HackenProof connects companies with 82,000+ verified security researchers through bug bounty programs and security audit services — Curated, Crowdsourced, and DualDefense.
This listing identifies a third-party MCP server. MCPBundles is not affiliated with, sponsored by, or endorsed by the service or its operator unless stated on this page.
This server may ask you to sign in when your AI client connects.
Last probed Nov 3, 2026 · mcp.hackenproof.com
28tools discovered
For AI agents — MCPBundles Directory API
For MCP client apps (human connect):
MCP connect URL: https://mcp.hackenproof.com/mcp
Skill page: https://www.mcpbundles.com/skills/hackenproof-mcp-c4570b5435
Explore capabilities (28)
read 12
write 13
Showing 25 of 28
Showing 25 of 28 tools from the public preview. Connect the server to inspect the full live tool list.
Get5
List5
Triage3
Add2
Change2
Other capabilities8
List Companies
read
list_companies
List companies accessible to the current user. Returns [{title, slug, role}].
Use slug (not title) in all other tools.
Args:
search: Case-insensitive filter on title or slug.
List Companies — List companies accessible to the current user. Returns [{title, slug, role}].
Use slug (not title) in all other tools.
Args:
search: Case-insensitive filter on title or slug.
List Programs — List program slugs for a company.
Args:
company: Company slug (from list_companies)
Get Program Stats — Report counts: total, new, SLA soon-to-breach, SLA breached.
Args:
company: Company slug
program: Program slug
List Reports — Search/filter reports. Returns summaries (id, title, state, severity, labels, author, created).
Use get_report_details for full content. page=0 fetches all pages (slow for large programs).
Args:
company: Company slug
program: Program slug
search: Free-text search query
severity: "Critical" | "High" | "Medium" | "Low"
state: "New" | "In review" | "Need more info" | "Triaged" | "Out of scope" | "Not applicable" | "Spam" | "Informative" | "Disclosed" | "Duplicate" | "Resolved"
Get Report Sizes — Get char counts for each report field without fetching full content.
Call this first to decide whether to fetch the full report or specific fields.
Returns: {vulnerability_description, validation_steps, comments, attachments}
Args:
company: Company slug
program: Program slug
report_id: Report ID (e.g. HACK-55)
Get Report Details — Fetch report content. Default truncates long fields at 4000 chars and excludes comments;
_sizes shows real char counts. Use get_report_sizes first to plan what to fetch.
- full=True: return everything at full length including comments (may be large)
- fields=["vulnerability_description"]: return only that field at full length
- fields=["comments"]: get comments inline
Available fields: id, title, severity, state, author, target, attachments,
vulnerability_description, validat
Get Comments — Get comments on a report. Deleted comments are always excluded.
Args:
company: Company slug
program: Program slug
report_id: Report ID (e.g. HACK-55)
limit: Return only the last N comments (most recent first).
include_hidden: If False, exclude comments hidden from the reporter.
comment_ids: Return only comments with these IDs (from list_comments_summary).
Get your MCP into directories
A working endpoint is step one. Directory coverage is the coordinated launch across ChatGPT, Claude, Cursor, the MCP Registry, and community indexes.
HackenProof connects companies with 82,000+ verified security researchers through bug bounty programs and security audit services — Curated, Crowdsourced, and DualDefense.
How do I connect HackenProof to my AI agent?
Use the MCP endpoint listed on this page in your MCP client configuration. One-click install pills support Claude, Cursor, VS Code, and other hosts. Copy the remote MCP URL if your client needs a manual entry.
How many tools does HackenProof provide?
Operate this server?
Request removal if you do not want HackenProof listed here, or claim the listing if you want to manage it on MCPBundles.
Operate HackenProof?
This server appears in the MCPBundles directory. Verify you operate it to take over the listing — name, description, logo, contact email, and skill content. We email a 6-digit code to a maintainer address your server publishes in /.well-known/security.txt or /.well-known/mcpbundles.json. Free, takes about a minute.
MCPBundles publishes this directory for MCP discovery. Except where we host or operate an offering, third-party services run under their own terms. Product and company names on this page are used in a descriptive, identifying way (including under nominative fair use where applicable); they remain the property of their owners. Nothing here grants you rights in those marks, and nothing here is an offer to sell a third party's services. Terms · Request removal
More in security
Other MCP servers in this category from the directory index
List Comments Summary — List comment metadata without fetching comment text. Use this to identify
which comments to fetch with get_comments(comment_ids=[...]).
Returns: [{comment_id, username, role, date, is_hidden}] excluding deleted comments.
Args:
company: Company slug
program: Program slug
report_id: Report ID (e.g. HACK-55)
Search Comments — Search comment text across all reports in a program. Slow on large programs — use page=N to limit scope.
Args:
company: Company slug
program: Program slug
query: Text to find (case-insensitive)
state: Restrict to reports in these states
page: 1-based page of reports to search. 0 = all pages.
Get Attachments — List attachment filenames and URLs for a report.
Only includes report-level attachments (description/PoC uploads). Comment attachments
are not listed here — check the attachments field in get_comments results instead.
URLs require auth — use fetch_attachment to download content.
Args:
company: Company slug
program: Program slug
report_id: Report ID (e.g. HACK-55)
Fetch Attachment — Download an attachment via authenticated session. Returns text content for text files,
or metadata + a ready-to-run curl command for binary files.
Args:
company: Company slug
program: Program slug
attachment_url: URL from get_attachments or get_report_details
Add Comment — Post a markdown comment on a report. Visible to the researcher unless hidden=True.
