ASMHunter

Drive ASMHunter attack-surface monitoring from an AI agent: recon, scans, findings, reports.

Connector by asmhunter.appOfficial · Domain verified by the MCP Registry

IndexedLicense unknownLocal (stdio)

Chalk Labs

Need help deploying ASMHunter?

Chalk Labs sets up agents like this inside real teams: connected to your tools, tested on your data, with a human in the loop where it matters.

Book a call

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/asmhunter-app-asmhunter-mcp

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Drive ASMHunter attack-surface monitoring from an AI agent: recon, scans, findings, reports.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools: 17 read · 13 write · 3 delete · 1 not yet classified
Secrets: 1 (API keys, tokens or passwords)
Install scripts: None found
Runs as: Python package

Tools by what they do 34

Read from the source code; the running server may list different tools.

Read 17 · Look things up without changing anything.

get_findings
get_my_stats
get_program
get_scan_status
get_scope_changes
get_session
get_value_receipt
get_watchlist
list_assets
list_entries
list_reports
list_sessions

Show 5 more tools

list_targets
list_wins
list_workflows
recommend_programs
search_programs

Write 13 · Create, change, send or run things.

add_finding
add_lead
add_note
add_tested
add_win
bulk_add_entries
create_session
create_target
draft_report
trigger_scan
update_entry
update_report

Show 1 more tools

update_session

Delete 3 · Delete, drop, revoke or wipe things.

delete_entry
delete_report
delete_session

Not yet classified 1 · We could not tell from the name and description.

promote_entry

Secrets and settings it asks for

Secrets: values you paste in that let it act as you.

ASMHUNTER_TOKEN

Tools (34)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

add_finding
Log a confirmed finding (promote to a report later). method/url = request context; tags = labels; chain_id = link entries into one exploit chain; retest_at = ISO time to revisit.
add_lead
Log a lead (a promising-but-unconfirmed angle). method/tags/chain_id/retest_at supported.
add_note
Add a working note (recon synthesis, blockers, resume info). method/tags/chain_id/retest_at supported.
add_tested
Record a tested-and-clear surface so you don't retest it. method/tags/chain_id/retest_at supported.
add_win
Log a bounty win. Pass vulnerability_id/report_id/target_id to link it (sets surfaced_by_asmhunter when a product finding is referenced).
bulk_add_entries
Add many entries at once. Each: {type,title,body?,severity?,target_id?,url?}.
create_session
Start a hunt session (program-anchored or freeform). Auto-links the program's targets. Pass `goal` to state the objective for this session (e.g. "find IDOR in the billing API"). It is stored and returned by get_session, so you can keep the session focused on it.
create_target
Add a scan target (optionally linked to a program).
delete_entry
Delete an entry.
delete_report
Delete a report draft.
delete_session
Delete a session and its entries.
draft_report
Create a report draft (vuln_class one of: xss,idor,ssrf,sqli,ssti,xxe,csrf,oauth,default_credentials,info_disclosure,rce,open_redirect).
get_findings
Your vulnerability findings (filter by severity/search).
get_my_stats
Your hunt stats: sessions, entry breakdown, per-program activity.
get_program
Full program detail + scope. `program` is a program_id (UUID) OR a handle (e.g. 'shopify'). Pass `platform` to disambiguate a handle shared across platforms. (Find ids/handles via search_programs / recommend_programs.) The returned `assets` list contains BOTH in-scope and out-of-scope scope items (in-scope first); each asset carries an `in_scope` boolean — `in_scope: false` means the asset is explicitly OUT OF SCOPE (do not test or submit against it). Set `include_out_of_scope=False` for an in-scope-only list. Without this the API returns in-scope assets only, hiding the out-of-scope set enti…

Show 19 more tools

get_scan_status
Status of a scan run.
get_scope_changes
Recent scope additions/removals across tracked programs.
get_session
A session with all its entries + linked targets.
get_value_receipt
What ASMHunter surfaced for you (30d) + your logged-win totals. Use this to ground recommendations in the user's actual monitored surface.
get_watchlist
Your watched programs with full metrics (bounties, dupe, health, scope) + prior_sessions per program. Use to resume hunting on programs you track.
list_assets
Discovered assets/hosts (filter by target/search).
list_entries
List a session's entries (optionally one type).
list_reports
List your report drafts/submissions.
list_sessions
List your hunt sessions (filter by active/paused/completed).
list_targets
Your scan targets.
list_wins
List the user's logged bounty wins (private, self-reported).
list_workflows
Available scan workflows: each item has workflow_id + display_name + description + tier lock. Call this BEFORE trigger_scan to choose a valid workflow_id (e.g. recon, subdomain enumeration, vuln scan, JS secrets).
promote_entry
Promote a finding entry into a report draft. Returns {report_id}.
recommend_programs
Ranked program recommendations with reasons (opportunity, dupe, health, prior sessions).
search_programs
Search bug-bounty programs by name.
trigger_scan
Queue a real scan (pro+, consumes scan quota). Re-call with confirm=true to actually run it.
update_entry
Update an entry (close a lead, set severity, tag, schedule retest, link a chain).
update_report
Update a report draft (pass the fields to change).
update_session
Update a session (title/status/notes/goal/time).

Signals

Weekly downloads: 29
Last release: Jul 8, 2026 (3 months ago)
Last package publish: Jul 8, 2026 (3 months ago)

From the package registry.

Details

Registry name: app.asmhunter/asmhunter-mcp
Version: 0.1.2
Auth: API key
Packages: pypi asmhunter-mcp
License: License unknown
Website: asmhunter.app/docs.html
First seen: Oct 24, 2026
Last checked: Oct 25, 2026
Source: Official MCP Registry

Done for you

Rather not set it up yourself?

Chalk Labs scopes, builds and runs agents for your team: the task audit, the eval harness, the integrations and the weekly ops report. Fixed scope, priced before we start.

See how we build AI agents →Read the case studies

Chalk Labs is a two-founder AI and growth studio. We build AI agents, CRMs and MVPs for Web3 and AI companies, and have shipped 50+ product and token launches.

launches shipped: 50+; launches shipped
media placements: 500+; media placements
founders on every account: 2; founders on every account

Press we've placed: Forbes · CoinDesk · Decrypt · Cointelegraph · The Block

Rahil Jain, Co-founder, Chalk Labs. Ex-Goldman Sachs engineer. You talk to the person who builds it.

Get ASMHunter running in your business

Tell us what you want to automate. A founder replies within one working day with a plan, not a pitch deck.

Need help deploying ASMHunter?

Call Get help

Cite this page

ASMHunter MCP server. Agent Mart. https://agentmart.dev/connectors/asmhunter-app-asmhunter-mcp (last updated 2026-10-25)