Architecture

Pipeline

You → recon → hunt → validate → report
         │               │
         ▼               ▼
   Hunt memory     7-Question Gate

Stage	CLI	Role
Recon	`bughunter recon`	Subdomain enum, live hosts, URL crawl, surface mapping
Hunt	`bughunter hunt` / `--quick`	Vulnerability testing against recon output
Validate	`bughunter validate` / `triage`	Kill weak findings before report writing
Report	`bughunter report`	Draft submission-ready write-ups
Chain	`bughunter chain`	Extend bug A into B/C exploit paths
Memory	session + pattern store	Techniques and context carry across hunts

MCP exposes the same stages as tools (see MCP):

AI Agent
   ↓
Agentic-Bug-Hunter MCP
   ↓
Scope → Recon → Hunt → Validate → Report → Memory

MCP is an adapter over the research engine — not a second scanner.

Path	Role
`engine.py`	Standalone `bughunter` CLI
`brain.py`	Multi-provider LLM layer
`tools/`	Recon, hunt, validate, scanners
`skills/`	Methodology and class knowledge
`commands/`	Slash commands for agent harnesses
`agents/`	Specialist agent prompts
`memory/`	Cross-session hunt memory
`mcp/bughunter-mcp/`	Native MCP server
`mcp/hackerone-mcp/`	Public HackerOne helpers
`mcp/burp-mcp-client/` · `caido-mcp-client/`	Third-party proxy MCP config

Missing external tools are skipped, not treated as fatal errors
Auth headers set once can carry through httpx, katana, ffuf, nuclei, dalfox when configured
Active MCP tools require an allowlisted scope and approval
Discovered hosts are not automatically authorized
Report tools draft locally — they do not auto-submit