Args:
company: Company slug
program: Program slug
report_id: Report ID (e.g. HACK-55)
comment: Markdown text. Newlines are supported.
hidden: If true, only triage team can see the comment.
text: Alias for comment (use either).
Comment With Attachment — Post a comment with one or more file attachments on a report.
For a single file, use the flat params (file_path or file_base64 + filename).
For multiple files, use the attachments list — each entry is a dict with the same keys.
Args:
company: Company slug
program: Program slug
report_id: Report ID (e.g. HACK-55)
file_path: Absolute path to the file to attach (local only).
file_base64: Base64-encoded file content (for remote clients).
filename: Filename for the attachmen
Screenshot And Comment — Attach an evidence rendering of another HackenProof report (e.g. the
original of a duplicate) to a comment.
Behaviour: fetches the report's PDF first (full content, fast). Falls back
to a page screenshot only if the PDF endpoint fails for that report.
Args:
company: Company slug
program: Program slug
report_id: Report ID to post the comment on (e.g. HACK-55)
comment: Markdown comment text. Newlines are supported.
screenshot_url: Full URL of the report page to attach (e.g. t
Update Comment — Edit a comment on a report, possible only within 15 minutes of posting.
Args:
company: Company slug
program: Program slug
report_id: Report ID (e.g. HACK-55)
new_text: Replacement markdown text.
comment_id: ID of the comment to edit (preferred if available).
comment_text: Substring of the comment text to search for (used when comment_id is unknown).
Delete Comment — Delete a comment on a report , possible only within 15 minutes of posting.
Args:
company: Company slug
program: Program slug
report_id: Report ID (e.g. HACK-55)
comment_id: ID of the comment to delete (preferred if available).
comment_text: Substring of the comment text to search for (used when comment_id is unknown).
Change State — Change report state. Automatically walks intermediate transitions to reach the target.
Valid states: New | In review | Need more info | Triaged | Out of scope |
Not applicable | Spam | Informative | Disclosed | Duplicate | Resolved | Paid | Deleted
When target_state="Disclosed", you can optionally control public visibility:
- visibility: "private" | "partially" | "public"
- visibility_params: per-field booleans. Recognised keys:
report_title, author_name, rewards, comments, t
Set Visibility — Update what's publicly visible on an already-disclosed report.
Args:
company: Company slug
program: Program slug
report_id: Report ID (e.g. HACK-55)
visibility: "private" | "partially" | "public"
visibility_params: Per-field booleans. Recognised keys:
report_title, author_name, rewards, comments, target_info, vuln_details,
validation_steps, vuln_type, attachments, severity, state, creation_date,
participants, timeline
Change Severity — Change report severity.
Valid values: Low | Medium | High | Critical
Args:
company: Company slug
program: Program slug
report_id: Report ID (e.g. HACK-55)
severity: New severity (exact string from list above)
List Labels — List all labels available in the company. Labels are company-level and shared across all programs.
Use this before triaging to pick correct existing labels instead of creating duplicates.
Args:
company: Company slug
program: Program slug
Add Labels — Add labels to a report.
Use kebab-case: dup-42, access-control, needs-poc. Avoid spaces/underscores/mixed case.
Args:
company: Company slug
program: Program slug
report_id: Report ID (e.g. HACK-55)
labels: Label names to add
Remove Labels — Remove labels from a report. Labels not currently on the report are silently ignored.
Args:
company: Company slug
program: Program slug
report_id: Report ID (e.g. HACK-55)
labels: Label names to remove
Triage Report — Apply all triage decisions to a single report in one authorized action.
For the same actions on many reports, use triage_bulk instead.
For different actions per report, use triage_reports_batch.
Execution order: comment (with optional attachment) → state → severity → labels.
The LLM should present a plain-text summary of planned actions before calling this,
so the user can review and confirm in one step.
Args:
company: Company slug
program: Program slug
report_id: Report ID (e.g.
Triage Reports Batch — Apply different triage decisions to multiple reports in one authorized action.
For the same actions on all reports, use triage_bulk instead (simpler, flat params).
The LLM should present a summary table of planned actions before calling this,
so the user can review, edit, and confirm everything in one step.
Each entry in `reports` is a dict with (all fields optional except report_id):
report_id (str, required)
state (str) e.g. "Out of scope", "Duplicate", "Triaged"
Triage Bulk — Apply identical triage actions to multiple reports at once.
Use this when the same state, severity, labels, and/or comment apply to all reports.
For per-report customization, use triage_reports_batch instead.
Execution order per report: comment (+attachment) → state → severity → labels.
Reports are processed sequentially; failures on one do not stop the rest.
Args:
company: Company slug
program: Program slug
report_ids: List of report IDs (e.g. ["HACK-55", "HACK-56"])
state: T
Showing the first 25 tools — full list and schemas: Directory API.
MCPBundles probed 28 tools on the live server. The tool list on this page reflects what was discovered at the last refresh — connect your client to see the full set available to your session.
What authentication does HackenProof require?
HackenProof may require signing in to the provider before tools can run. Connect through MCPBundles or your MCP client and complete any provider login when prompted.
Don't want this listed?
Request removal from the MCPBundles directory. We stop publishing this listing on mcpbundles.com.
MCPBundles is an independent platform built on the open Model Context Protocol standard. MCPBundles is not affiliated with, sponsored by, or endorsed by Anthropic PBC.