An astronaut overseeing a futuristic data hub
Download PDFMarkdown Version

Connect HackerOne to ChatGPT, Claude and Gemini

Set it up once and it works in ChatGPT, Claude, Cursor, and any other client you love. It all runs safely in the background, so you can relax and focus on what really matters. Run your entire bug bounty program from a chat interface.

Ask AI about this Connector

Developed, maintained, and hosted by Vinkius.

MCP VERIFIED · PRODUCTION READY · VINKIUS GUARANTEED

Waiting for input…

Works with modern AI clients that support MCP, including ChatGPT, Claude, Cursor, and more.

ChatGPTClaudeCursorPerplexityGeminiMicrosoft CopilotRaycastMeta AI

Your AI does the work. We keep it safe and sound.

No other AI tool gives you this. Your workflow runs in the client you already love, your account stays protected, and you decide what the agent can and cannot do. It is the whole reason to make the switch.

Each Connector lives inside our infrastructure, the same place where your workflow runs. The three things below are already part of it, working quietly in the background so you never have to think about them. Nothing to add, nothing to set up, nothing to worry about.

A futuristic MCP client docking bay
V8 Isolate01

Each Connector runs inside its own sealed environment.

Each Connector runs inside its own sealed V8 runtime — no access to your files, your system, or other servers. A Connector never sees past its own request.

Kill Switch02

One switch stops every agent. Instantly.

One action deactivates every Connector, revokes every token, and ends every session at once. AI Governance keeps the record.

FinOps per User03

Spending limits that pause instead of surprise.

Every user keeps their own connections and credentials, isolated from everyone else. Anything that would cross your spending limit is held for your approval, not billed.

Three controls, built into the layer your AI connects through.

Curated set · 10 capabilities

We ship only the actions that matter.

Capability set01 / 03

01-04

4 capabilities in this set.

Part of 10 available through HackerOne.

  1. 01

    List payments

    Access your bounty payment history. Use this to audit past rewards or check recent payouts.

  2. 02

    List programs

    Retrieve a list of all bug bounty or VDP programs you have access to. This helps your agent identify which program a report belongs to.

  3. 03

    Award bounty

    Issue a bounty for a specific vulnerability report. This capability handles the reward process directly from your chat.

  4. 04

    Change report state

    Update the status of a vulnerability report. You can move reports to states like triaged or resolved.

Capability set02 / 03

05-07

3 capabilities in this set.

Part of 10 available through HackerOne.

  1. 05

    Get program

    Fetch detailed information about a specific security program. Use this to check scopes and program rules.

  2. 06

    Get report

    Pull full details for a single vulnerability report. This provides the context needed for deep triage.

  3. 07

    List assets

    View the assets defined within your security programs. This is useful for verifying if a report falls within scope.

Capability set03 / 03

08-10

3 capabilities in this set.

Part of 10 available through HackerOne.

  1. 08

    Add report comment

    Post a comment to a vulnerability report. Use this to communicate with researchers or leave internal notes.

  2. 09

    List hacktivity

    Get the latest updates from the HackerOne hacktivity feed. This keeps you informed on recent discoveries.

  3. 10

    List reports

    Retrieve all vulnerability reports submitted to your HackerOne programs. This is the starting point for triage workflows.

Real work

What teams actually run

01

Rapid Triage

A security engineer asks the agent for all high-severity reports to prioritize investigation.

02

Automated Rewards

A manager instructs the agent to award a bounty once a report is validated.

03

Scope Verification

An engineer checks the list of program assets to see if a new report is in scope.

04

Status Updates

A team member updates a report from 'New' to 'Triaged' without opening a browser.

Automate a task

Put HackerOne to work on one thing.

Step-by-step automations your AI runs through this Connector: the workflow, the prompts to start with, and the exact capabilities behind each move.

One connector, every AI

HackerOne works with the most popular AI clients.

