Skip to main content

HackerOne MCP Server Setup & Tool Reference

Organizations: Connect Claude to a read-only HackerOne MCP server and understand the available tools.

Overview

The HackerOne MCP (Model Context Protocol) server provides read-only access to HackerOne platform data from Claude and other supported MCP clients. You can use it to search and analyze programs, reports, assets, bounty information, and remediation data without making changes to your HackerOne account.

This article explains the prerequisites, plan availability, and important configuration details for setting up the HackerOne MCP server.

The HackerOne MCP server is available on Professional and Enterprise plans across both Legacy and CTEM packaging.

Prerequisites

Before you begin, make sure you have:

  • A HackerOne account with API access to the programs you want to access.

  • Claude Code (CLI), Claude Desktop, or another compatible MCP client installed.

Note: All MCP tools are currently read-only. You cannot use Claude or another MCP client to modify reports, tickets, assets, or program settings through the HackerOne MCP server.

Use the Correct client_id

Each supported MCP client registers its own OAuth client and redirect URI. Claude Code (CLI) and Claude Desktop use different local callback paths.

Using the wrong client_id causes the OAuth redirect to fail during authentication.

When configuring the HackerOne MCP server:

  • Use the configuration snippet that matches the client you are setting up.

  • Do not use the Claude Code (CLI) client_id for Claude Desktop.

  • Do not use the Claude Desktop client_id for Claude Code (CLI).

Selecting the correct configuration ensures the OAuth flow completes successfully.

Setup — Claude Code (CLI)

1. Add the MCP

claude mcp add-json hackerone --scope user '{
  "type": "http",
  "url": "https://hackerone.com/mcp",
  "oauth": {
    "clientId": "d5HEIsfrQSO7rK_z7a0fXDBbKei7VxKj7df3GOQBQ5I",
    "callbackPort": 9384,
    "scopes": "h1:graphql"
  }
}'

Use --scope user so the config follows your profile rather than one repo.

2. Authenticate

  1. Run /mcp inside Claude

  2. Find hackerone in the list

  3. Select authenticate — your browser opens to complete OAuth against hackerone.com

  4. Confirm it worked: ask Claude to check your HackerOne user profile

Setup — Claude Desktop

1. Log in to HackerOne

Make sure you're already logged into your HackerOne account at hackerone.com in your browser.

2. Add the connector

  1. Open Claude Desktop and go to Settings > Connectors > Add custom connector

  2. Enter:

    • Name: HackerOne

    • Remote MCP server URL: https://hackerone.com/mcp

    • OAuth Client ID: kvb8pI7eB_bqFRGCFdgfSZZ6S2rb8ZYn6YpOwlm9x2Y — leave OAuth Client Secret blank

  3. Click Add

If you see a Connection methods section (Individual sign-in/Managed authorization), leave Individual sign-in on. This only shows up when adding the connector as a Claude org admin—most people won't see it.

3. Authenticate

Claude opens a browser window so you can complete the OAuth flow on HackerOne. Approve the authorization request, then return to Claude Desktop. After authentication completes, the connector appears as Connected.

Authentication

Your login expires periodically. If a tool call suddenly fails with a re-authorization error, reconnect: run /mcp and re-authenticate for CLI, or go to Settings > Connectors and reconnect for Desktop.

What You'll See

After you authenticate, hackerone.com shows a consent screen asking you to allow access. Select Allow access to continue.

Tools

Discovery

Tool

Description

get_current_user

Current authenticated user's profile

list_programs

Programs accessible to you, returns handles

list_organizations

Returns IDs of Organizations accessible to you

list_assets

Assets for an organization

get_asset

Detail for a specific asset

Reports

Tool

Description

search_reports

Filter reports by program, state, severity, keyword, date (10-minute minimum report age applies)

get_report

Full report detail (10-minute minimum report age applies)

report_summary

AI-structured report summary artifact

report_assessment

AI-generated objective assessment from evidence

report_statistics

Natural-language question over report statistics and analytics (Hai)

report_compare

AI comparison of two reports

report_comparison_table

Comparison table artifact across similar reports

report_similarity_search

Find semantically similar reports (embeddings)

report_similarity_by_embedding_search

Similar reports via embedding search

report_feature_query_search

Natural-language search over reports

Bounty & Remediation

Tool

Description

bounty_table_lookup

Bounty table info for a report

bounty_amount_suggestion

AI-powered bounty amount suggestion

get_remediation_plan

H1 remediation plan for a report

get_code_validation_summary

H1 Remediation root cause analysis for a report (Hai)

Other

Tool

Description

insight_agent_extractor

Extract structured insights across a set of reports (Hai)

mermaid

Generate a Mermaid diagram artifact (Hai)

Example Prompts

Reports

  • "Summarize report #4521 for me."

  • "Give me an objective assessment of report #4521 based on the evidence submitted."

  • "Is report #4521 a duplicate of #4390?"

  • "Find reports similar to #4521."

  • "How many critical reports came in for the Acme program last quarter?"

  • "Search reports mentioning HTTP request smuggling from the last 90 days."

Bounty & remediation

  • "What's the remediation plan for report #4521 — root cause, suggested fix, and verification checks?"

  • "What's the code validation summary for report #4521?"

  • "What bounty should we pay for report #4521?"

  • "Look up the bounty table for the Acme program."

Other

  • "Pull structured insights across all SSRF reports from this quarter."

  • "Diagram the stages a report goes through from validation to remediation."

Troubleshooting

Symptom

Cause

Fix

"Needs authentication" in claude mcp list (CLI)

Token expired or never completed

Run /mcp, re-authenticate

Tool call errors "requires re-authorization"

Token expired mid-session

Re-authenticate for your client

Desktop OAuth fails at the browser redirect step

Wrong client_id entered in the connector's OAuth Client ID field — CLI and Desktop client_ids aren't interchangeable

Use the Desktop client_id (kvb8pI7eB_bqFRGCFdgfSZZ6S2rb8ZYn6YpOwlm9x2Y) for Desktop, CLI client_id for CLI

Port 9384 already in use (CLI only)

Another MCP process is bound to that port

lsof -nP -iTCP:9384 -sTCP:LISTEN, stop the conflicting process

Related Articles
Did this answer your question?