How to Use the Bugcrowd MCP in OpenAI Agents SDK

Run your Bugcrowd vulnerability workflows directly inside OpenAI Agents SDK with strict guardrails and automated handoffs.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Bugcrowd MCP to OpenAI Agents SDK

Create your Vinkius account to connect Bugcrowd to OpenAI Agents SDK and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Bugcrowd with OpenAI Agents SDK

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Triaging Submissions with OpenAI Agents SDK

Your OpenAI agents can pull pending security reports using `list_submissions` and analyze the technical details instantly. Instead of bouncing between tabs, the agent reads the hacker's write-up, checks context with `get_submission`, and extracts the core vulnerability details. Because you are using this SDK, you can set up a safety gate before any submission changes are written back. The agent parses the payload, runs its analysis, and hands off to a human-in-the-loop agent to confirm before finalizing any state.

Mapping Attack Surfaces and Scopes

Let your agent map out active testing boundaries by querying `list_targets` and `get_target`. It matches incoming bug reports against your active program scopes to verify if the researcher found a bug on an in-scope asset. By feeding this scope data directly into your agent's context, you prevent it from hallucinating what is in-scope. It cross-references the targets via this MCP Server, giving your team accurate confirmation on whether a bug is valid or out-of-scope.

Automating Bounty Program Audits

Track the health of your crowdsourced security programs by letting your agent pull metrics with `list_programs` and `get_program`. The agent compiles real-time summaries of active engagements, payout trends, and researcher activity. This MCP Server allows you to run audits through the OpenAI dashboard to trace every single tool call. You see exactly when the agent called `list_engagements` or `get_engagement`, giving you a clear audit trail of your security operations.

Setup guide

Set up Bugcrowd MCP in OpenAI Agents SDK

Prerequisites

Python 3.10+ installed
openai-agents package (pip install openai-agents)
Active Vinkius subscription with a valid endpoint token

1

Install the SDK

Run pip install openai-agents to install the OpenAI Agents SDK. The MCP integration is built-in — no extra dependencies needed.
2

Connect via SSE transport

Use MCPServerSse with your Vinkius endpoint URL. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. The SDK auto-discovers all Bugcrowd tools at runtime.
3

Create your Agent

Pass the MCP to Agent(mcp_servers=[server]). The agent receives Bugcrowd tools as native definitions — JSON schemas resolve automatically.
4

Run the agent

Call Runner.run(agent, prompt) to execute. The agent invokes the appropriate Bugcrowd tools and returns structured results. Copy the full example on the right to get started.

agent.py

import asyncio
from agents import Agent, Runner
from agents.mcp import MCPServerSse

async def main():
    async with MCPServerSse(
        url="https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    ) as server:
        agent = Agent(
            name="Bugcrowd Agent",
            instructions="You have access to Bugcrowd tools.",
            mcp_servers=[server],
        )
        result = await Runner.run(agent, "List recent transactions")
        print(result.final_output)

asyncio.run(main())

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Bugcrowd. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Bugcrowd now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Bugcrowd MCP in OpenAI Agents SDK

Use the MCPServerStreamableHttp class to point to your Vinkius endpoint. Pass this server instance into the mcp_servers list when initializing your agent.

Yes. You configure the agent's system prompt or use the SDK's built-in guardrails to restrict execution of write tools like create_submission while allowing read-only tools.

Absolutely. The SDK handles async execution natively, allowing your agent to pull data from list_submissions and list_targets concurrently without blocking your main application loop.

The MCP Server manages the underlying API communication with Bugcrowd. If you hit a rate limit, the Vinkius hosting layer and the SDK handle the retries so your agent script doesn't crash mid-run.

All vulnerability descriptions and target details retrieved via get_submission remain within your secure OpenAI Agents SDK runtime context. This MCP Server runs inside an ephemeral, zero-trust sandbox, meaning your raw vulnerability data is never cached or stored on our servers.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript