How to Use the HackerOne MCP in Cline

Q: Can Cline automate my HackerOne triage workflow?

Yes, Cline uses listreports to fetch new submissions and addreportcomment to reply to researchers. It can analyze the report, write a fix, and update the ticket status automatically.

Q: How do I configure the HackerOne MCP Server in Cline?

You can add the server configuration directly in your clinemcpsettings.json file. Cline will auto-discover the tools, giving the agent immediate access to your reports and assets via the MCP settings file.

Q: Can Cline issue bounty awards on HackerOne?

Yes, Cline uses the awardbounty tool to pay researchers directly from your VS Code sidebar. It can also run listpayments to check previous payout amounts for consistency.

Q: Can Cline fetch my program details?

Yes, Cline uses getprogram to fetch details about your active security programs. This allows the agent to understand your specific policy guidelines and target scopes.

Let Cline manage your HackerOne queue, verify scope, and write code fixes directly inside VS Code.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect HackerOne MCP to Cline

Create your Vinkius account to connect HackerOne to Cline and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup HackerOne with Cline

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Verify program scope and write fixes in Cline

The `list_assets` tool lets Cline verify if a submitted vulnerability is in scope before you write a single line of code. Connecting this MCP server to VS Code allows Cline to pull the defined assets, compare them to the report, and alert you if the researcher targeted an out-of-scope system. Once scope is verified, Cline writes the code fix in your workspace, creates a test file to verify the patch, and prepares the commit. No manual copying of vulnerability details required.

Manage report lifecycles inside the Cline interface

This MCP Server provides the `get_report` and `change_report_state` tools to let Cline update ticket progress directly from VS Code. Cline reads the raw markdown of the submission, checks the reproduction steps, and updates the status. You do not need to open a browser tab to close duplicates or accept valid bugs. Cline updates the state, allowing you to stay focused on your editor.

Track and issue HackerOne payments with Cline

The `list_payments` tool gives Cline the ability to view your program's financial history to check past reward trends. Cline checks what you paid for similar vulnerabilities in the past to ensure fair pricing. When you are ready to pay, Cline uses `award_bounty` to send the reward. It handles the entire transaction and logs the confirmation in the report comments.

Setup guide

Set up HackerOne MCP in Cline

Prerequisites

VS Code with Cline extension installed
Active Vinkius subscription with a valid endpoint token

1

Open Cline MCP settings

Click the Cline icon in the VS Code sidebar to open the Cline panel. Then click the MCP Servers icon (server stack) at the top-right corner of the panel.
2

Add a remote server

Click "Remote Servers" at the top, then click "Add Remote MCP". In the Name field, type hackerone-mcp. In the URL field, paste your Vinkius endpoint: https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp. Get your token from cloud.vinkius.com.
3

Enable the server

After saving, the server appears in the Cline MCP panel. Toggle the switch to enable it. The status indicator turns green when the connection is live.
4

Start using tools

Return to the Cline chat and ask: "Check my latest HackerOne refund status." Cline will discover the available tools and request your approval before invoking each one — giving you full control over every action.

Cline MCP Settings

{
  "mcpServers": {
    "hackerone-mcp": {
      "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    }
  }
}

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by HackerOne. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect HackerOne now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about HackerOne MCP in Cline

Yes, Cline uses `list_reports` to fetch new submissions and `add_report_comment` to reply to researchers. It can analyze the report, write a fix, and update the ticket status automatically.

You can add the server configuration directly in your `cline_mcp_settings.json` file. Cline will auto-discover the tools, giving the agent immediate access to your reports and assets via the MCP settings file.

Yes, Cline uses the `award_bounty` tool to pay researchers directly from your VS Code sidebar. It can also run `list_payments` to check previous payout amounts for consistency.

Yes, Cline uses `get_program` to fetch details about your active security programs. This allows the agent to understand your specific policy guidelines and target scopes.

Your vulnerability reports and program scopes are processed locally on your machine. The connection uses secure tokens, ensuring that sensitive security findings are never exposed to third-party endpoints.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript