vuln·telMCP serverToolsNew in scopeGuidesField notesGet a key

MCP servers for AI bug-bounty agents, compared

This page is for hunters who run an AI agent (Claude Code, Cursor, Codex) on bug-bounty work and want to know which MCP servers are worth connecting. No single server does everything, and most good setups combine three layers: an execution layer that touches the target (Burp), a recon layer that maps it, and an intelligence layer that says what is known, what has paid before, and what is new. vulntel is an intelligence-layer server; this page compares it with the servers you would weigh it against, and says plainly where the others are stronger.

Checked against each project's own pages on 2026-11-03. Projects move fast: if a cell is wrong, tell us and we will fix it.

At a glance

What it is for Hosted or local Cost Needs your platform token
vulntel CVE intelligence + disclosed-report mechanics + program priors + new scope, for agents hosted (mcp.vulntel.com) free; 9 tools keyless (25 calls/day), free key for all 13 no
Vulners MCP broad CVE / advisory search hosted + open source free tier (100 API credits/month) to $1,300/month no
VulnCheck MCP exploitation intelligence, KEV ahead of CISA local (Go / Docker) free Community token covers NVD tools; most indices paid no
h1-brain your own HackerOne history + 3,600+ disclosed reports, per-program briefings local free yes (HackerOne API token)
bbradar (Pro) scope changes on 24 platforms, target scores, duplicate/competition risk local MCP (@bbradar/mcp) free discovery; Pro paid no
TargetFinder scope tracking on 6 platforms with re-add events and competition level local free (MIT) no
Vulnerability-Exposure-MCP "am I affected" from banners, distro patch checks, report checking local free (MIT) no
cvENGINE self-hosted attack-surface platform with distro-aware CVE matching self-hosted free (GPL-3) no
Burp MCP (PortSwigger) drive Burp from the agent: requests, proxy history local, inside Burp free extension (GPL-3.0); needs Burp no

Where each one is stronger

  • Vulners has the broadest advisory coverage of the hosted options (230+ sources) and a mature self-serve ladder; its MCP is included on every tier, Free too. If you mainly need "find advisories about X", start there.
  • VulnCheck has the strongest exploitation evidence (first-party research, VulnCheck KEV), and its MCP has 29 tools. It runs locally and most indices need a paid plan.
  • h1-brain is the closest thing to vulntel's report-driven tools, and it knows your HackerOne history, which no hosted service can. It needs your HackerOne token and runs on your machine.
  • bbradar covers far more platforms for scope changes (24) and already filters re-adds and normalization noise, with a duplicate/competition-risk estimate. If fresh scope across many platforms is your main loop, it is ahead. TargetFinder is the free, local alternative.
  • Vulnerability-Exposure-MCP and cvENGINE also give distro-aware answers for server banners (Debian / Ubuntu backports), locally or self-hosted, and cvENGINE pairs it with real scanning.
  • Burp's MCP is the execution layer. vulntel does not replace it; it tells the agent where to point it.

What vulntel does differently

Only claims we can back:

  • Hosted, free, nothing to install, no platform token. One URL, and nine tools answer without a key.
  • Mechanics from ~14,000 distilled disclosed HackerOne reports, with a tried= list. You tell find_attack_approaches which bug classes you have already exhausted and it ranks the nearest approaches you have not tried. Others offer report search or per-program suggestions; we found none that takes a caller's tried list.
  • Program priors from public disclosures across all hunters. program_outcome_prior gives, per bug class, how much more often it landed on a program than on average, and which classes almost never land there, without your token.
  • A per-claim CVE fact-check. verify_cve_claim splits a claim into exists / affects this version / severity / exploited and returns supported, refuted or unverifiable for each, with evidence: built for catching an agent's confident mistakes before they reach a report.
  • Distro verdicts from a verbatim banner, hosted, including Alpine. Paste OpenSSH_8.9p1 Ubuntu-3ubuntu0.10 and each CVE gets Ubuntu's own verdict for that build next to the upstream one. Others now do Debian / Ubuntu locally; hosted with Alpine is the difference.
  • New scope with the program's history joined. new_in_scope lists assets that just entered a program's scope (re-adds and renames filtered out) with the program's disclosed-report history, a cached stack if we have one, and advisories for newly added code repositories. bbradar and TargetFinder track more platforms; the joined context is ours.

Where vulntel is weaker: it is HackerOne-centric for report data (Bugcrowd publishes few full disclosures), it has no first-party exploitation telemetry, and it covers fewer bounty platforms for scope than bbradar.

A setup that works

Execution: Burp's MCP. Recon: your own tooling, or observe for a quick stack read. Intelligence: vulntel for "what is known, what has paid, what is new", plus h1-brain if you want your own HackerOne history in the loop.

Sources (checked 2026-11-03)

  • Vulners pricing and MCP: vulners.com/pricing, docs.vulners.com/docs/products/mcp/
  • VulnCheck MCP tools: github.com/vulncheck-oss/mcp (docs/tools.md); indices: docs.vulncheck.com/indices
  • h1-brain: github.com/PatrikFehrenbach/h1-brain
  • bbradar: github.com/bbradar-io/bbradar.io
  • TargetFinder: github.com/NaroChatyan/targetfinder
  • Vulnerability-Exposure-MCP: github.com/MRFrazer25/Vulnerability-Exposure-MCP
  • cvENGINE: github.com/hevnsnt/CVEngine
  • Burp MCP server: github.com/PortSwigger/mcp-server
  • vulntel tools: vulntel.com/tools