漏洞赏金MCP服务器

# Build the Docker image
docker build -t bugbounty-mcp:latest .

# Run the container
docker run -d \
  --name bugbounty-mcp-server \
  -v $(pwd)/output:/app/output \
  -v $(pwd)/data:/app/data \
  -v $(pwd)/.env:/app/.env:ro \
  bugbounty-mcp:latest

# View logs
docker logs -f bugbounty-mcp-server

# Access container shell for debugging
docker exec -it bugbounty-mcp-server /bin/bash

# Stop and remove container
docker stop bugbounty-mcp-server
docker rm bugbounty-mcp-server

docker run -d \
  --name bugbounty-mcp-server \
  -e SHODAN_API_KEY="your_shodan_key" \
  -e VIRUSTOTAL_API_KEY="your_vt_key" \
  -e GITHUB_TOKEN="your_github_token" \
  -e LOG_LEVEL="INFO" \
  -v $(pwd)/output:/app/output \
  bugbounty-mcp:latest

# Start the server
docker-compose up -d

# View logs in real-time
docker-compose logs -f bugbounty-mcp

# Stop the server
docker-compose down

# Start the server
docker run -d \
  --name bugbounty-mcp \
  -v $(pwd)/output:/app/output \
  -v $(pwd)/.env:/app/.env:ro \
  bugbounty-mcp:latest

# Check server status
docker exec bugbounty-mcp bugbounty-mcp validate-config

# View available tools
docker exec bugbounty-mcp bugbounty-mcp list-tools

# Navigate to the project directory
cd bugbounty-mcp-server

# Start the MCP server
./run.sh serve

# List all available commands
./run.sh --help

# Start the MCP server
./run.sh serve

# List all 92+ available tools
./run.sh list-tools

# Validate configuration and tool availability
./run.sh validate-config

# Perform a quick security scan
./run.sh quick-scan --target example.com

# Download security wordlists
./run.sh download-wordlists --type subdomains

# Export configuration template
./run.sh export-config --format yaml
bugbounty-mcp export-config --format yaml -o config.yaml

{
  "mcpServers": {
    "bugbounty-mcp": {
      "command": "docker",
      "args": ["exec", "-i", "bugbounty-mcp-server", "bugbounty-mcp", "serve"],
      "env": {
        "DOCKER_HOST": "unix:///var/run/docker.sock"
      }
    }
  }
}

{
  "mcpServers": {
    "bugbounty-mcp": {
      "command": "/Users/your-username/Documents/bugbounty-mcp-server/run.sh",
      "args": ["serve"],
      "env": {
        "PATH": "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin"
      }
    }
  }
}

import asyncio
from mcp.client.session import ClientSession
from mcp.client.stdio import stdio_client

async def use_bugbounty_mcp():
    async with stdio_client(["./run.sh", "serve"]) as (read, write):
        async with ClientSession(read, write) as session:
            # Initialize the session
            await session.initialize()
            
            # List available tools
            tools = await session.list_tools()
            print(f"Available tools: {len(tools)}")
            
            # Call a tool
            result = await session.call_tool(
                "subdomain_enumeration",
                {"domain": "example.com", "passive_only": True}
            )
            print(result)

# Run the client
asyncio.run(use_bugbounty_mcp())

# Terminal 1: Start the MCP server
./run.sh serve

# Terminal 2: Test with any MCP client
# The server will be listening on stdio for MCP protocol messages

User: "Please perform a comprehensive security assessment of example.com"

LLM: I'll help you conduct a comprehensive security assessment using the BugBounty MCP tools. Let me start by gathering information about the target.

[The LLM will automatically use tools like:]
- subdomain_enumeration to find subdomains
- port_scanning to identify open services  
- vulnerability_scanning to detect security issues
- web_directory_scanning to find hidden files
- And 90+ other security tools as needed

# Build development image with debugging tools
docker build -t bugbounty-mcp:dev --target builder .

# Run with volume mounts for live development
docker run -it --rm \
  -v $(pwd):/app \
  -v $(pwd)/output:/app/output \
  bugbounty-mcp:dev bash

# Run specific tools
docker exec bugbounty-mcp nmap --version
docker exec bugbounty-mcp nuclei -version
docker exec bugbounty-mcp subfinder -version

# Run with increased resources
docker run -d \
  --name bugbounty-mcp \
  --cpus="2.0" \
  --memory="4g" \
  -v $(pwd)/output:/app/output \
  bugbounty-mcp:latest

# Monitor resource usage
docker stats bugbounty-mcp

# Create data volume backup
docker run --rm \
  -v bugbounty-data:/data \
  -v $(pwd)/backup:/backup \
  alpine tar czf /backup/data-backup-$(date +%Y%m%d).tar.gz -C /data .