These are the most popular clients, each with a step-by-step guide: one link, set up once, with governance and visibility built in. And because everything runs on the MCP standard, the same connection also works in any other compatible client — nothing to rebuild.

ClaudeClaudeChatGPTChatGPTGeminiGeminiPerplexityPerplexityGrokGrokMicrosoft CopilotMicrosoft CopilotCursorCursorVS CodeVS CodeWindsurfWindsurfJetBrainsJetBrainsClineClineLangChainLangChainVercel AI SDKVercel AI SDKLovableLovableZ.aiZ.aiRaycastRaycastQwen CodeQwen CodeKimi CodeKimi CodeLe ChatLe Chat

Building your own app? The connector is yours to use.

You don't need a client to put HackerOne to work: the same hosted connection plugs into your own applications and agent code, with the same governance on every request. Build with it, chat with it — one connection for both.

Observed, not estimated

892ms average. Fast in production.

HackerOne is checked daily against the live service.

Daily averagePeak 1088ms
Oct 3Today
Fastest day
710ms
Slowest day
1088ms
14-day trend
Slowing+23%

Connect your client

One URL. Every client.

Activate the Connector, copy your link, and paste it into the client you already use. 10 capabilities arrive ready to run.

Preview access · not provider authentication

The vk_preview_* token belongs to Vinkius preview infrastructure. It lets Claude discover and display the capabilities of HackerOne, so you can see the experience inside your AI.

It does not authenticate your account with HackerOne. Actions requiring credentials or live account data may not run until you activate the Connector and authorize the service.

HackerOne Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_MdngwsTWgI8aN2tcglppukreOCXiR4XOops4TQFJ/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — HackerOne capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "hackerone-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_MdngwsTWgI8aN2tcglppukreOCXiR4XOops4TQFJ/mcp"
    }
  }
}
  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Step-by-step instructions for each client are in the guide. How to connect

Guided setup for Claude? Set up HackerOne in Claude and other AIs

See all the AI clients this connector works with ↑

Who it's for

Built for the work HackerOne owners hand off.

This MCP is built for security teams managing external researcher programs.

  • 01

    Security Engineers

    They use the agent to quickly pull report details and severity ratings during triage.

  • 02

    Bug Bounty Managers

    They hand off the repetitive tasks of awarding bounties and messaging researchers to the agent.

  • 03

    CISOs

    They use the agent to get a high-level view of program health and incoming vulnerabilities.

FAQ

Questions HackerOne owners ask.

  • 01

    How do I connect my HackerOne account?

    You need to provide your HackerOne API Token Identifier and Token Value during the setup process on Vinkius.

  • 02

    Which AI clients can I use with this MCP?

    You can use any MCP-compatible client, including Claude, Cursor, and Windsurf.

  • 03

    Can I actually pay researchers through the AI?

    Yes, you can use the award_bounty capability to issue rewards for vulnerability reports directly through your agent.

  • 04

    Does this MCP work with VDP programs?

    Yes, the MCP can list and manage both bug bounty and Vulnerability Disclosure Programs (VDP).

  • 05

    Is my HackerOne data secure?

    Vinkius hosts the MCP and manages the credentials securely, allowing your agent to interact with the API without exposing your raw tokens to the model.

  • 06

    How do I generate my HackerOne API Token?

    Log in to HackerOne, navigate to Settings > API Token, and click 'Create API Token'. Make sure to copy both the Identifier and the Token Value immediately.

  • 07

    Can I award bounties through this integration?

    Yes! Use the award_bounty capability by providing the report ID and the amount. You can also specify an optional bonus amount for the researcher.

  • 08

    Does the integration support internal comments?

    Yes, the add_report_comment capability has an optional internal boolean parameter (defaults to true). This allows you to communicate with your team privately on a specific report.

  • 09

    Can I filter reports by their handle or ID?

    You can use list_reports to see all reports or get_report with a specific ID to retrieve detailed information for a single discovery.

Explore

More in Fort Knox

Suggestions

Connect HackerOne to Claude, Cursor, ChatGPT & more