Scope to Bounty ★

Category: MCP Server Runtime: Python 3.10+

Summary

Stop copying scope tables by hand. The Rifteo Context MCP server gives your AI agent live access to bug bounty program scope directly from the platform — in-scope assets, out-of-scope exclusions, bounty eligibility, and policy — before a single test is run.

Fetches live scope from HackerOne, Intigriti, YesWeHack, Bugcrowd, and Immunefi
Searches publicly disclosed HackerOne reports by vulnerability type, technology, or keyword
Loads Rifteo security contexts (L1 overview or L2 full methodology) on demand
Registers automatically with Claude Code, Cursor, Windsurf, Gemini CLI, and 7 other agents

Installation

pip install rifteo-context-mcp

Register with your agent

Auto-install — detects all installed agents:

rifteo-context install

Single agent:

rifteo-context install --agent claude-code
rifteo-context install --agent cursor
rifteo-context install --agent gemini-cli

Project-level only:

rifteo-context install --agent claude-code --project

Supported agents:

Agent	Config location
`claude-code`	`~/.claude.json`
`cursor`	`~/.cursor/mcp.json`
`windsurf`	`~/.codeium/windsurf/mcp_config.json`
`gemini-cli`	`~/.gemini/settings.json`
`cline`	`~/.cline/data/settings/cline_mcp_settings.json`
`kiro`	`~/.kiro/settings/mcp.json`
`codex`	`~/.codex/config.toml`
`opencode`	`~/.config/opencode/opencode.json`
`amp`	`~/.config/amp/settings.json`
`continue`	`~/.continue/config.json`

MCP Tools

Bug Bounty Platforms

Tool	What it does
`get_program_scope`	Fetch live scope for any bug bounty program — in-scope, out-of-scope, bounty eligibility, policy
`search_hacktivity`	Search publicly disclosed HackerOne reports by vulnerability type, tech, or keyword

Once registered, ask your agent:

get the scope for hackerone program "github"
get the scope for yeswehack program "datadome-bot-bounty"
search hacktivity for GraphQL vulnerabilities
search hacktivity for SSRF in cloud environments

Platform support:

Platform	Scope	Auth required
`hackerone`	Full scope + policy	Yes — username + API token
`intigriti`	Full scope	Yes — API token
`yeswehack`	Full scope	No
`bugcrowd`	Partial (public HTML)	No
`immunefi`	Direct link	No

Security Contexts

Tool	What it does
`list_contexts`	List all available Rifteo contexts with one-line summaries
`get_context`	Load a context by name — L1 overview or L2 full methodology
`search_contexts`	Search contexts by keyword

Each context has two levels:

L1 — Overview and when to use (default, lightweight)
L2 — Full detailed methodology

Ask your agent:

list all available security contexts
get the web-app-pentest context
load cloud-audit full methodology
search contexts for jwt

Authentication

HackerOne — get your token at hackerone.com/settings/api_token/edit

rifteo-context auth hackerone
# HackerOne username: yourname
# HackerOne API token: ****

Intigriti — get your token at app.intigriti.com/settings/api

rifteo-context auth intigriti
# Intigriti API token: ****

YesWeHack and search_hacktivity work without credentials. Manage connected platforms:

rifteo-context auth --list
rifteo-context auth --remove hackerone

Web App Pentest

Full web application penetration test methodology

Code Audit

Source code security review methodology

Cloud Audit

AWS, GCP, and Azure security audit methodology

Overview

Community

Top toolkits

Scope to Bounty ★

Summary

Installation

Register with your agent

MCP Tools

Bug Bounty Platforms

Security Contexts

Authentication

Web App Pentest

Code Audit

Cloud Audit

​Summary

​Installation

​Register with your agent

​MCP Tools

​Bug Bounty Platforms

​Security Contexts

​Authentication

​Related contexts

Web App Pentest

Code Audit

Cloud Audit

Summary

Installation

Register with your agent

MCP Tools

Bug Bounty Platforms

Security Contexts

Authentication

Related contexts