How to Use the HackerOne MCP in CrewAI

Q: Can CrewAI agents calculate and award HackerOne bounties autonomously?

Yes, a CrewAI agent can use awardbounty to issue payouts based on severity guidelines it fetches from your HackerOne program. However, you should set up a supervisor agent to review these decisions before the tool executes.

Q: Can I limit which tools a specific agent can access?

Yes, you can use the MCPServerHTTP class in CrewAI to restrict access, blocking a triage agent from calling the HackerOne awardbounty tool. This lets you enforce strict role-based access control across your security crew.

Deploy a collaborative crew of specialized CrewAI agents to research, triage, and comment on HackerOne bug reports.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect HackerOne MCP to CrewAI

Create your Vinkius account to connect HackerOne to CrewAI and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup HackerOne with CrewAI

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Multi-Agent HackerOne Triage Teams

The `list_reports` tool serves as the primary entry point for your CrewAI triage agent to scan for unassigned HackerOne vulnerabilities. This specialized CrewAI agent reads the incoming HackerOne queue and extracts key technical details for the rest of the crew.

Autonomous Program and Asset Monitoring

The `list_assets` tool allows a scout CrewAI agent to map out the active scope defined across your HackerOne programs. Your CrewAI team uses this scope data to verify if a submitted HackerOne vulnerability targets a critical production system.

Multi-Agent Hacker Communication via MCP Server

The `add_report_comment` tool enables a customer-success CrewAI agent to post updates directly to the researcher's thread on HackerOne. This CrewAI agent translates technical findings from your engineering crew into clear, polite updates for the external HackerOne reporter.

Setup guide

Set up HackerOne MCP in CrewAI

Prerequisites

Python 3.10+ installed
crewai package (pip install crewai)
Active Vinkius subscription with a valid endpoint token

1

Install CrewAI
Run pip install crewai to install the framework. MCP support is built-in via the mcps parameter.
2

Add the MCP URL to your agent
Pass your Vinkius endpoint directly to the mcps list. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. CrewAI handles tool discovery and caching automatically.
3

Kick off your crew
Create a Crew with your agent and tasks. Call crew.kickoff() — the agent will automatically invoke HackerOne tools as needed.

crew.py

from crewai import Agent, Task, Crew

agent = Agent(
    role="HackerOne Analyst",
    goal="Access and analyze HackerOne data via MCP.",
    backstory="Expert analyst with direct HackerOne access.",
    mcps=[
        "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    ],
)

task = Task(
    description="List recent HackerOne transactions",
    agent=agent,
    expected_output="A summary of recent activity",
)

crew = Crew(agents=[agent], tasks=[task])
result = crew.kickoff()
print(result)

Get your connection token →

Prerequisites

Python 3.10+ installed
crewai + crewai-tools packages
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run pip install crewai crewai-tools. The MCPServerAdapter handles lifecycle management and tool conversion.
2

Connect with MCPServerAdapter
Use MCPServerAdapter as a context manager with SseServerParameters pointing to your Vinkius endpoint. The adapter automatically manages connection lifecycle.
3

Assign tools and run
Pass the returned mcp_tools to your agent's tools parameter. The adapter converts MCP tools to native BaseTool objects compatible with all CrewAI agents.

crew.py

from crewai import Agent, Task, Crew
from crewai_tools import MCPServerAdapter
from mcp import SseServerParameters

server_params = SseServerParameters(
    url="https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
)

with MCPServerAdapter(server_params) as mcp_tools:
    agent = Agent(
        role="HackerOne Analyst",
        goal="Access and analyze HackerOne data via MCP.",
        backstory="Expert analyst with direct HackerOne access.",
        tools=mcp_tools,
    )

    task = Task(
        description="List recent HackerOne transactions",
        agent=agent,
        expected_output="A summary of recent activity",
    )

    crew = Crew(agents=[agent], tasks=[task])
    result = crew.kickoff()
    print(result)

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by HackerOne. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect HackerOne now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about HackerOne MCP in CrewAI

You pass the Vinkius HTTP endpoint directly into the CrewAI agent's `mcps` parameter to register all HackerOne tools. The MCP server automatically exposes these endpoints as executable actions for your crew.

Yes, a CrewAI agent can use `award_bounty` to issue payouts based on severity guidelines it fetches from your HackerOne program. However, you should set up a supervisor agent to review these decisions before the tool executes.

The CrewAI framework uses shared memory to ensure agents do not run `change_report_state` and `add_report_comment` on HackerOne out of order. Each agent waits for the previous task to complete before taking action.

Yes, you can use the `MCPServerHTTP` class in CrewAI to restrict access, blocking a triage agent from calling the HackerOne `award_bounty` tool. This lets you enforce strict role-based access control across your security crew.

Your HackerOne vulnerability report payloads are processed in an ephemeral, zero-trust V8 sandbox managed by Vinkius, keeping CrewAI operations isolated. The MCP architecture ensures your credentials and report details are never cached or used to train public models.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript