# BountyHunt

> BountyHunt tracks bug-bounty programs and audit competitions across Sherlock,
> Cantina, Immunefi, HackenProof, and Code4rena. It catalogs each program's
> in-scope assets (git repos, web targets, contracts) and watches them for
> activity: commits, pull requests, releases, tags, and scope changes.

Agents can query BountyHunt directly over MCP (streamable HTTP, OAuth sign-in):
`claude mcp add --transport http bountyhunt https://api.bountyhunt.xyz/mcp`

The public REST API needs no key for catalog reads:
GET https://api.bountyhunt.xyz/v1/programs, /v1/assets, /v1/events
(OpenAPI spec: https://api.bountyhunt.xyz/v1/openapi.json)

## Docs

- [Getting started](https://bountyhunt.xyz/docs/getting-started): what BountyHunt does and the free vs Pro plans
- [Webhooks](https://bountyhunt.xyz/docs/webhooks): signed, retried event deliveries to your endpoint
- [REST API](https://bountyhunt.xyz/docs/api): endpoints, auth, pagination, rate limits
- [Connect an agent](https://bountyhunt.xyz/docs/mcp): the MCP server, tools, and OAuth flow

## Catalog

- [Programs](https://bountyhunt.xyz/programs): every tracked bug-bounty program and audit competition, each with its in-scope assets

## Legal

- [Terms](https://bountyhunt.xyz/terms): BountyHunt is an independent aggregator of public information, not affiliated with the platforms it lists
- [Privacy](https://bountyhunt.xyz/privacy)