hackerone-brain-mcp-server

HackerOne Brain (H1 Brain) MCP Server

When to Use

• When starting a new bug bounty program and need to pull scope/policy into .claudemd.
• When checking disclosed reports to avoid submitting duplicates.
• When researching what vulnerability types a program rewards highest.
• When building target-specific context for Claude's autonomous hunting sessions.

Prerequisites

• HackerOne API token (from HackerOne settings → API → Generate Token)
• Node.js 18+ installed
• Claude Code CLI with MCP server support enabled
• H1_API_TOKEN environment variable set

Core Concept

"H1 Brain is an MCP Server that pulls HackerOne program policy and disclosed reports directly into Claude's context." — Episode 166 [32:02]

MCP (Model Context Protocol) servers extend Claude's capabilities by providing structured access to external data sources. H1 Brain connects Claude to HackerOne's platform data.

Workflow

Phase 1: MCP Server Setup

Add H1 Brain to your Claude Code CLI MCP configuration:

// ~/.claude/mcp_servers.json
{
  "h1-brain": {
    "command": "npx",
    "args": ["-y", "h1-brain-mcp"],
    "env": {
      "H1_API_TOKEN": "${H1_API_TOKEN}"
    }
  }
}

If the h1-brain-mcp package is not available publicly, build a custom MCP server:

// mcp-servers/h1-brain/index.ts
import { Server } from "@modelcontextprotocol/sdk/server/index.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

const H1_API_BASE = "https://api.hackerone.com/v1";
const H1_TOKEN = process.env.H1_API_TOKEN;

const server = new Server({ name: "h1-brain", version: "1.0.0" }, {
  capabilities: { tools: {} },
});

// Tool: Get program policy and scope
server.setRequestHandler("tools/list", async () => ({
  tools: [
    {
      name: "get_program_policy",
      description: "Get a HackerOne program's policy, scope, and bounty table",
      inputSchema: {
        type: "object",
        properties: { handle: { type: "string", description: "Program handle (e.g., 'github')" } },
        required: ["handle"],
      },
    },
    {
      name: "search_disclosed_reports",
      description: "Search publicly disclosed reports for a program",
      inputSchema: {
        type: "object",
        properties: {
          handle: { type: "string" },
          query: { type: "string", description: "Search query (e.g., 'SSRF', 'IDOR')" },
        },
        required: ["handle"],
      },
    },
  ],
}));

server.setRequestHandler("tools/call", async (request) => {
  const { name, arguments: args } = request.params;

  if (name === "get_program_policy") {
    const res = await fetch(`${H1_API_BASE}/hackerone/programs/${args.handle}`, {
      headers: { Authorization: `Bearer ${H1_TOKEN}` },
    });
    const data = await res.json();
    return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
  }

  if (name === "search_disclosed_reports") {
    const res = await fetch(
      `${H1_API_BASE}/reports?filter[program][]=${args.handle}&filter[disclosed]=true&page[size]=20`,
      { headers: { Authorization: `Bearer ${H1_TOKEN}` } }
    );
    const data = await res.json();
    return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
  }

  return { content: [{ type: "text", text: "Unknown tool" }] };
});

const transport = new StdioServerTransport();
server.connect(transport);