# Restore data volume
docker run --rm \
  -v bugbounty-data:/data \
  -v $(pwd)/backup:/backup \
  alpine tar xzf /backup/data-backup-XXXXXXXX.tar.gz -C /data

# Make executable (first time only)
chmod +x docker.sh

# Build and run in one command
./docker.sh build && ./docker.sh run --api-keys

# Quick operations
./docker.sh logs --follow     # View live logs
./docker.sh shell            # Access container shell
./docker.sh validate         # Validate setup
./docker.sh restart --force  # Force restart
./docker.sh clean --force    # Clean everything

# Data management
./docker.sh backup           # Backup container data
./docker.sh restore backup/file.tar.gz  # Restore data

# Development
./docker.sh build --dev      # Build dev image
./docker.sh run --dev        # Run with source mounting

# bugbounty_mcp_config.yaml
api_keys:
  shodan: "your_shodan_api_key"
  virustotal: "your_virustotal_api_key"
  github: "your_github_token"

tools:
  nmap_path: "nmap"
  nuclei_path: "nuclei"
  max_concurrent_scans: 10
  default_timeout: 30

scanning:
  default_ports: ["21", "22", "23", "25", "53", "80", "443", "8080", "8443"]
  max_crawl_depth: 3
  max_pages_to_crawl: 100

output:
  output_dir: "output"
  report_format: "json"
  create_html_report: true

safety:
  safe_mode: true
  allowed_targets: ["*.example.com", "192.168.1.0/24"]
  blocked_targets: ["*.gov", "*.mil"]

"Perform subdomain enumeration for example.com using both passive and active methods"

"Check if example.com uses a CDN and try to find the origin server"

"Search GitHub for any repositories mentioning example.com that might contain sensitive information"

"Test the login form at https://example.com/login for SQL injection vulnerabilities"

"Scan https://example.com for XSS vulnerabilities in all input parameters"

"Check if https://example.com has any CORS misconfigurations"

"Perform a complete security assessment of example.com including:
- Subdomain discovery
- Port scanning
- Web application testing
- SSL/TLS analysis
- Generate a detailed report"

"Investigate the company Example Corp for:
- Employee information
- Technology stack
- Recent data breaches
- Social media presence"

tools:
  nmap_path: "/usr/local/bin/nmap"
  masscan_path: "/opt/masscan/bin/masscan"
  nuclei_path: "/home/user/go/bin/nuclei"
  # ... other tools

safety:
  safe_mode: true                    # Enable safety checks
  allowed_targets:                   # Whitelist of allowed targets
    - "*.example.com"
    - "192.168.1.0/24"
    - "10.0.0.0/8"
  blocked_targets:                   # Blacklist of forbidden targets
    - "*.gov"
    - "*.mil"
    - "*.edu"
  rate_limit_enabled: true          # Enable rate limiting
  requests_per_second: 10.0         # Request rate limit

bugbounty-mcp-server/
├── bugbounty_mcp_server/
│   ├── __init__.py
│   ├── server.py              # Main MCP server
│   ├── config.py              # Configuration management
│   ├── utils.py               # Utility functions
│   ├── cli.py                 # Command-line interface
│   └── tools/
│       ├── __init__.py
│       ├── base.py            # Base tool class
│       ├── recon.py           # Reconnaissance tools
│       ├── scanning.py        # Scanning tools
│       ├── vulnerability.py   # Vulnerability assessment
│       ├── webapp.py          # Web application tools
│       ├── network.py         # Network security tools
│       ├── osint.py           # OSINT tools
│       ├── exploitation.py    # Exploitation tools
│       └── reporting.py       # Reporting tools
├── wordlists/                 # Wordlists for scanning
├── output/                    # Scan results and reports
├── data/                      # Persistent data storage
├── pyproject.toml             # Project configuration
├── README.md                  # This file
├── LICENSE                    # MIT License
└── SECURITY.md               # Security guidelines