Claude Code moonlights as a bug bounty hunter

What it does A Claude Code plugin that turns Anthropic’s terminal AI into a bug bounty partner. It adds 23 slash commands—/recon, /hunt, /validate, /report, /autopilot—that orchestrate external scanners like nuclei, httpx, and katana through a persistent memory layer. The tool maps targets, tests 20 web2 and 10 web3 vulnerability classes, validates findings through a “7-Question Gate,” and drafts platform-specific reports for HackerOne or Bugcrowd.

The interesting bit The memory system persists hunt state across sessions in JSONL files, so patterns from yesterday’s target inform today’s hunt and you can /pickup exactly where you left off. It also reads live proxy traffic via Burp/Caido MCP and carries authentication sessions across the entire recon pipeline—details that usually require manual scripting.

Key highlights

• 23 slash commands covering recon, hunting, validation, reporting, and Web3 contract audits
• Persistent hunt-memory JSONL files with a 10 MB cap and automatic rotation
• Auth-aware pipeline: set a session once and httpx, katana, ffuf, and nuclei all inherit it
• Integrates with Burp Suite and Caido via MCP to read live browser traffic
• Generates submission-ready reports with CVSS 3.1 scores for HackerOne, Bugcrowd, Intigriti, and Immunefi
• Can run standalone Python scripts if you don’t use Claude Code

Caveats

• Requires a paid Claude Pro/Max plan or Anthropic API credits; the free web tier won’t work
• The recon toolkit is largely thin wrappers around existing Go/Python security tools, so you’re still installing and trusting subfinder, nuclei, etc.

Verdict Worth a look if you’re already paying for Claude Code and want to automate the bug bounty treadmill. Skip it if you expect novel exploits—this orchestrates known techniques and existing scanners rather than inventing new ones.