#1212th of 19 in Security
agentic-bug-hunter
Bug bounty CLI that runs recon, hunting, validation and report writing with LLMs
- Stars
- 5.8k
- License
- MIT
- Last commit
- Oct 2026
- Last release
- Aug 2026
- Language
- Python
1,748 on 21 Apr 20265,806 on 10 Nov 2026
From GitHub's daily star counts.
Checked on GitHub.
Overview
Python CLI (`bughunter`) and Claude Code plugin that drives a bug bounty workflow: recon with external tools, LLM-guided testing for web and smart contract bug classes, a 7-Question validation gate, and report drafts for HackerOne, Bugcrowd, Intigriti and Immunefi. It works with Ollama, Groq, DeepSeek, Claude, OpenAI, OpenRouter, LiteLLM and others, and keeps hunt memory across sessions. An MCP server is also included.
Who it is for: Bug bounty hunters who want LLM-assisted recon, validation and reports
Strengths
- Supports Ollama for fully local runs, plus about ten cloud providers and gateways
- Covers recon, hunt, validate and report in one CLI, also as Claude Code slash commands
- Persistent hunt memory with resume via /pickup and a 10 MB rotated JSONL cap
- Ships an MCP server where active tools require scope and explicit approval
Weaknesses
- Full recon needs subfinder, httpx, nuclei, katana, ffuf and nmap installed separately
- No Docker or compose setup; installs via pip, uv or install.sh
- Output quality depends on the chosen model; local setup suggests a ~9 GB qwen2.5:14b
- README gives payout ranges and logos but no benchmarks of real findings
What it needs
- GPU optional
- Needs subfinder, httpx, nuclei, katana, ffuf, nmap, Ollama or a cloud LLM API key
- Models: Ollama, Groq, DeepSeek, Claude API, OpenAI
Quick answers
Is agentic-bug-hunter open source?
Yes. Its code is on GitHub under the MIT license.
Does agentic-bug-hunter need a GPU?
No. It runs on a CPU and can use a GPU when you have one.
Also in Security
See all 19| Rank | Project | Score |
|---|---|---|
| 1 | shannonAutonomous pentester that exploits web apps and APIs using source analysis | 91 out of 100 |
| 2 | ifixaiPython CLI that audits AI agents for policy, access and reliability failures | 87 out of 100 |
| 3 | StrixAutonomous AI pentesting agents that validate vulnerabilities with working exploits | 84 out of 100 |
| #4 | pentagiAutonomous multi-agent penetration testing system with sandboxed security tools | 77 out of 100 |
| #5 | ai-infra-guardRed-teaming platform for AI infra CVEs, MCP servers, agent skills and jailbreaks | 75 out of 100 |