BountyRadar MCP

What BountyRadar MCP does

BountyRadar MCP MCP server acts as a selection and alerting layer for public software bounties rather than a marketplace. It gathers bounty records from Opire, BountyHub, ClawHunt, Algora, GitHub, and validated security programs, then makes them available to agents through MCP. Records are ranked using agent solvability, freshness, competition, and reward-related signals.

The service is intended for target selection. It does not hold funds, perform KYC, or settle bounty payments. Its catalog keeps issues that identify an actual bounty through a stated monetary reward or a bounty label, while unfunded “good first issues” are excluded.

How it works

BountyRadar MCP MCP server exposes a ranked feed and supporting query tools. Feed requests can filter by category, minimum reward, maximum competition, source, freshness, estimated agent solvability, and honeypot inclusion. Search checks bounty titles, descriptions, tags, and repository information.

Scoring is deterministic and explainable. Freshness declines with item age, competition declines as more attempts are recorded, and reward contributes a capped logarithmic value. Agent solvability can come from an existing field or be derived from task type. A language model may assist with task classification during catalog refresh, but it does not determine the final score.

Bounties marked as honeypots are omitted from the default feed. Callers can explicitly include them when needed. The subscription tool stores a filter profile and returns a polling descriptor; an optional webhook URL is echoed but never called.

Setup and configuration

The hosted service is available as a Streamable HTTP MCP endpoint at https://neeenja--bountyradar-mcp.apify.actor/mcp. Clients connect with an Apify bearer token. The hosted version uses pay-per-event billing: initialization and tool discovery are free, while selected feed, search, scoring, statistics, and subscription calls are charged according to the published pricing table.

For local use, clone the MIT-licensed repository and run the Node 22 stdio server with:

node src/server.mjs

A client can launch it with node and the src/server.mjs argument. Local or self-hosted use is free. The repository also documents an Apify deployment path, but live catalog refresh requires platform keys and, where configured, LLM credentials. The optional live catalog merge is enabled with BR_INCLUDE_LIVE=1.

Tools and capabilities

BountyRadar MCP MCP server provides these tools:

• get_bounty_feed returns ranked, filtered subscriber-feed results.
• search_bounties searches by keyword across bounty text, tags, and repositories.
• get_bounty_detail returns a complete record and score breakdown by ID.
• score_bounty returns the raw explainable score for one bounty.
• list_sources reports registered sources and their statuses, including live, curated, and partner_candidate.
• get_stats returns counts grouped by source, category, and reward band.
• subscribe_feed saves a filter profile in server memory and returns a poll descriptor.

The server also exposes the bountyradar://feed/latest, bountyradar://stats, and bountyradar://sources resources, plus a daily_bounty_brief prompt. Use this MCP server when an agent needs a structured shortlist before spending compute on implementation attempts.

Limitations and notes

The hosted endpoint is not a bounty marketplace and does not submit work, manage payouts, or settle transactions. Subscription state is held only in server memory. Webhook URLs are not invoked. ClawHunt is listed as a partner candidate and is not scraped by the included refresh process. Some sources require their own platform credentials for refresh. The local server is read-only and stateless, and optional classification may send public bounty text to a configured LLM endpoint.