AI agent tools for bug bounty
Short answer: Our top pick for bug bounty: Agentic-Bug-Hunter, with the highest AgentPick Score (70/100) among tools tagged "bug-bounty". Runners-up: h5i (69) and redamon (68). Compare what each does, its license and how recently it was updated below.
| # | Tool | What it does | Score | Stars | License | Updated |
|---|---|---|---|---|---|---|
| #1 | Agentic-Bug-Hunter | AI-powered bug bounty hunting toolkit that works with or without subscription. | 70/100 | ★ 5.3k | MIT | 9 Oct 2026 |
| #2 | h5i | An agent-native web security workspace. Find vulnerabilities through red-teaming. Formally verify properties of Rust codes in Lean 4. | 69/100 | ★ 777 | Apache-2.0 | 14 Oct 2026 |
| #3 | redamon | Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with hu… | 68/100 | ★ 3.1k | MIT | 14 Oct 2026 |
| #4 | xalgorix | Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript. | 68/100 | ★ 1.2k | Apache-2.0 | 12 Oct 2026 |
| #5 | Pentest-Swarm-AI | Autonomous penetration testing using a swarm of AI agents. Orchestrates recon, classification, exploitation, and reporting specialists with ReAct reas… | 67/100 | ★ 3k | AGPL-3.0 | 11 Oct 2026 |
| #6 | pentest-ai | Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay yourself. | 66/100 | ★ 1.7k | MIT | 9 Oct 2026 |
| #7 | open-kritt | Open-source, self-hosted AI vulnerability research tool that orchestrates agents to find and validate security issues in code. | 63/100 | ★ 2.3k | AGPL-3.0 | 12 Oct 2026 |
| #8 | Cybermes | Autonomous Offensive Security, Bug Bounty & Red Teaming Agent Framework powered by Hermes Agent, specialized reasoning skills, and multi-model LLM orc… | 60/100 | ★ 940 | Apache-2.0 | 2 Oct 2026 |
| #9 | Claude-BugHunter | A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 … | 59/100 | ★ 5.1k | MIT | 14 Oct 2026 |
| #10 | pentest-ai-agents | Turn Claude Code into your offensive security research assistant. Specialized AI subagents for authorized penetration testing plan engagements, analyz… | 55/100 | ★ 2.3k | MIT | 6 Oct 2026 |
| #11 | flounder | Autonomous white-hat security auditor for AI-driven code review, bug bounty research, exploit construction, and execution-grounded verification. | 54/100 | ★ 520 | AGPL-3.0 | 5 Oct 2026 |
| #12 | BugTraceAI | Open-source, self-hosted web pentesting suite with agentic scanning, analyst tools, API testing, model checkpoints and MCP integrations. | 53/100 | ★ 359 | Apache-2.0 | 14 Oct 2026 |
| #13 | BurpMCP-Ultra | AI-powered MCP server for Burp Suite Professional — 149 tools across proxy, scanner, inline fuzzer, race conditions, guided injection, JWT/IDOR attack… | 53/100 | ★ 272 | MIT | 28 Sept 2026 |
| #14 | cain-agent | Real-world AI penetration testing engineer for authorized assessments — built-in cloud module covering AWS/Azure/GCP + Aliyun/Tencent/Huawei clouds. B… | 49/100 | ★ 953 | Apache-2.0 | 14 Oct 2026 |
| #15 | blitzstrike | Blitz Strike — a universal MCP security-audit toolbelt. Reconnaissance at speed. Analysis in depth. Validation before report. | 45/100 | ★ 508 | MIT | 12 Oct 2026 |
| #16 | numasec | The AI Agent for Cyber Security. | 39/100 | ★ 810 | AGPL-3.0 | 8 May 2026 |
| #17 | h1-brain | MCP server that connects AI assistants to HackerOne for bug bounty hunting | 34/100 | ★ 358 | MIT | 13 Oct 2026 |
| #18 | pentest-agents | Bug bounty agent framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw — 48 agents, 26 commands, 19 CLI tools, 2 MCP serve… | 21/100 | ★ 1k | See repo | 12 Jun 2026 |
Source: each project's public GitHub repository (description, stars, license, last push). Listed tools aren't tested or ranked by AgentPick.
How to choose
- Grant the narrowest permissions the server allows.
- Check whether it runs locally or calls a remote service.
- Prefer servers listed in the official MCP registry.
Get the best new agent tools every week. Free, with a verdict on each. Get the weekly digest
Related
AI agent tools for local-first setups →
MCP servers
AI agent tools for knowledge graphs and bases →
MCP servers
AI agent tools for RAG (retrieval-augmented generation) →
MCP servers
AI agent tools for MCP client →
MCP servers
AI agent tools for cybersecurity →
MCP servers
AI agent tools for DevOps →
MCP servers
AgentPick Weekly
The week's new agent tools with a verdict on each, every week. Free. We'll email you a link to confirm, and you can unsubscribe any time. See our Privacy Policy.