ACTIVE2026Python · FastAPI · MCP

BountyHound

An autonomous bug bounty research pipeline: five security tools wrapped as job servers behind one MCP entry point, with a validation boundary that keeps an agent from reporting what it never verified.

Problem

An autonomous hunt has a failure mode worse than missing a bug: confidently reporting one that is not real. The pipeline had to make recon, testing, and reporting drivable by an agent while making it structurally hard to surface a finding that was never reproduced.

Architecture

Five tools (Nuclei, SQLMap, Nmap, Ffuf, Amass) run as FastAPI job servers, each behind one MCP entry point, with shared Pydantic models in a small core library. Work moves through an explicit running -> completed | cancelled | error state machine, and the discipline that matters is the boundary: no finding exists without a completed job behind it. The architecture is deliberately simple; the value is the validation gate, not the plumbing.

RE-TEST recon SCOPE MAP hypothesis SCORED QUEUE test JOBS validate GATE report H1 DRAFT NO FINDING WITHOUT A COMPLETED JOB NUCLEI SQLMAP NMAP FFUF AMAS JOB SERVERS
Five tools behind one MCP entry point

Outcome

A pipeline an agent can drive end to end, with the validation boundary doing the work that stops slop. The same finding-validation discipline is written up separately: Why resolved is not validated and Anatomy of an autonomous bug bounty pipeline.