Bug Bounty Intelligence

What Bug Bounty Intelligence MCP server does

Bug Bounty Intelligence provides AI-assisted security analysis for Solidity repositories and exposes selected benchmark data from Sherlock audit competitions. Agents can submit a repository for scanning, check whether the analysis has completed, retrieve the resulting report URL, and inspect vulnerability-pattern acceptance rates from reconciled contest results.

The scan is intended to produce security hypotheses for human review. Reports can contain up to 30 hypotheses, split between a higher-confidence group and an additional lower-confidence group. The service also reports how much of the repository’s in-scope code was read.

How it works

The scan_contract tool submits a repository to the remote analysis service. get_scan_report polls the scan and returns its status and report URL when available. A scan typically takes about 20 to 45 seconds according to the project’s measured results.

Before paying for a scan, the service offers a precheck endpoint that accepts a repository in owner/name form. It indicates whether the repository contains Solidity counted by the scan and gives a rough estimate of the amount that will be read. The scan prioritizes files considered more likely to affect funds and excludes tests, mocks, scripts, interfaces, vendored libraries, and other out-of-scope material. GitHub submodules are fetched when they point to GitHub.

The paid quick-scan endpoint costs 1 USDC on Base and returns the first 15 hypotheses. The full endpoint costs 5 USDC and adds 15 lower-confidence hypotheses. Both endpoints use x402 payment handling and signed offers; a completed paid response includes a signed receipt for the payment transaction.

Tools and capabilities

• scan_contract: Submit a repository for Solidity security analysis.
• get_scan_report: Poll scan progress and obtain the report URL.
• list_vulnerability_patterns: Display acceptance rates from exact-reconciled Sherlock contests.
• Use the free precheck to estimate scan coverage before payment.
• Review reports containing ranked hypotheses and an indication of code coverage.

The acceptance-rate dataset is released under CC0 and is based on Sherlock audit-competition results. Its counting rule uses a strict two-judge process, with public errata and result folders documenting the measurements.

Limitations and notes

The scan has not been shown to find the issues rewarded by human audit contests reliably. Published measurements found 8 of 105 known High and Medium findings in one eight-contest run, and 5 of 66 findings in nine newer Code4rena contests. In those tests, most known findings were missed, so output should be treated as review leads rather than verified vulnerabilities or audit conclusions.

The project’s comparisons also found no known findings from the tested contest sets using default Slither or Aderyn runs, but those comparisons were made by language-model judges and should not be read as a general ranking of tools. Older contests may also overlap with training data used by the scan’s model.

The full scan’s 5 USDC price exceeds the default 1-dollar-per-request limit used by the official x402 client unless that limit is raised. Payment receipts confirm that the service observed a transaction for a resource; they do not establish the quality or correctness of the security report.