Open Source · Claude Code Plugin · Free

AI that hunts bugs.
Writes the report.
You collect.

Open-source Claude Code plugin. Recon, twenty vuln classes, CVSS scoring, and a submission-ready report for HackerOne, Bugcrowd, Intigriti, and Immunefi. Runs in your terminal.

Get on GitHub → See how it works
Agentic Bug Hunter - Open source AI bug bounty toolkit free or subscription based | Product Hunt
2k+ stars · 360+ forks · MIT licensed
bughunter ~ live
cvss scored. ready to submit.
vuln-2026-pkce HIGH · 8.2
PKCE Bypass in OAuth Callback
███ ████████ ████ ███ █████████ ████ ████ ████ ████ ██ ███████ ███████ ████ ██████ █████ ████████ ██████ ████ ██ ████ █████ ██████ ███ ████████ █████ ████ ██████ ██
H1 · BUGCROWD · INTIGRITI · IMMUNEFI
01_HOW_IT_WORKS

Three steps. One command. A report.

No dashboards. No signup. No SaaS bill. You run it inside Claude Code, point it at a target, and walk away.

Step 01 — Install
One command inside Claude Code

Clone the repo, run the installer, you are ready. No SaaS signup. No keys to share.

git clone https://github.com/Awarexone/Agentic-Bug-Hunter && cd Agentic-Bug-Hunter && ./install.sh
Step 02 — Point
Drop in a domain or program

Hand it a target. The tool pulls in-scope assets from HackerOne, Bugcrowd, Intigriti, YWH, and Immunefi.

hunt example.com
Step 03 — Collect
Get a submission-ready report

Recon, scan, validate, write. CVSS scored. H1, Bugcrowd, Intigriti, or Immunefi format.

✓ report.md ready

That is the entire workflow.

01B_JUST_PASTE_THIS

No slash commands required. Just ask Claude.

Open claude in your terminal and paste any of these. The first one installs the toolkit. The rest are the hunt loop in plain English — Claude picks the right tools, agents, and gates.

Don't have it yet? Paste the install prompt first. Claude will clone the repo, run the installers, surface any missing dependencies, and confirm when you're ready to hunt.

$ claude
01 Install — Claude clones, installs, verifies, reports any failures
Help me install the Claude Bug Bounty toolkit from https://github.com/Awarexone/Agentic-Bug-Hunter into ~/tools/. Steps: 1. git clone the repo into ~/tools/Agentic-Bug-Hunter 2. cd into it and run ./install_tools.sh (scanners: subfinder, httpx, nuclei, gau, katana, ffuf, dnsx, nmap) 3. then run ./install.sh (registers the AI skills + 23 slash commands into ~/.claude/) 4. verify by listing the new commands (/recon, /hunt, /validate, /report, /autopilot) and confirming the bug-bounty + web2-recon + report-writing skills are available 5. if anything fails (Go missing, Python pkg, brew formula), tell me exactly which tool broke and the one-line fix — don't silently skip it I'm on macOS / Linux. Use brew or apt as needed. Don't sudo unless I approve.
02 Recon — subdomains, live hosts, URLs, tech, nuclei sweep
Run recon on target.com — subdomain enum, live host probing, URL crawling, tech fingerprinting, and a focused nuclei sweep. Save everything under recon/target.com/. Skip any external tool that isn't installed and tell me what to install to close the gap.
03 Hunt — prioritized vuln testing, with safety pauses
Hunt target.com using the recon data already in recon/target.com/. Prioritize the high-value classes first: IDOR/BOLA, auth bypass, SSRF, mass assignment, OAuth/OIDC, business logic. Skip anything informational. Pause before any active POST/PUT/DELETE so I can approve.
04 Validate — 7-Question Gate + 4 validation gates before you submit
I think I found a [VULN_CLASS] on [ENDPOINT/PARAM]. Walk it through the 7-Question Gate and the 4 validation gates from skills/triage-validation/. If it can't clearly pass all 7, kill it — I'd rather drop a maybe than tank my N/A ratio on the platform.
05 Report — impact-first writeup for H1 / Bugcrowd / Intigriti / Immunefi
Write a submission-ready report for the finding I just validated. Platform: [HackerOne / Bugcrowd / Intigriti / Immunefi]. Use the impact-first template: title formula, one-line impact statement, exact repro steps, request/response PoC, CVSS 3.1 vector + score, suggested fix. Human tone — no AI-slop hedging like "could potentially".
06 Autopilot — full loop end-to-end, pauses at every gate
Run autopilot on target.com in --normal mode. Take it end-to-end: scope check → recon → attack-surface ranking → hunt → validate → report. Pause at each gate so I can sanity-check before you spend more credits. Log everything to hunt-memory so I can resume later.
07 Smart Contract — 10 DeFi bug classes + Foundry PoCs
Audit the Solidity contract at [path/to/Contract.sol]. Walk all 10 DeFi bug classes from skills/web3-audit: reentrancy, oracle manipulation, access control, accounting desync, flash loan, signature replay, ERC4626 share inflation, off-by-one, incomplete code paths, proxy/upgrade. For any finding, drop a Foundry PoC using the template in that skill.
08 Token / Meme-Coin — rug-pull signal scan, EVM + Solana
Scan this token for rug-pull signals: [CHAIN] [contract-address]. Check mint authority, freeze authority, LP lock status, transfer-tax manipulation, honeypot patterns, bonding-curve exploits, and proxy/admin keys. Tell me straight: ape, watch, or avoid.
09 Scope check — verify before you send a single request
Is [asset.example.com] in scope for the [program-name] bug bounty program on [HackerOne / Bugcrowd / Intigriti / Immunefi]? Pull the live policy, check in-scope / out-of-scope lists, flag any caveats (no automated scanners, no DoS, prod-only, etc.) before I send a single request.

