Skip to content
Agentmart
Submit a tool

Bug Bounty Intelligence

AI security scanner for Solidity + free CC0 dataset of Sherlock audit-competition acceptance rates.

Connector by holistis · GitHub account verified by the MCP Registry

IndexedMITRemote (HTTP)★ 8
Write a review

Install

Works with Claude Code, VS Code, Cursor, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install connector/holistis-bug-bounty-intelligence-mcp

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Remote endpoint

  • https://wazir-x402.duckdns.org/api/bug-intel Remote (HTTP)

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

AI security scanner for Solidity + free CC0 dataset of Sherlock audit-competition acceptance rates.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools
2 read · 0 write · 0 delete · 1 not yet classified
Secrets
None asked for
Install scripts
Nothing to install (hosted)
Runs as
Hosted (remote endpoint)

Tools by what they do 3

Read from the source code; the running server may list different tools.

Read 2 · Look things up without changing anything.

  • get_scan_report
  • list_vulnerability_patterns

Not yet classified 1 · We could not tell from the name and description.

  • scan_contract

Network hosts it talks to 19

  • api.cerebras.ai · found in code
  • api.groq.com · found in code
  • api.mistral.ai · found in code
  • api.sambanova.ai · found in code
  • api.telegram.org · found in code
  • api.together.xyz · found in code
  • blog.alphaventuredao.io · found in code
  • decrypt.co · found in code
  • docs.google.com · found in code
  • eips.ethereum.org · found in code
  • etherscan.io · found in code
  • github.com · found in code
  • glama.ai · found in code
  • openrouter.ai · found in code
  • raw.githubusercontent.com · found in code
  • sherlock-files.ams3.digitaloceanspaces.com · found in code
  • tokenizen.nl · found in code
  • wazir-x402.duckdns.org · found in remote endpoint, install command
  • x402.tokenizen.nl · found in code

Files it touches

  • Your home directory (~)

Tools (3)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • get_scan_report

    Poll the status of a job_id returned by scan_contract. Call this every few minutes after submitting. Reports usually arrive within the hour; polling faster just re-checks a job that is still processing. Returns status (queued/processing/complete/failed), the repo under scan, and once complete the reportUrl (the report of hypotheses, with the share of code that was read), the outcome and the coverage. A failed job says why and where to write for a new attempt or a refund. A 404 means the job_id does not exist — double-check what scan_contract actually returned rather than retrying blindly.

  • list_vulnerability_patterns

    Returns historical vulnerability patterns and acceptance rates from Sherlock audit-competition findings. Numbers are limited to contests where results could be exactly reconciled against Sherlock's own published outcomes (1,032 findings across 10 contests) — no estimated or unverifiable figures. Useful for understanding what types of bugs are most likely to be valid in a given protocol type. This tool is FREE — no payment required.

  • scan_contract

    Submit a public GitHub repository for an automated Solidity analysis. The result is a list of AI-generated hypotheses to review by hand. It is not an audit and not a list of confirmed bugs. The scan reads the files most likely to move funds first, in at most six parts. Tests, mocks, scripts, interfaces and vendored dependencies are left out. The report states what share of the in-scope code was actually read, and a report can say that no hypotheses came out of the part that was read. Check the repository first, for free: GET https://x402.tokenizen.nl/api/bug-intel/precheck?repo=owner/name says…

Compare and alternatives

    Featured in

    Signals

    Stars
    8
    Forks
    2
    Open issues
    4
    Last commit
    Oct 24, 2026 (4 days ago)
    Last release
    Jul 29, 2026 (3 months ago)

    From GitHub (fetched Oct 24, 2026).

    Details

    Registry name
    io.github.holistis/bug-bounty-intelligence-mcp
    Version
    1.0.3
    Auth
    Auth not stated
    License
    MIT
    Repository
    github.com/holistis/bug-bounty-intelligence-mcp
    Website
    github.com/holistis/bug-bounty-intelligence-mcp
    First seen
    Oct 24, 2026
    Last checked
    Oct 24, 2026
    Source
    Official MCP Registrygithub-graphql

    More from holistis

    Cite this page

    Bug Bounty Intelligence MCP server. Agent Mart. https://agentmart.dev/connectors/holistis-bug-bounty-intelligence-mcp (last updated 2026-10-24)