> HackerOne MCP lets you manage bug bounty reports and security programs directly from your AI agent. You can triage vulnerabilities, award bounties, and monitor your hacktivity feed without switching tabs. It connects your organization's security data to your workflow for faster response times.

## Overview
- **Category:** fort-knox
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_MdngwsTWgI8aN2tcglppukreOCXiR4XOops4TQFJ/ai-agent-connect
- **Tags:** bug-bounty, vulnerability-management, security-research, penetration-testing, incident-response

## Description

Connecting your HackerOne account to your AI agent changes how you handle incoming security threats. Instead of hunting through nested menus to find a specific report or checking the status of a bounty payment, you just ask your agent. It handles the heavy lifting of navigating the platform for you. Whether you're triaging a high-severity bug or updating a program's scope, the information is always right there in your chat. You can manage the entire lifecycle of a vulnerability, from the first submission to the final reward, without ever leaving your workspace. This Connector is part of the Vinkius catalog, which makes it easy to plug into your existing setup. It turns your AI into a dedicated triage engineer that knows your programs inside out. You get a clear view of your assets, a history of your payments, and a live feed of what researchers are finding. It's about getting the right data at the right time so you can focus on fixing problems rather than managing spreadsheets.

## Tools

### list_hacktivity
List the HackerOne hacktivity feed. This keeps you updated on recent discoveries in real time.

### list_payments
List bounty payments history. This helps you track your total spend and reward history.

### list_programs
List bug bounty or VDP programs you have access to. This gives you an overview of all your managed programs.

### list_reports
List vulnerability reports submitted to your HackerOne program. This is the fastest way to see new submissions.

### add_report_comment
Add a comment to a specific vulnerability report. This helps you communicate with researchers directly.

### award_bounty
Award a bounty for a vulnerability report. You can process rewards quickly to keep researchers happy.

### change_report_state
Update the state of a vulnerability report. This lets you move reports to triaged or resolved status.

### get_program
Get details for a specific security program. Use this to check scope and specific program rules.

### get_report
Get detailed information about a specific vulnerability report. This pulls all relevant data for a single bug.

### list_assets
List assets defined in your security programs. This shows you exactly what is in scope for your tests.

## Prompt Examples

**Prompt:** 
```
Show me all the reports submitted in the last 24 hours.
```

**Response:** 
```
I've pulled the latest submissions for your program. Here are the new reports from the last 24 hours:

| Report ID | Title | Severity | Status |
| :--- | :--- | :--- | :--- |
| #8821 | SQL Injection in Login | **High** | New |
| #8825 | XSS in Profile Page | **Medium** | New |
| #8829 | Info Disclosure | **Low** | New |

Would you like to see the full details for the SQL Injection report?
```

**Prompt:** 
```
Award a $200 bounty to report 99821.
```

**Response:** 
```
✅ **Bounty Awarded!**

I've successfully processed a **$200 reward** for report **#99821**. The researcher has been notified of the payment. 

Would you like me to add a comment to the report thanking them for the submission?
```

**Prompt:** 
```
What assets are currently in our scope?
```

**Response:** 
```
Here are the assets currently defined in your security program scope:

*   **Domains:** 
    *   `api.example.com`
    *   `staging.example.com`
*   **IP Ranges:** 
    *   `192.168.1.0/24`
*   **Mobile Apps:** 
    *   `ExampleApp v2.1`

Let me know if you need to check the reachability of any specific asset.
```

## Capabilities

### Triage vulnerability reports
Pull details on new submissions to prioritize high-severity issues.

### Update report statuses
Move reports to triaged, resolved, or closed states with one command.

### Award bounty payments
Process rewards for researchers immediately after a fix is verified.

### Browse security programs
Access structured scopes and asset lists for your specific programs.

### Monitor hacktivity feeds
Stay updated on new discoveries in your internal or public feeds.

### View payment history
Retrieve a full history of bounty payments for budget tracking.

### Track program assets
See exactly which assets are defined within your security programs.

## Use Cases

### The Triage Rush
A security engineer gets 50 new reports. They ask the agent to list reports and find any with High severity to prioritize the most dangerous bugs.

### The Fast Payout
A bug bounty manager confirms a fix. They ask the agent to award a $1,000 bounty and add a comment thanking the researcher for the quick turn around.

### The Scope Check
A developer wants to know if a specific IP is in scope. They ask the agent to list assets for their program to get an immediate answer.

### The Status Update
During a sprint, a team moves a bug to Resolved. They tell the agent to change the report state for that specific ID without opening a new tab.

## Benefits

- Faster triage: Use list_reports and get_report to identify high-severity bugs in seconds instead of manual searching.
- Automated rewards: Use award_bounty to pay researchers immediately after a fix is verified to keep them engaged.
- Better communication: Use add_report_comment to keep researchers updated without leaving your workspace or dashboard.
- Clearer scope: Use list_assets and get_program to keep your security boundaries organized and easily accessible.
- Real-time monitoring: Use list_hacktivity to stay on top of new discoveries as they happen in your feed.
- Financial oversight: Use list_payments to track your bounty spend and reward history for better budget management.

## How It Works

The bottom line is you get a direct line to your HackerOne data without the manual clicking.

1. Subscribe to the HackerOne MCP on Vinkius.
2. Enter your HackerOne API Token Identifier and Token Value in your client settings.
3. Ask your agent to list reports, award bounties, or check program status.

## Frequently Asked Questions

**Can I use the HackerOne MCP to manage my bug bounty rewards?**
Yes, you can award bounties and view payment history directly through your AI agent. This helps you keep track of your spend and reward researchers quickly.

**How does the HackerOne MCP help with vulnerability triage?**
It allows your agent to list all new reports and pull specific details for each one. You can quickly identify high-priority bugs without digging through a dashboard.

**Can my AI agent update report statuses with this Connector?**
Yes, you can tell your agent to change a report's state to triaged, resolved, or closed. It updates your HackerOne program status in real time.

**Does the HackerOne MCP work for VDP programs?**
Yes, it supports both bug bounty and Vulnerability Disclosure Programs. You can manage your programs, assets, and reports regardless of the payout model.

**Can I see my hacktivity feed using the HackerOne MCP?**
Yes, you can pull the latest entries from your hacktivity feed. This keeps you updated on new discoveries and researcher activity as they happen.

**How do I connect my HackerOne account to my AI client?**
You just need to subscribe to the Connector and provide your HackerOne API Token Identifier and Token Value. Once connected, your agent can access your organization's data.

**How do I generate my HackerOne API Token?**
Log in to HackerOne, navigate to **Settings > API Token**, and click 'Create API Token'. Make sure to copy both the **Identifier** and the **Token Value** immediately.

**Can I award bounties through this integration?**
Yes! Use the `award_bounty` tool by providing the report ID and the amount. You can also specify an optional bonus amount for the researcher.

**Does the integration support internal comments?**
Yes, the `add_report_comment` tool has an optional `internal` boolean parameter (defaults to true). This allows you to communicate with your team privately on a specific report.

**Can I filter reports by their handle or ID?**
You can use `list_reports` to see all reports or `get_report` with a specific ID to retrieve detailed information for a single discovery.