RootBounty has a Model Context Protocol server. Assistants that speak MCP — Claude, Claude Code, Cursor, VS Code and others — can use the platform as you: find programs, read their scope and rules, follow your reports and, if you allow it, send a report.
| Server URL | https://mcp.rootbounty.com/mcp |
| Transport | Streamable HTTP |
| Authentication | Authorization: Bearer rbp_… (a personal API key) |
In Settings → API keys, create a key for the assistant.
A key can never change your account, your security settings, your payout details or other keys. Revoke it there at any time.
Claude Code
claude mcp add --transport http rootbounty https://mcp.rootbounty.com/mcp --header "Authorization: Bearer rbp_…"
Cursor, VS Code and other clients with a JSON configuration
{
"mcpServers": {
"rootbounty": {
"url": "https://mcp.rootbounty.com/mcp",
"headers": { "Authorization": "Bearer rbp_…" }
}
}
}
Any client that supports remote MCP servers over HTTP with a custom header works the same way.
| Tool | What it does |
|---|---|
whoami |
The account behind the key |
search_programs |
Find bug bounty and disclosure programs |
get_program |
Description, guidelines, scope and rewards of one program |
list_hacktivity |
The public record of reports |
get_public_report |
A report both sides agreed to publish in full |
get_leaderboard |
Researchers ranked by reputation |
list_my_reports |
Your reports (researchers) or your inbox (companies) |
get_report |
One of your reports, with its timeline |
list_notifications |
What RootBounty told you recently |
list_my_payouts |
Bounties and their payment status |
list_my_invitations |
Private programs you were invited to |
submit_report |
Send a new report (researchers, key with Read + reports) |
Comments, triage, attachments, disclosure, payout details and everything about your account stay on the website, behind your password and second factor.
The same as the API: 5 requests per minute per account, counting every key, and the daily limit on new reports. An assistant that is told to slow down should wait a minute.