Loading ToolBench
AI-powered bug bounty hunting toolkit — MCP server for Claude Code
Server has 10 tools with complete naming (verb_noun pattern) and descriptions. All tools have input schemas with typed parameters and descriptions. However, output schemas are not documented, LLMs cannot predict return structure. Error handling is minimal; no recovery guidance or actionable error messages. Parameter descriptions lack constraints (enums, ranges, formats). Security concerns: hunt_submit and make_report are destructive but lack dry-run/confirmation patterns. No tool annotations (readOnlyHint/destructiveHint). Composition is sound, tools are single-purpose and chainable.
Search NVD + GitHub advisories for known vulnerabilities in one call.
Search huntr.com for bounty programs.
Check existing vulnerability reports for a repo + duplicate detection.
Fill huntr.com submission form via Chrome CDP.
Generate a vulnerability report + CVSS score for a bounty platform.
Extract HTTP routes + auth status from a codebase. Auto-clones the repo. Returns local_path so you can Read/Grep files directly. By default only returns interesting routes (unprotected, admin, debug, upload endpoints).
Output schemas not documented. LLMs cannot predict return structure or plan downstream tool calls. hunt_programs, hunt_reports, map_routes, map_surface, test_endpoint, test_ssrf, check_vulns, note, make_report all lack documented return types.
Destructive tools (hunt_submit, make_report) lack dry-run or confirmation patterns. Agents can accidentally submit reports or fill forms without validation. hunt_submit has dry_run parameter but make_report does not.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). LLMs cannot distinguish safe tools from destructive ones without explicit hints. hunt_submit and make_report should be marked destructive.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 58 | 2026-07-28+ | v2 |
Attack surface summary: framework, auth, validation, sinks, dep CVEs, prior notes. Auto-clones the repo. Returns local_path for direct file access. One call replaces 10+ Read/Grep calls for initial recon.
Save/retrieve investigation notes per target. Persists across sessions.
Run HTTP security checks against a live endpoint. Passive mode (default): HEAD/OPTIONS only, safe. Active mode: probes auth bypass, methods.
Start an SSRF callback catcher via interactsh. Returns a unique URL to inject. Polls for out-of-band interactions for timeout_seconds, then returns results.
Parameter descriptions lack formal constraints. sort_by in hunt_programs lists values as prose ('saturation_asc, bounty_desc, reports_asc, recent') instead of enum. checks in test_endpoint lists options as prose. LLMs may hallucinate invalid values.
Error handling is minimal. No recovery guidance, no actionable error messages. If hunt_submit fails, LLM has no guidance on what to do next. No error classification (retryable vs fatal).