Connect your agent to BugRater

BugRater runs an MCP server. Point Claude Code, Codex, Cursor, claude.ai or any MCP client at it, and your agent can choose programs on pay, crowding and response data, and check scope before it sends a request. Public data needs no account.

Public data

https://bugrater.com/mcp

As your account

https://bugrater.com/mcp/account

Add it to your client

Pick your client. Signing in adds your project logs, cards and Attack Surface data to what the agent can use.

claude mcp add --transport http bugrater https://bugrater.com/mcp

claude mcp add --transport http bugrater https://bugrater.com/mcp/account

[mcp_servers.bugrater]
url = "https://bugrater.com/mcp"

[mcp_servers.bugrater]
url = "https://bugrater.com/mcp"
bearer_token_env_var = "BUGRATER_TOKEN"

{
  "mcpServers": {
    "bugrater": { "url": "https://bugrater.com/mcp" }
  }
}

{
  "mcpServers": {
    "bugrater": { "url": "https://bugrater.com/mcp/account" }
  }
}

{
  "servers": {
    "bugrater": { "type": "http", "url": "https://bugrater.com/mcp" }
  }
}

{
  "servers": {
    "bugrater": { "type": "http", "url": "https://bugrater.com/mcp/account" }
  }
}

https://bugrater.com/mcp/account

https://bugrater.com/mcp/account

https://bugrater.com/mcp

Prefer a token to signing in? Create one in Settings, Agent access and send it as Authorization: Bearer bra_live_… to either URL.

Example scope check

This is check_scope answering for TransUnion LLC on HackerOne, computed just now from the scope BugRater imported on Oct 22, 2026. Only in scope means the agent can go ahead. Anything else should go to a person to check against the policy.

A wildcard covers subdomains but may not cover the apex domain, so the apex comes back unclear. An out-of-scope entry wins over a broader in-scope one. Contract addresses match the explorer links platforms list them as.

What your agent can ask

There are 27 tools. Answers carry their sources and dates, and say when a figure rests on too few reports to trust. Three prompts come with them: choose_target, program_dossier and pre_test_check. When you're signed in, each of your cards also appears as a prompt.

Access and limits

Without an account

You can use every public tool at 40 calls a minute per address, with no sign-up.

Signed in

120 calls a minute, and access to your project logs, cards and Attack Surface data. Attack Surface calls are billed to your existing API balance at the published prices. Everything else is free.

What a connection can't do

Change your settings, see your email or password, delete anything, or reach the admin API. Revoke a token or a connected app in Settings, Agent access and it stops working on the next call.

What BugRater sees

BugRater sees only the questions your agent asks, and never touches your targets. We log which tool was called and when, but not the arguments, so a scope check does not tell us what you are about to test. See the privacy policy and terms.

Where the data comes from

Reviews are BugRater's. Scope, payouts, intake and response targets are the platforms' own published figures, copied on the date each answer gives. The program's policy page is the authority.

Skill file and docs

A skill file

Install it in Claude Code, or any client that reads SKILL.md, so the agent knows when to use BugRater and to check scope first.

curl -fsSL https://bugrater.com/agents/skill.md --create-dirs -o ~/.claude/skills/bugrater/SKILL.md

Copy

For crawlers and tool builders

The developer docs cover the REST API, x402 pay-per-call and sign-in, and are also published as /openapi.json, /llms.txt and /llms-full.txt. Every program page also has a Markdown version. Add .md to its URL, or request text/markdown.