Bug Bounty Hunter

You can turn Gemini Antigravity into a skilled Bug Bounty MCP server that orchestrates 50+ security tools for autonomous reconnaissance, vulnerability scanning, and exploitation analysis directly from your chat interface. This setup enables rapid, coordinated security assessment within your Gemini environment, using familiar commands to trigger comprehensive investigations.

How to use

You interact with the Bug Bounty MCP server through your MCP client inside Gemini Antigravity. Start a recon mission by asking for a full or partial assessment, specify a target, or request specific vulnerability checks. The server will run the configured toolchain to perform subdomain discovery, port and HTTP probing, content discovery, and vulnerability scanning, then return a structured report of findings.

Practical usage patterns include initiating broad reconnaissance, targeting critical assets, performing cloud-focused checks, and validating authentication and API security. You can mix capabilities, for example: request a full reconnaissance on a domain, then drill into potential XSS or SQLi findings, and finally audit a related cloud storage bucket for exposure.

How to install

Prerequisites you need on your system include Python 3.10 or newer, Go for external tooling like subfinder and nuclei, and Git.

Step 1: Clone the project repository and set up a Python virtual environment.

# Clone the repository
git clone https://github.com/MauricioDuarte100/BugBountyMCP.git
cd BugBountyMCP

# Create a virtual environment (Crucial for isolation)
python3 -m venv bb_venv
source bb_venv/bin/activate

# Install Python dependencies
pip install -e .

Step 2: Install external tools using the provided installer script.

# Make the install script executable
chmod +x install.sh

# Run the installer
./install.sh

If you prefer manual setup, you can review and follow manual instructions listed in INSTALL.md, then complete the installation steps accordingly.

Step 3: Configure Gemini Antigravity to access the MCP server using the recommended method.

{
  "mcpServers": {
    "bugbounty": {
      "command": "/bin/bash",
      "args": [
        "-c",
        "source /path/to/BugBountyMCP/bb_venv/bin/activate && python /path/to/BugBountyMCP/bug_bounty_mcp.py"
      ],
      "env": {
        "PYTHONUNBUFFERED": "1"
      },
      "disabled": false,
      "autoUpgrade": true
    }
  }
}

Important: Replace "/path/to/BugBountyMCP" with the absolute path to your cloned directory.

Step 4: Verify installation by listing active MCP servers in your Gemini session. You should see the bugbounty server listed.

/mcp list

The Arsenal (Capabilities)

Your Gemini environment is equipped with a diverse toolkit organized into reconnaissance, spidering, vulnerability scanning, and authentication/API analysis. Each capability is designed to operate from the chat interface, returning actionable results.

Usage Examples

Full Recon Mission

You: Run a full reconnaissance on example.com. Gemini: Starts subdomain enumeration, port scanning, and probing.

Specific Vulnerability Scan

You: Check https://target.com for XSS vulnerabilities. Gemini: Deploys XSS scanner and reports findings.

Cloud Audit

You: Scan this S3 bucket my-bucket for public access. Gemini: Checks ACLs and content.

Security and responsible use

Follow authorized testing practices and adhere to the scope and engagement rules whenever you perform security assessments using this MCP server. Use only against targets you have explicit permission to test.

Contributing

Join the hunt by contributing security-focused improvements or new capabilities. Your collaboration helps strengthen the ecosystem and expands the range of supported assessments.

Note

Built for the Gemini Antigravity community. Happy hunting.

Available tools

Reconnaissance

Subdomain enumeration, port scanning, HTTP probing, DNS/CT checks

Spidering

Deep crawling, JS analysis, hidden files discovery

Vulnerability Scanning

Template-based scanning, injection testing, access control checks, cloud security audits

Authentication & API

Auth testing, API security assessment, GraphQL/Swagger inspection