Vinkius

HackerOne MCP. Triage Reports, Manage Bounties, Track Payments.

HackerOne connects your security team directly to bug bounty program operations. Use this MCP to manage vulnerabilities, track assets, and handle payments without leaving your chat window. You can list reports, change their status, add comments, award bounties, and view payment history—all through natural conversation.

HackerOne MCP is compatible with Claude Claude
HackerOne MCP is compatible with ChatGPT ChatGPT
HackerOne MCP is compatible with Cursor Cursor
HackerOne MCP is compatible with Gemini Gemini
HackerOne MCP is compatible with Windsurf Windsurf
HackerOne MCP is compatible with VS Code VS Code
HackerOne MCP is compatible with JetBrains JetBrains
HackerOne MCP is compatible with Vercel Vercel
See Vinkius in Action

Give Claude and any AI agent real-world access

Reviewing vulnerability reports

Retrieve lists of submitted bug bounty reports or pull detailed information about a specific finding.

Managing program assets

List and monitor the defined assets within your security programs to understand scope reachability.

Updating report status and communication

Change a report's official state (like triaged) or add internal comments to communicate with researchers.

Handling payments and bounties

Access the history of bounty payments and award rewards directly for specific vulnerability reports.

Monitoring program scope

List all available bug bounty or VDP programs you have access to, along with their structured assets.

Waiting for input…

AI Agent
HackerOne

What AI agents can do with HackerOne: 10 Tools for Security Ops

These tools give you granular control over every aspect of bug bounty management—from listing reports to awarding bounties and checking asset scope.

Make your AI actually useful.

Add this MCP to Claude, Cursor, or Windsurf and your AI stops guessing. It gets real tools to look things up, take action, and handle the stuff you keep doing by hand.

Start using HackerOne MCP

Add Report Comment

Allows you to add a specific comment directly to any vulnerability report.

Award Bounty

Processes and awards a bounty payment for a designated vulnerability report.

Change Report State

Updates the official state of a vulnerability report, such as marking it triaged or...

Get Program

Retrieves detailed information about a specific security program you manage.

Get Report

Pulls comprehensive details for one particular vulnerability report ID.

List Assets

Generates a list of assets defined in your security programs, helping map out coverage.

List Hacktivity

Pulls the recent internal or public hacktivity feed to see what's been discovered lately.

List Payments

Retrieves a history of all bounty payments made through HackerOne.

List Programs

Shows you a list of bug bounty or VDP programs that are available to your account.

List Reports

Lists all vulnerability reports submitted within the scope of your current HackerOne...

Security and governance baked right in.

Pick your AI client below to get set up. Just create a Vinkius account, subscribe, and you're instantly up and running. We handle the entire backend infrastructure, delivering out-of-the-box support for HTTPS Streamable, SSE, and OAuth2—zero messy routing required.

HackerOne MCP is compatible with Claude

Claude AI

1

Open Claude Settings

Go to claude.ai, click your profile icon, then navigate to Customize → Connectors.

2

Add Custom Connector

Click the "+" button and select Add custom connector. Paste your Vinkius endpoint URL:

https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp

Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. For OAuth-protected servers, expand Advanced settings to add credentials.

3

Start a conversation

Open a new chat. The HackerOne integration is available immediately — no restart needed.

Choose How to Get Started

Build a custom MCP for your own tools, or connect a ready-made integration from our catalog.

Build Your Own

Turn any API into an MCP. Import a spec, define Agent Skills, or deploy with MCPFusion.

  • Import from OpenAPI, Swagger, or YAML specs
  • Create Agent Skills with progressive disclosure
  • Deploy to edge with MCPFusion framework
  • Built in DLP, auth, and compliance on each call
  • Real time usage dashboard and cost metering
  • Publish to catalog or keep private
Start building

Make Your AI Do More

Start with HackerOne, then connect any of our 5,200+ other servers whenever your AI needs more. One click, no limits.

  • Use this MCP plus 5,200+ others, all in one place
  • Add new capabilities to your AI anytime you want
  • Connections are secured and governed automatically
  • Track usage and costs across all your servers
  • Works with Claude, ChatGPT, Cursor, and more
  • New servers added to the catalog weekly
HackerOne MCP server cover

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by HackerOne. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

VINKIUS CLOUD

Cloud Hosted

Managed infra

V8 Isolated

Sandboxed per request

Zero-Trust Proxy

No stored credentials

DLP Enforced

Policy on each call

GDPR Compliant

EU data residency

Token Compression

~60% cost reduction

Your data is protected. See how we built it.

The pain of managing security reports across five tabs

Right now, triaging a report feels like juggling. You start on the main dashboard to list submissions, then click into a specific vulnerability to read details, and if you need to update its status, you have to switch to another tab. To communicate with the researcher or your internal team, you copy-paste notes into a separate chat tool. It's slow, error-prone, and takes you out of flow.

With this MCP, all those steps happen in one place. You tell your agent what needs doing—for example, 'Check report 12345 for details and change its state to resolved.' The agent handles the data retrieval and the status update without you ever leaving the conversation window.

HackerOne MCP: Direct Bounties and Triage Status

You don't have to manually award bounties or track payments. You just ask your agent to `award_bounty` for the specific report ID, and it processes the payment record instantly. Need to communicate a status change? Use `change_report_state`—it updates the system and logs an internal note automatically.

What's different now is that you move from being a data copy-paster to a decision-maker. Your agent manages the tedious mechanical steps, letting you focus on what matters: fixing the vulnerability.

What HackerOne MCP does for your AI

This MCP lets you run your vulnerability management workflows inside any AI client. You connect your organization account to get full control over bug bounty programs. Forget switching between report tabs and internal dashboards just to triage a finding. Your agent acts like a dedicated Security Program Manager, handling the day-to-day operations in real time.

You can list all submitted vulnerability reports or retrieve deep details on a specific one. Need to update something? You can change a report's state—marking it as triaged or resolved—and even award bounties directly from the chat. The system also lets you interact with asset definitions, check internal hacktivity feeds for recent discoveries, and monitor payment history.

By connecting through Vinkius, this MCP gives your agent immediate access to all necessary program insights, making communication and workflow management simple.

Built · Hosted · Managed by Vinkius HackerOne MCP - Manage Bug Bounty Reports & Programs
Server ID 019d75ad-997e-719f-9dd9-04d7c22199cf
Vinkius Inspector
Compliance Grade A+
Score 100/100
Vinkius Inspector Badge — Score 100/100

Frequently asked questions about HackerOne MCP

How can I list all my open bug bounty reports using HackerOne MCP? +

You use the list_reports tool. This function pulls a comprehensive list of every submission tied to your active program, giving you an immediate overview of what needs attention.

Does HackerOne MCP let me change a report status? +

Yes, you can use change_report_state. This tool updates the official status of a vulnerability report (like 'Triaged' or 'Resolved') and logs it for compliance records.

How do I check past payments with HackerOne MCP? +

To review payouts, use list_payments. This function retrieves the entire history of bounty rewards associated with your program, helping you audit expenses quickly.

Can I add a comment to a report using this MCP? +

Yes, that's what add_report_comment is for. You can communicate notes or internal findings directly into the record without needing to open the external platform.

What information does HackerOne MCP provide about programs? +

You can use list_programs to see all available programs and get_program for deep details on a specific program's rules, scope, and assets.