awarexone/agentic-bug-hunter

AI-powered bug bounty hunting — recon to report, in your terminal.

What Is This · Trusted By · Free Setup · Quick Start · Commands · What It Finds · AXguard · Support · FAQ

Built and maintained by AwareXone · Website · X · GitHub

One API for GPT, Claude, and other leading AI models Sign up and get $3 in API credit · partner for BugHunter standalone mode

Register with partner link → · promo SDRBUGHUNTER · Docs · Model Plaza

---

Get started (30 seconds)

uv tool install agentic-bug-hunter   # install the CLI (or: pipx install agentic-bug-hunter)
bughunter setup                      # connect a free AI provider

Then hunt — straight from your terminal:

bughunter hunt target.com            # recon → find → validate → report

…or drive it from inside Claude Code:

/hunt target.com

The CLI and AI hunting work on their own. Full recon also uses external tools (subfinder · httpx · nuclei · katana · ffuf · nmap) — install them with install_tools.sh from the repo. Output lands in ~/.bughunter/.

---

Trusted By Engineers At

Where this project’s stargazers say they work.

Compiled from public GitHub profiles of this repository's stargazers -
43 people across 30 organizations, counted from the employer
each person lists on their own profile or from their public organization
memberships. No individual accounts are named. These companies have not
endorsed or sponsored this project; their logos are shown as trademarks of
their respective owners.

---

What Is This?

Agentic Bug Hunter finds real, reportable bugs, not theoretical ones. Point it at a target and it runs recon, tests for vulnerabilities, validates findings against a strict gate, and writes a submission-ready report for HackerOne, Bugcrowd, Intigriti, or Immunefi.

It remembers everything: patterns found on one target inform the next, and sessions pick up where they left off.

Works as a Claude Code plugin, or as a fully standalone CLI (bughunter) with no subscription required.

---

Standalone Mode: No Subscription Required

You no longer need Claude Code, Claude Pro, or any paid AI subscription.

Install once, use the bughunter command from any terminal on your machine:

git clone https://github.com/Awarexone/Agentic-Bug-Hunter.git
cd Agentic-Bug-Hunter
./install.sh --agent standalone

Rerun the same command after pulling updates. The installer detects and refreshes the active managed bughunter command, including older installations under /usr/local/bin or ~/.local/bin, while preserving your saved provider configuration in ~/.bughunter/config.json.

To uninstall the standalone command while keeping its configuration:

./uninstall.sh --agent standalone

Use --purge-config to also delete ~/.bughunter/config.json. The uninstaller also supports claude, opencode, pi, codex, agents, and all targets.

bughunter help               # show every command
bughunter setup              # choose your AI provider (Ollama is free + offline)
bughunter recon target.com   # map the attack surface
bughunter hunt  target.com   # hunt for vulnerabilities
bughunter validate "finding" # 7-Question Gate on your finding
bughunter report             # write a submission-ready report
bughunter chat               # interactive AI hunting shell
bughunter providers          # list all available AI providers
bughunter models             # list models and show the selected one
bughunter status             # check which provider is active
bughunter h target.com       # short alias for hunt
bughunter r target.com       # short alias for recon
bughunter v "finding"        # short alias for validate

Free AI Providers (auto-detected, free-first priority)

BugHunter auto-detects providers in this order: Ollama → Groq → DeepSeek → … → OrcaRouter → OpenRouter → Sidrune AI → Claude → OpenAI. LiteLLM is opt-in (selected explicitly or when LITELLM_API_KEY is set) so it never preempts a provider you already configured. Requesty is opt-in the same way (selected explicitly or when REQUESTY_API_KEY is set); set REQUESTY_BASE_URL=https://router.eu.requesty.ai/v1 to route through the EU region.

Switch providers or choose an installed Ollama model anytime: bughunter setup. The setup can also be fully non-interactive:

bughunter setup --provider ollama --model qwen2.5:14b

For a one-off override, put the option before the command:

bughunter --provider ollama --model qwen3:14b hunt target.com

Zero-cost fully offline setup

# 1. Install Ollama (runs AI locally, no internet needed after download)
curl -fsSL https://ollama.ai/install.sh | sh
ollama pull qwen2.5:14b          # ~9 GB, one-time download

# 2. Install BugHunter
git clone https://github.com/Awarexone/Agentic-Bug-Hunter.git
cd Agentic-Bug-Hunter
./install.sh --agent standalone   # creates system-wide 'bughunter' command

# 3. Hunt
bughunter setup       # choose Ollama, then choose one of its installed models
bughunter recon target.com

Groq setup (free cloud, fastest option)

export GROQ_API_KEY="your-key-here"     # free at console.groq.com
./install.sh --agent standalone
bughunter setup       # choose Groq
bughunter hunt target.com

Sidrune AI setup (multi-model gateway)

Sidrune AI is an optional OpenAI-compatible gateway (https://fluxionai.world/v1). It is not the default provider — pick it in bughunter setup, or set BRAIN_PROVIDER=fluxion when you want it.