Replace the brackets. Hit enter. Hunt.

02_YOUR_FIRST_BUG

First finding in ten minutes.

From a clean Claude Code install to a report sitting in your H1 inbox.

00:00
Install
Claude Code + plugin command
02:00
Pick target
From your H1 or Bugcrowd dashboard
03:00
Run hunt
Walk away. Come back to a report.
10:00
Submit
Review the report, paste, submit.

Most of that time is the tool running.
Your hands-on time is under three minutes.

03_CAPABILITIES

What it actually does.

Eight technical capabilities. No fluff. Every line is a feature that ships today.

Recon pipeline

Subdomain enum, DNS resolution, live host detection, URL crawling. Pulls in-scope assets via bbscope.

Twenty vuln classes

IDOR, SSRF, XSS, SQLi, RCE, OAuth, race conditions, GraphQL, SAML/SSO, CI/CD, and 10 more.

Auth-aware hunting

Set session once with --cookie, --bearer, or env vars. Every downstream tool carries it.

CVSS 4.0 scoring

Built-in calculator. H1 uses 3.1, every other platform uses 4.0. Enforced automatically.

Submission-ready reports

Templates for H1, Bugcrowd, Intigriti, Immunefi. Burp Suite style HTML also supported.

Hunt memory

Persistent across sessions. Remembers every endpoint tested, feeds it back on the next run.

Validation gates

7-question gate + 4 validation gates. Auto-kills informational findings before submission.

MCP integrations

Burp MCP for live browser traffic. HackerOne MCP for program intel. Missing tools are skipped, not errors.

04_FAQ

Questions, answered.

Is it really free?

The open-source plugin on GitHub is free and will stay free. You only pay for your own Claude Code usage, which is the standard Anthropic API cost. No subscription, no signup, no credit card on this site.

What does it cost to run a hunt?

Depends on target size and scan depth. A typical small-to-medium target hunt sits in the low single-digit dollars of Claude API usage. Bigger enterprise scopes go higher. You control the budget by scoping the target.

Does it work with my existing Burp setup?

Yes. There is a Burp MCP integration. The tool reads your live browser traffic and uses it for auth-aware testing.

Will this get me banned from a program?

The tool respects scope and rate limits. Validation gates kill informational findings before submission. You are still responsible for staying inside program rules. Always read the program scope before running.

Does it submit reports automatically?

No. It writes the report and saves it locally. You review and submit yourself. That is by design.

Can I contribute?

Yes. The repo is MIT-licensed. PRs welcome. Roadmap, open issues, and contributor guide are all on GitHub.

What about the $BUG token?

The open-source tool is free regardless of the token. The token is for the hosted version of the autonomous agent that ships next. See the roadmap below.

05_ROADMAP_AND_TOKEN

Where this is going.

No dates. No quarters. Just direction.

What's next

Now · Live
  • Open-source Claude Code plugin
  • Manual hunt via hunt <target> command
  • Twenty vuln classes, four platform report formats
  • Persistent hunt memory across sessions
Later
  • Hosted version with team workspaces
  • Token-gated premium runs for high-volume hunters
  • Webhook delivery to H1 and Bugcrowd workflow

About $BUG

$BUG

Utility token for the hosted version of BugHunter.Fun. The open-source tool on GitHub is free and always will be. The token gates access to the hosted autonomous agent and team workspaces when those ship.

Contract: [REDACTED]
Chain: Solana
Status: Hosted version in development

Skip the grunt work.
Start collecting.

Open source. Free. Runs in your terminal. Submission-ready reports for the four biggest bug bounty platforms.

$ git clone https://github.com/Awarexone/Agentic-Bug-Hunter && cd Agentic-Bug-Hunter && ./install.sh Click to copy

— or just paste the install prompt into claude and let it install itself —

Get on GitHub → See the prompts