Agentic-Bug-Hunter: Open Source AI Security & Privacy

What is Agentic-Bug-Hunter?

What it is

Agentic-Bug-Hunter is a Python MIT-licensed AI security toolkit in the AI & Machine Learning / AI Security & Privacy category. It lives in bug bounty and penetration-testing workflows, and it can run as a Claude Code plugin or as a standalone bughunter command. Maintained by AwareXone, it targets recon, vulnerability testing, validation, and report writing.

The project solves a concrete problem in bug bounty hunting: manual work is split across target mapping, vulnerability testing, finding validation, and report drafting. It addresses that split by letting a user point the tool at a target, run recon, hunt, validate, and report from one terminal. It also says it remembers patterns across targets and resumes sessions where they left off.

Key capabilities

Runs as a standalone CLI named bughunter, with commands for setup, recon, hunt, validate, report, chat, providers, models, and status.
Supports aliases h, r, and v for hunt, recon, and validate.
Validates findings through a 7-Question Gate before report generation.
Writes submission-ready reports for HackerOne, Bugcrowd, Intigriti, or Immunefi.
Uses free-first AI provider selection, including local Ollama, Groq free tier, and DeepSeek cheap models.
Preserves provider configuration in ~/.bughunter/config.json during installer refresh and uninstall.
Can integrate with Claude Code when the user chooses that mode.

Who uses it and how

Bug bounty hunters use it from a terminal to map an attack surface with bughunter recon target.com.
Security engineers use it to hunt vulnerabilities with bughunter hunt target.com and validate findings before submission.
Users with privacy constraints use Ollama locally, with ollama pull qwen2.5:14b and no cloud dependency.
Users with cloud access use Groq or DeepSeek after obtaining API keys or selecting a provider.
Claude Code users use it as a plugin inside that coding agent.

Getting started

Install by cloning the repository, entering the directory, and running ./install.sh --agent standalone; rerun after pulling updates to refresh the managed command. Start with bughunter setup, then run commands such as bughunter recon target.com, bughunter hunt target.com, bughunter validate "finding", and bughunter report.

When to use it — and when not to

Use it when you want an open-source Python toolkit that can operate without Claude Pro or a paid AI subscription, especially for local Ollama use or free cloud tiers. It is not a managed hosted service, so self-hosters must install the CLI, configure providers, maintain API keys, and run local models if they want offline use. The facts show it depends on an AI provider for interactive and automated tasks, and its workflow ends in a submission-ready report rather than a hosted bounty service.

project readme (upstream, from github) — read inline

AI-powered bug bounty hunting - recon to report, in your terminal.
Free Setup · Quick Start · Commands · What It Finds · Install · Support · FAQ

Built and maintained by AwareXone · Website · X · GitHub

Trusted By Engineers At

Where this project's stargazers say they work.

_{Compiled from public GitHub profiles of this repository's stargazers -
43 people across 30 organizations, counted from the employer
each person lists on their own profile or from their public organization
memberships. No individual accounts are named. These companies have not
endorsed or sponsored this project; their logos are shown as trademarks of
their respective owners.}

Support This Project

If BugHunter helps your hunts, you can fuel more of them — every contribution helps build more open-source security tools.

Crypto Donations

	Address
Bitcoin (BTC)	`1GXwGqmLcnbZWgVNskUAZyw2cmqenkUFNY`
Solana (SOL)	`4ArkPu1E7tkrt3d5X84grWzF1xjuLpScgGEy12Bp2cmE`

Sponsorship

We're open to sponsors. Sponsoring funds new features and keeps the standalone mode free for everyone, and gets your logo and a link right here in the README, plus a credit in every release.

Want to sponsor? Reach out at AwareXone.com or [email protected].

AwareXone

BugHunter is built and maintained by AwareXone. Beyond open-source tools like this one, AwareXone builds AI-driven defenses against scams, fraud, and social engineering, and offers social engineering defense and human risk consultancy for organizations. If that's something your team needs, get in touch.

What Is This?

Agentic Bug Hunter finds real, reportable bugs, not theoretical ones. Point it at a target and it runs recon, tests for vulnerabilities, validates findings against a strict gate, and writes a submission-ready report for HackerOne, Bugcrowd, Intigriti, or Immunefi.

It remembers everything: patterns found on one target inform the next, and sessions pick up where they left off.

Works as a Claude Code plugin, or as a fully standalone CLI (bughunter) with no subscription required.

Standalone Mode: No Subscription Required

You no longer need Claude Code, Claude Pro, or any paid AI subscription.

Install once, use the bughunter command from any terminal on your machine:

git clone https://github.com/Awarexone/Agentic-Bug-Hunter.git
cd Agentic-Bug-Hunter
./install.sh --agent standalone

Rerun the same command after pulling updates. The installer detects and refreshes the active managed bughunter command, including older installations under /usr/local/bin or ~/.local/bin, while preserving your saved provider configuration in ~/.bughunter/config.json.

To uninstall the standalone command while keeping its configuration:

./uninstall.sh --agent s

Frequently asked questions

Is Agentic-Bug-Hunter free to use?

Agentic-Bug-Hunter is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does Agentic-Bug-Hunter do?

AI-powered bug bounty hunting toolkit that works with or without subscription.

What is Agentic-Bug-Hunter written in?

Agentic-Bug-Hunter is primarily written in Python. Its source is publicly available at https://github.com/Awarexone/Agentic-Bug-Hunter, and it has 4,898 GitHub stars.