# 1. Register (AwareXone partner link) and create an API key
#    https://fluxionai.space/register?source=github&campaign=github-sidrune-agentic-bug-hunter&promo=SDRBUGHUNTER
#    Docs: https://docs.fluxionai.world/user-guide/help-center
#    Models: https://fluxionai.world/model-plaza

export FLUXION_API_KEY="your-key-here"
./install.sh --agent standalone
bughunter setup --provider fluxion --model openai/gpt-4o
bughunter hunt target.com

# Or one-off:
bughunter --provider fluxion --model openai/gpt-4o hunt target.com

---

Quick Start

Fastest - install from PyPI

pip install agentic-bug-hunter
bughunter setup                   # pick a free AI provider
bughunter recon target.com
bughunter hunt  target.com

Installs the bughunter and bughunter-agent commands. The AI hunting works out of the box; full recon also uses external CLIs (subfinder, httpx, nuclei, katana, ffuf, nmap). Get them with install_tools.sh from the repo, or your package manager. Output is written to ~/.bughunter/ (override with BUGHUNTER_HOME).

Option A - standalone (no subscription, works for everyone)

git clone https://github.com/Awarexone/Agentic-Bug-Hunter.git
cd Agentic-Bug-Hunter
./install.sh --agent standalone   # creates system-wide 'bughunter' command
bughunter setup                   # pick a free AI provider
bughunter recon target.com
bughunter hunt  target.com
bughunter validate "my finding"
bughunter report

Option B - Claude Code plugin (requires Claude Code)

git clone https://github.com/Awarexone/Agentic-Bug-Hunter.git
cd Agentic-Bug-Hunter
chmod +x install_tools.sh && ./install_tools.sh   # subfinder · httpx · nuclei · katana · ffuf
chmod +x install.sh      && ./install.sh          # skills + commands → ~/.claude/

claude
/recon target.com        # map the attack surface
/hunt target.com         # test for vulnerabilities
/validate                # run the 7-Question Gate
/report                  # write the submission

Option C - let Claude install it (Claude Code only)

Open your terminal, run claude, then paste:

Install the Claude Bug Bounty toolkit from https://github.com/Awarexone/Agentic-Bug-Hunter
into ~/tools/. Clone the repo, run ./install_tools.sh then ./install.sh.
Verify /recon /hunt /validate /report are available.

---

MCP

Use Agentic-Bug-Hunter from AI agents (Cursor, Claude Code, Codex, OpenCode).

AI Agent → Agentic-Bug-Hunter MCP → Scope → Recon → Hunt → Validate → Report

pip install 'mcp>=2.2.0'
./install.sh --agent mcp
bughunter mcp doctor
bughunter mcp serve

MCP is an adapter over the existing research engine — not a second scanner. Active tools require scope and explicit approval. See docs/mcp.md.

---

Commands

Core Workflow

Recon & Enumeration

Scanners (Web + LLM)

Smart Contract (Web3)

Session & Utility

---

What It Finds

---

AI Agents

Nine specialists, each built for one job:

---

How It Works

Every tool in the pipeline is gated on whether it’s installed - missing tools are skipped, not errors. Auth headers set once carry through httpx · katana · ffuf · nuclei · dalfox automatically.

---

Project Structure

---

Installation

Prerequisites:

# macOS
brew install go python3 jq

# Linux (Ubuntu/Debian)
sudo apt install golang python3 jq

Scanning tools (installs subfinder · httpx · nuclei · katana · ffuf · gau · dnsx · nmap · dalfox and more):

chmod +x install_tools.sh && ./install_tools.sh

Standalone bughunter command (no subscription, works without Claude Code):

./install.sh --agent standalone
bughunter setup    # choose Ollama (free) · Groq (free tier) · DeepSeek (cheap) · Claude · OpenAI

AI skills + commands into Claude Code:

chmod +x install.sh && ./install.sh

Other agent harnesses:

./install.sh --agent opencode    # OpenCode
./install.sh --agent pi          # Pi Agent
./install.sh --agent codex       # Codex
./install.sh --agent all         # every supported target

Optional: Chaos API key (better subdomain coverage)

export CHAOS_API_KEY="your-key"
echo 'export CHAOS_API_KEY="your-key"' >> ~/.zshrc

---

Rules

Seven rules run every session, no exceptions:

---

Contributing

PRs welcome. Most valuable:

• New scanner modules or detection techniques
• Payload additions to skills/security-arsenal/SKILL.md
• Methodology improvements backed by paid reports
• Platform support (YesWeHack · Synack · HackenProof)

git checkout -b feature/your-contribution
git commit -m "feat: short description"
git push origin feature/your-contribution

---

Used By

Teams and researchers running BugHunter in their workflow.

---

GitHub · Twitter · [email protected] · [email protected] Built by bug hunters, for bug hunters. MIT License · For authorized security testing only. Always test within an approved bug bounty program scope.

Powered by AwareXone.com

Website ·
X / Twitter ·
GitHub