Overview

The HackerOne MCP (Model Context Protocol) server provides read-only access to HackerOne platform data from Claude and other supported MCP clients. You can use it to search and analyze programs, reports, assets, bounty information, and remediation data without making changes to your HackerOne account.

This article explains the prerequisites, plan availability, and important configuration details for setting up the HackerOne MCP server.

The HackerOne MCP server is available on Professional and Enterprise plans across both Legacy and CTEM packaging.

Prerequisites

Before you begin, make sure you have:

A HackerOne account with API access to the programs you want to access.
Claude Code (CLI) or another compatible MCP client installed.

Note: All MCP tools are currently read-only. You cannot use Claude or another MCP client to modify reports, tickets, assets, or program settings through the HackerOne MCP server.

Use the Correct `client_id`

Each supported MCP client registers its own OAuth client and redirect URI. Using the wrong client_id causes the OAuth redirect to fail during authentication.

When configuring the HackerOne MCP server:

Use the configuration snippet that matches the client you are setting up.
Do not use the Claude Code (CLI) client_id for Claude Desktop.
Do not use the Claude Desktop client_id for Claude Code (CLI).

Selecting the correct configuration ensures the OAuth flow completes successfully.

Setup — Claude Code (CLI)

1. Add the MCP

claude mcp add-json hackerone --scope user '{
  "type": "http",
  "url": "https://hackerone.com/mcp",
  "oauth": {
    "clientId": "d5HEIsfrQSO7rK_z7a0fXDBbKei7VxKj7df3GOQBQ5I",
    "callbackPort": 9384,
    "scopes": "core-graphql/access"
  }
}'

Use --scope user so the config follows your profile rather than one repo.

2. Authenticate

Run /mcp inside Claude
Find hackerone in the list
Select authenticate — your browser opens to complete OAuth against hackerone.com
Confirm it worked: ask Claude to check your HackerOne user profile

Setup — Claude Desktop, Claude Code (Desktop app) & Claude Code (web)

These three all connect the same way, through a custom connector, and share the same client_id below. Follow the same steps in whichever app you're setting up.

1. Log in to HackerOne

Make sure you're already logged into your HackerOne account at hackerone.com in your browser.

2. Add the connector

Open Settings > Connectors > Add custom connector
Enter:
- Name: HackerOne
- Remote MCP server URL: https://hackerone.com/mcp
- OAuth Client ID (under Advanced settings): kvb8pI7eB_bqFRGCFdgfSZZ6S2rb8ZYn6YpOwlm9x2Y — leave OAuth Client Secret blank
Select Add

Note: If you see a Connection methods section (Individual sign-in/Managed authorization), leave Individual sign-in on. This only shows up when adding the connector as a Claude org admin — most people won't see it.

3. Authenticate

On the Connectors page, find HackerOne and select Connect
Claude opens a browser window to complete OAuth against hackerone.com
Approve access, then return to Claude — the connector now shows as connected

Setup — Codex(CLI)

1. Add the server to your Codex config

Open ~/.codex/config.toml (create it if it doesn't exist) and add:

# Must be at the TOP of the file, above every [section] header.
mcp_oauth_callback_port = 9384
[mcp_servers.hackerone]
url = "https://hackerone.com/mcp"
scopes = ["core-graphql/access"]
[mcp_servers.hackerone.oauth]
client_id = "fJNMwLzj3OSt8LCobKDR5AB5DqEf_-kT2x1DYxOxpsU"

Ordering matters. In TOML, every key after a [section] header belongs to that section. mcp_oauth_callback_port is top-level — it must appear before the first [mcp_servers…] header, or login will fail.

2. Authorize

codex mcp login hackerone

A browser window opens for HackerOne sign-in. Approve it; Codex captures the callback and stores the token.

3. Verify

codex mcp list

hackerone should appear as configured. Inside a session, /mcp shows the active server and its tools.

Authentication - Any Client

Your login expires periodically. If a tool call suddenly fails with a re-authorization error, reconnect:

CLI: run /mcp and re-authenticate
Desktop, Code Desktop app, or web: go to Settings > Connectors and reconnect
Codex: run codex mcp login hackerone again

What You'll See

After you authenticate, hackerone.com shows a consent screen asking you to allow "read and write access to the HackerOne GraphQL API." All current MCP tools are read-only — there are no write operations today. Select Allow access to continue.

