How to Use the HackerOne MCP in LlamaIndex

Q: Will LlamaIndex hallucinate about HackerOne report states?

No. Because the agent pulls directly from the API using listreports or getreport, the information is grounded in live data rather than pre-trained weights.

Index your security program data into LlamaIndex for searchable knowledge grounded in live HackerOne reports.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect HackerOne MCP to LlamaIndex

Create your Vinkius account to connect HackerOne to LlamaIndex and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup HackerOne with LlamaIndex

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Searchable bug reports in LlamaIndex

The agent pulls report details with `get_report` and feeds them into your vector store. You query your own historical data to find patterns in past vulnerabilities. This turns raw API responses into a persistent knowledge base. You stop guessing about report context and start building answers on actual historical findings.

Analyze hacktivity feeds with LlamaIndex

You use `list_hacktivity` to ingest public bug bounty trends into your index. Your agent compares your program's performance against broader market data. It helps you spot shifts in researcher behavior early. You build RAG applications that combine live platform feed data with your private security documentation.

Manage program data using LlamaIndex

The agent retrieves program configurations using `get_program` and stores them for quick lookup. You query your index to see if a report matches a specific asset. This creates a unified view of your security posture. You don't just call tools; you build a semantic map of your entire bug bounty program.

Setup guide

Set up HackerOne MCP in LlamaIndex

Prerequisites

Python 3.10+ installed
llama-index-tools-mcp package
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run pip install llama-index-tools-mcp llama-index-llms-openai. The MCP tools package provides BasicMCPClient and McpToolSpec.
2

Connect with BasicMCPClient
Point BasicMCPClient to your Vinkius endpoint URL. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. Supports SSE and Streamable HTTP transports.
3

Convert to LlamaIndex tools
Call mcp_tool_spec.to_tool_list_async() to convert all HackerOne MCP tools into native FunctionTool objects that any LlamaIndex agent can use.
4

Run with any LLM
Create a FunctionAgent with the tools and your preferred LLM. Swap OpenAI for Anthropic, Gemini, or any LlamaIndex-supported provider.

agent.py

from llama_index.tools.mcp import BasicMCPClient, McpToolSpec
from llama_index.core.agent.workflow import FunctionAgent
from llama_index.llms.openai import OpenAI

# Connect to the MCP
mcp_client = BasicMCPClient(
    "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
)
mcp_tool_spec = McpToolSpec(client=mcp_client)

# Convert MCP tools to LlamaIndex tools
tools = await mcp_tool_spec.to_tool_list_async()

# Create and run the agent
agent = FunctionAgent(
    tools=tools,
    llm=OpenAI(model="gpt-4o"),
    system_prompt="You have access to HackerOne tools.",
)
response = await agent.run("List recent HackerOne data")

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by HackerOne. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect HackerOne now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about HackerOne MCP in LlamaIndex

The MCP tools fetch raw data from the API, which LlamaIndex then converts into vectors. This allows you to perform semantic search across your entire report history.

No. Because the agent pulls directly from the API using `list_reports` or `get_report`, the information is grounded in live data rather than pre-trained weights.

The server is ephemeral and does not persist your data. It acts as a bridge, passing information from the API to your local LlamaIndex instance.

Yes. You control tool access during client initialization. You can restrict the agent to read-only tools if you want to prevent accidental state changes.

It handles JSON report payloads, bounty payment records, and program metadata. These are transmitted over an encrypted connection and processed only within your local agent environment.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript