HackerOne MCP Server for Mastra AI 10 tools — connect in under 2 minutes
Mastra AI is a TypeScript-native agent framework built for modern web stacks. Connect HackerOne through Vinkius and Mastra agents discover all tools automatically. type-safe, streaming-ready, and deployable anywhere Node.js runs.
ASK AI ABOUT THIS MCP SERVER
Vinkius supports streamable HTTP and SSE.
import { Agent } from "@mastra/core/agent";
import { createMCPClient } from "@mastra/mcp";
import { openai } from "@ai-sdk/openai";
async function main() {
// Your Vinkius token. get it at cloud.vinkius.com
const mcpClient = await createMCPClient({
servers: {
"hackerone": {
url: "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp",
},
},
});
const tools = await mcpClient.getTools();
const agent = new Agent({
name: "HackerOne Agent",
instructions:
"You help users interact with HackerOne " +
"using 10 tools.",
model: openai("gpt-4o"),
tools,
});
const result = await agent.generate(
"What can I do with HackerOne?"
);
console.log(result.text);
}
main();
* Every MCP server runs on Vinkius-managed infrastructure inside AWS - a purpose-built runtime with per-request V8 isolates, Ed25519 signed audit chains, and sub-40ms cold starts optimized for native MCP execution. See our infrastructure
About HackerOne MCP Server
Connect your HackerOne organization account to any AI agent and take full control of your vulnerability management workflows through natural conversation.
Mastra's agent abstraction provides a clean separation between LLM logic and HackerOne tool infrastructure. Connect 10 tools through Vinkius and use Mastra's built-in workflow engine to chain tool calls with conditional logic, retries, and parallel execution. deployable to any Node.js host in one command.
What you can do
- Report Oversight — List all vulnerability reports, retrieve detailed information, and monitor their current state and severity.
- Program Insights — Browse your bug bounty or VDP programs and access structured scopes and assets.
- Report Interaction — Add comments to reports, change their triaged state, or award bounties directly from the chat.
- Asset Tracking — Monitor the assets defined within your security programs and their reachability.
- Financial Monitoring — Retrieve history of bounty payments and manage rewards efficiently.
- Hacktivity Feed — Stay updated with the internal or public hacktivity feed to see recent discoveries.
The HackerOne MCP Server exposes 10 tools through the Vinkius. Connect it to Mastra AI in under two minutes — no API keys to rotate, no infrastructure to provision, no vendor lock-in. Your configuration, your data, your control.
How to Connect HackerOne to Mastra AI via MCP
Follow these steps to integrate the HackerOne MCP Server with Mastra AI.
Install dependencies
Run npm install @mastra/core @mastra/mcp @ai-sdk/openai
Replace the token
Replace [YOUR_TOKEN_HERE] with your Vinkius token
Run the agent
Save to agent.ts and run with npx tsx agent.ts
Explore tools
Mastra discovers 10 tools from HackerOne via MCP
Why Use Mastra AI with the HackerOne MCP Server
Mastra AI provides unique advantages when paired with HackerOne through the Model Context Protocol.
Mastra's agent abstraction provides a clean separation between LLM logic and tool infrastructure. add HackerOne without touching business code
Built-in workflow engine chains MCP tool calls with conditional logic, retries, and parallel execution for complex automation
TypeScript-native: full type inference for every HackerOne tool response with IDE autocomplete and compile-time checks
One-command deployment to any Node.js host. Vercel, Railway, Fly.io, or your own infrastructure
HackerOne + Mastra AI Use Cases
Practical scenarios where Mastra AI combined with the HackerOne MCP Server delivers measurable value.
Automated workflows: build multi-step agents that query HackerOne, process results, and trigger downstream actions in a typed pipeline
SaaS integrations: embed HackerOne as a first-class tool in your product's AI features with Mastra's clean agent API
Background jobs: schedule Mastra agents to query HackerOne on a cron and store results in your database automatically
Multi-agent systems: create specialist agents that collaborate using HackerOne tools alongside other MCP servers
HackerOne MCP Tools for Mastra AI (10)
These 10 tools become available when you connect HackerOne to Mastra AI via MCP:
add_report_comment
Add a comment to a specific vulnerability report
award_bounty
Award a bounty for a vulnerability report
change_report_state
Update the state of a vulnerability report (e.g., triaged, resolved)
get_program
Get details for a specific security program
get_report
Get detailed information about a specific vulnerability report
list_assets
List assets defined in your security programs
list_hacktivity
List the HackerOne hacktivity feed
list_payments
List bounty payments history
list_programs
List bug bounty or VDP programs you have access to
list_reports
List vulnerability reports submitted to your HackerOne program
Example Prompts for HackerOne in Mastra AI
Ready-to-use prompts you can give your Mastra AI agent to start working with HackerOne immediately.
"List all vulnerability reports submitted this week."
"Award a $500 bounty to report ID 12345."
"Change the state of report 12345 to 'Triaged'."
Troubleshooting HackerOne MCP Server with Mastra AI
Common issues when connecting HackerOne to Mastra AI through the Vinkius, and how to resolve them.
createMCPClient not exported
npm install @mastra/mcpHackerOne + Mastra AI FAQ
Common questions about integrating HackerOne MCP Server with Mastra AI.
How does Mastra AI connect to MCP servers?
MCPClient with the server URL and pass it to your agent. Mastra discovers all tools and makes them available with full TypeScript types.Can Mastra agents use tools from multiple servers?
Does Mastra support workflow orchestration?
Connect HackerOne with your favorite client
Step-by-step setup guides for every MCP-compatible client and framework:
Anthropic's native desktop app for Claude with built-in MCP support.
AI-first code editor with integrated LLM-powered coding assistance.
GitHub Copilot in VS Code with Agent mode and MCP support.
Purpose-built IDE for agentic AI coding workflows.
Autonomous AI coding agent that runs inside VS Code.
Anthropic's agentic CLI for terminal-first development.
Python SDK for building production-grade OpenAI agent workflows.
Google's framework for building production AI agents.
Type-safe agent development for Python with first-class MCP support.
TypeScript toolkit for building AI-powered web applications.
TypeScript-native agent framework for modern web stacks.
Python framework for orchestrating collaborative AI agent crews.
Leading Python framework for composable LLM applications.
Data-aware AI agent framework for structured and unstructured sources.
Microsoft's framework for multi-agent collaborative conversations.
Connect HackerOne to Mastra AI
Get your token, paste the configuration, and start using 10 tools in under 2 minutes. No API key management needed.