# BugRater

> Bug bounty and vulnerability disclosure programs, rated by the researchers who work them, with the platforms' own published data: payouts by severity, response targets, 90-day intake, structured scope, launches and accepted findings.

Agents should use the MCP server (no account needed for public data) and must call check_scope before testing any asset.

## For agents

- [MCP server](https://bugrater.com/mcp): Streamable HTTP endpoint; public tools need no account
- [Connect your agent](https://bugrater.com/agents): setup for Claude Code, Codex, Cursor, VS Code, claude.ai, ChatGPT
- [Agent skill](https://bugrater.com/agents/skill.md): SKILL.md that teaches the scope-first workflow
- [Full reference](https://bugrater.com/llms-full.txt): every endpoint and MCP tool, inline

## Docs

- [Developer reference](https://bugrater.com/docs.md): REST endpoints, auth, x402, limits
- [OpenAPI](https://bugrater.com/openapi.json): OpenAPI 3.1 description of the REST API

## Data

- [Program pages](https://bugrater.com/programs): every program; append .md to a program URL for Markdown
- [Hunting brief](https://bugrater.com/brief.md): what launched, paid and moved this week
- [Crowding](https://bugrater.com/crowding.md): reports per in-scope asset over 90 days
- [Security releases](https://bugrater.com/releases): vendor advisories and CVE credits

## Optional

- [Terms](https://bugrater.com/terms)
- [Privacy](https://bugrater.com/privacy)
- [About](https://bugrater.com/about)