Access Scope

MCP access is granted at the organization level, not per program. Once connected, Claude can access every program in any HackerOne organization you're a member of, scoped to your existing user permissions — you'll only see what your account already has access to on the platform.

Tools

Discovery

Tool	Description
`get_current_user`	Current authenticated user's profile
`list_programs`	Programs accessible to you, returns handles
`list_organizations`	Returns IDs of Organizations accessible to you
`list_assets`	Assets for an organization
`get_asset`	Detail for a specific asset

Reports

Tool	Description
`search_reports`	Filter reports by program, state, severity, keyword, date (10-minute minimum report age applies)
`get_report`	Full report detail (10-minute minimum report age applies)
`report_summary`	AI-structured report summary artifact
`report_assessment`	AI-generated objective assessment from evidence
`report_statistics`	Natural-language question over report statistics and analytics (Hai)
`report_compare`	AI comparison of two reports
`report_comparison_table`	Comparison table artifact across similar reports
`report_similarity_search`	Find semantically similar reports (embeddings)
`report_similarity_by_embedding_search`	Similar reports via embedding search
`report_feature_query_search`	Natural-language search over reports

Bounty & Remediation

Tool	Description
`bounty_table_lookup`	Bounty table info for a report
`bounty_amount_suggestion`	AI-powered bounty amount suggestion
`get_remediation_plan`	H1 remediation plan for a report
`get_code_validation_summary`	H1 Remediation root cause analysis for a report (Hai)

Other

Tool	Description
`insight_agent_extractor`	Extract structured insights across a set of reports (Hai)
`mermaid`	Generate a Mermaid diagram artifact (Hai)

Example Prompts

Reports

"Summarize report #4521 for me."
"Give me an objective assessment of report #4521 based on the evidence submitted."
"Is report #4521 a duplicate of #4390?"
"Find reports similar to #4521."
"How many critical reports came in for the Acme program last quarter?"
"Search reports mentioning HTTP request smuggling from the last 90 days."

Bounty & remediation

"What's the remediation plan for report #4521 — root cause, suggested fix, and verification checks?"
"What's the code validation summary for report #4521?"
"What bounty should we pay for report #4521?"
"Look up the bounty table for the Acme program."

Other

"Pull structured insights across all SSRF reports from this quarter."
"Diagram the stages a report goes through from validation to remediation."

Troubleshooting

Symptom	Cause	Fix
"Needs authentication" in `claude mcp list` (CLI)	Token expired or never completed	Run `/mcp`, re-authenticate
Tool call errors "requires re-authorization"	Token expired mid-session	Re-authenticate for your client
Desktop/Code Desktop app/web OAuth fails at the browser redirect step	Wrong client_id entered in the connector's OAuth Client ID field — client_ids aren't interchangeable across clients	Use the connector client_id (`kvb8pI7eB_bqFRGCFdgfSZZ6S2rb8ZYn6YpOwlm9x2Y`) for Desktop/Code Desktop app/web, the CLI client_id for CLI, the Codex client_id for Codex
Codex login fails immediately	`mcp_oauth_callback_port` placed after a `[section]` header instead of at the top of `config.toml`	Move `mcp_oauth_callback_port = 9384` above every `[section]` header
Port 9384 already in use (CLI/Codex only)	Another MCP process is bound to that port	`lsof -nP -iTCP:9384 -sTCP:LISTEN`, stop the conflicting process

Questions

Contact your CSM or HackerOne Support.

HackerOne MCP Server Setup & Tool Reference

Overview

Prerequisites

Use the Correct client_id

Setup — Claude Code (CLI)

1. Add the MCP

2. Authenticate

Setup — Claude Desktop, Claude Code (Desktop app) & Claude Code (web)

1. Log in to HackerOne

2. Add the connector

3. Authenticate

Setup — Codex(CLI)

1. Add the server to your Codex config

2. Authorize

3. Verify

Authentication - Any Client

What You'll See

Access Scope

Tools

Discovery

Reports

Bounty & Remediation

Other

Example Prompts

Reports

Bounty & remediation

Other

Troubleshooting

Questions

Use the Correct `client_id`