Skip to content

Back to the catalog

Bug Bounty Directory & MCP API
github.comrepo

Bug Bounty Directory & MCP API

bug-bounties is a community-maintained directory of over 3,000 active bug bounty programs and vulnerability disclosure policies (VDPs), exposed via a public API and a Model Context Protocol (MCP) server. It lets researchers programmatically query scope, rewards, and program metadata, and lets AI coding agents like Claude Code look up bug bounty targets directly.

TL;DR Open directory + API/MCP server of 3,000+ bug bounty programs and VDPs for researchers and AI agents.
Open original ↗
Document

What it is

lissy93/bug-bounties is a GitHub README that lists bug bounty programs and vulnerability disclosure policies (VDPs) alphabetically, under a "Top Programs" heading. Its links point to the full list at bug-bounties.as93.net, a "Browse All Programs" view and a "Submit New Program" flow. The entries are flat link lists, not structured data.

Each entry is a name, a link and up to three markers: 💰 for a bounty, 🏅 for a shout-out, 🎁 for swag. Entries with only 🏅 or 🎁 pay no cash, so the list mixes paying programs with plain disclosure policies.

The fetched text covers only the first 60,000 of 143,069 characters, ending at the K entries (KFC). It shows nothing about the public API or the MCP server, so endpoints, tools, schemas and setup are unverified here. The README itself carries no scope, reward amounts or program metadata, and no entry gives a date.

What the list shows

Most links go to a platform page, so the list works as an index into those platforms:

  • Immunefi (crypto and DeFi protocols)
  • Bugcrowd (including many "Marketplace Bug Bounty" engagements)
  • YesWeHack
  • Intigriti
  • HackerOne
  • Companies' own policy pages

Anthropic appears as "Anthropic (VDP)", linked to anthropic.com, not to a policy page.

Caveats

The visible portion has data-quality problems that matter for programmatic use:

  • Duplicate entries for one program: Acorns (three), Bullish (three), Dell Technologies (three), HPE Networking (two), Coindcx (two), Ezviz (two), ATG (two).
  • Entries with the same URL under different names: "Code.org" and "CodeAI".
  • Links that look wrong for the name: "Aiven" goes to aven.com, "ABNAMRO BANK" goes to a personal.rbs.co.uk page, and "Aragon" goes to an ark.io blog post.
  • A misspelled name: "Kayesa" links to kaseya.com.
  • Several entries link to a bare company homepage, not a disclosure policy: Abercrombie, Affirm, Agoda and others.

Check the policy page itself for scope and safe-harbour terms before testing anything. The list does not carry them.

Technologies named here

Related in Offensive Security