VulneraBLOCK
An AI-Powered Bug Bounty Hunting Platform - Comprehensive MCP server for security testing, vulnerability research, and bug bounty hunting
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
An AI-Powered Bug Bounty MCP Server — recon, vulnerability testing, API/auth/cloud scanning, graph analysis, and reporting for security researchers and bug bounty hunters.
[](https://opensource.org/licenses/MIT) [](https://www.typescriptlang.org/) [](https://nodejs.org/) [](https://youtu.be/wlUvBVNyh74) [](https://glama.ai/mcp/servers/telmon95/VulneraMCP)
VulneraMCP is a Model Context Protocol (MCP) server for bug bounty hunting and security testing. It integrates OWASP ZAP, optional Caido/Burp Suite, and CLI tools (subfinder, httpx, gau, ffuf) for reconnaissance, JavaScript analysis, XSS/SQLi/IDOR/CSRF testing, API and auth misconfiguration checks, cloud bucket and secret scanning, orchestrated scan flows, knowledge-graph analysis, wordlist generation, and Markdown reporting — with PostgreSQL storage for findings and test results.
🎬 Demo
Watch the VulneraMCP demonstration on YouTube: https://youtu.be/wlUvBVNyh74
🌟 Features
🔍 Reconnaissance Tools
- Subdomain Discovery: Subfinder, Amass integration
- Live Host Detection: HTTPx for checking active endpoints
- DNS Resolution: DNS record enumeration (A, AAAA, CNAME, MX, TXT)
- URL Discovery: Gau (Get All URLs) from archives and crawlers
- Fuzzing: ffuf for directory, file, and parameter discovery
- Full Recon Workflow: Automated multi-tool reconnaissance
🔐 Security Testing
- XSS Testing: Automated cross-site scripting detection
- SQL Injection: SQL
8eea9866561bOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add vulneramcp --env POSTGRES_PASSWORD=${POSTGRES_PASSWORD} --env REDIS_PASSWORD=${REDIS_PASSWORD} --env ZAP_API_KEY=${ZAP_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"vulneramcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"POSTGRES_PASSWORD": "${POSTGRES_PASSWORD}",
"REDIS_PASSWORD": "${REDIS_PASSWORD}",
"ZAP_API_KEY": "${ZAP_API_KEY}"
}
}
}
}Exposed tools (110)
95 read · 13 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
api.bola_test | read | |
api.graphql_introspection | read | |
api.graphql_misconfig | read | |
api.mass_assignment_test | read | |
api.rate_limit_test | read | |
api.swagger_enum | read | |
attackgraph.export_graphml | read | |
attackgraph.export_json | read | |
attackgraph.export_visual_json | read | |
attackgraph.generate | read | |
attackgraph.rank_paths | read | |
auth.detect_cookie_flags | read | |
auth.detect_jwt | read | |
auth.detect_mfa_signals | read | |
auth.detect_oauth_flow | read | |
auth.jwt_alg_confusion | read | |
auth.jwt_none_attack | read | |
auth.mfa_bypass_test | read | |
auth.oauth_misconfig | read | |
auth.password_reset_poisoning | destructive | |
auth.session_fixation | read | |
auth.test_jwt_alg_confusion | read | |
auth.test_jwt_none | read | |
auth.test_password_reset_poisoning | destructive | |
auth.test_session_fixation | read | |
cloud.azure_blob_enum | read | |
cloud.bucket_permission_probe | read | |
cloud.detect_keys_in_env | read | |
cloud.detect_keys_in_html | read | |
cloud.detect_keys_in_js | read | |
cloud.exposed_keys_scan | read | |
cloud.gcp_bucket_enum | read | |
cloud.s3_enum | read | |
cloud.storage_misconfig_check | read | |
cloud.terraform_leak_scan | read | |
db.get_findings | read | |
db.get_statistics | read | |
db.get_test_results | read | |
db.init | read | |
db.save_finding | write | |
graph.cluster_findings | read | Cluster similar findings |
graph.create_edge | write | |
graph.create_node | write | |
graph.detect_patterns | read | Detect patterns in graph structure |
graph.extract_patterns | read | Extract patterns from findings |
graph.find_attack_chains | read | Find attack chains |
graph.find_path | read | |
graph.find_related | read | Find related nodes |
graph.find_similar_findings | read | Find similar findings |
graph.get_node | read | |
graph.get_node_edges | read | |
graph.get_nodes_by_type | read | |
graph.init | read | Initialize graph database tables |
graph.link_finding_to_target | read | |
graph.link_related_findings | read | |
graph.statistics | read | Get graph statistics |
js.analyze | read | |
js.beautify | read | |
js.download | read | |
js.extract_secrets | read | |
js.find_endpoints | read | |
recon.amass | read | |
recon.dns | read | |
recon.ffuf | read | |
recon.full | read | |
recon.gau | read | |
recon.httpx | read | |
recon.subfinder | read | |
render.execute_js | write | |
render.extract_dom | read | |
render.extract_forms | read | |
render.screenshot | read | |
report.generate_markdown | read | |
scanner.correlate_findings | read | |
scanner.execution_log | read | |
scanner.normalize_target | read | |
scanner.run_flow | write | |
security.test_auth_bypass | read | |
security.test_csp | read | |
security.test_csrf | read | |
security.test_idor | read | |
security.test_sqli | read | |
security.test_xss | read | |
training.extract_from_writeup | read | |
training.get | read | |
training.get_csrf_patterns | read | |
training.import | write | |
training.import_all | write | |
training.import_htb | write | |
training.import_portswigger | write | |
training.match | read | |
training.stats | read | |
wordlist.generate_combined | read | |
wordlist.generate_custom | read | |
wordlist.generate_directories | read | |
wordlist.generate_files | read | |
wordlist.generate_parameters | read | |
zap.create_context | write | |
zap.get_active_scan_status | read | |
zap.get_alerts | read | |
zap.get_alerts_summary | read | |
zap.get_sites | read | |
zap.get_spider_status | read | |
zap.get_urls | read | |
zap.health_check | read | |
zap.include_in_context | read | |
zap.proxy_process | read | |
zap.send_request | write | |
zap.start_active_scan | write | |
zap.start_spider | write |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (10 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (6)
return eval(scriptToRun);
targetPattern: 'document.write|innerHTML|eval(',auth.password_reset_poisoning, auth.test_password_reset_poisoning
axios, body-parser, commander, cors, dotenv, express, fs-extra, js-beautify
"writeupText": "I found a CSRF vulnerability in /api/profile/update. The endpoint accepted POST requests without CSRF tokens. I crafted a form with <form method='POST'> and successfully changed the vi
- Full access to servers/database
Gates applied: no_behavioural_pass.
8eea9866561bfull audit observations/trust-audit/mcp-server/telmon95__vulnera.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 8eea9866561b | BLOCK | D | 69 | first audit |
Questions
What is the Vulnera MCP server?
An AI-Powered Bug Bounty Hunting Platform - Comprehensive MCP server for security testing, vulnerability research, and bug bounty hunting
What tools does Vulnera expose?
110 in total: 95 read-only, 13 that write, and 2 that can delete or overwrite (auth.password_reset_poisoning, auth.test_password_reset_poisoning). Every one is listed on this page with its risk.
Is Vulnera safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Vulnera need?
It reads POSTGRES_PASSWORD, REDIS_PASSWORD and ZAP_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (8eea9866561b), read on 2026-10-08. The repository is watched and re-audited when it changes.