awarexone/Agentic-Bug-Hunter

What it is

bughunter (Agentic-Bug-Hunter) is an MIT-licensed AI bug-bounty pipeline that runs recon → hunt → validate → report from the terminal. The summary covers the vuln-class counts, providers, and platforms; what it omits is that the tool ships in three install modes with different dependency footprints, and that a fully free, offline path exists via local Ollama — no Claude Code, Claude Pro, or paid API subscription required.

What to do

Standalone install (works without any subscription):

git clone https://github.com/Awarexone/Agentic-Bug-Hunter.git
cd Agentic-Bug-Hunter
./install.sh --agent standalone
bughunter setup    # choose provider

Free/offline path with local models:

curl -fsSL https://ollama.ai/install.sh | sh
ollama pull qwen2.5:14b          # ~9 GB, one-time
bughunter setup --provider ollama --model qwen2.5:14b

Non-interactive and one-off overrides are supported:

bughunter setup --provider ollama --model qwen2.5:14b
bughunter --provider ollama --model qwen3:14b hunt target.com

MCP server (for Cursor/Codex/OpenCode), separate from the CLI:

pip install 'mcp>=1.28'
./install.sh --agent mcp
bughunter mcp doctor
bughunter mcp serve

Uninstall preserves config unless you force it: ./uninstall.sh --agent standalone keeps ~/.bughunter/config.json; add --purge-config to delete it.

Operational details the summary omits

• Provider auto-detection order: Ollama → Groq → DeepSeek → … → OrcaRouter → OpenRouter → Claude → OpenAI. LiteLLM is opt-in only (explicit selection or LITELLM_API_KEY set) so it never preempts an already-configured provider. Config lives in ~/.bughunter/config.json.
• Scanner gating: every pipeline tool is gated on whether it's installed — missing tools are skipped, not errored. Auth headers set once carry through httpx, katana, ffuf, nuclei, and dalfox automatically.
• MCP is an adapter, not a second scanner: its active tools require defined scope plus explicit approval before running.

Caveats

The page is the project's own README, so all capability claims (26 web2 / 10 web3 classes, "kills weak findings") are self-reported, not independently verified. The "Trusted By" logos are compiled from 43 stargazers' public profiles and are explicitly not endorsements. Licensing is MIT but usage terms restrict it to authorized, in-scope testing (TERMS.md). The credential-attack skill (password spraying) and web3 rug-pull tooling are included — treat scope and legal guardrails as your responsibility, not the tool's.