The standalone entrypoint is bughunter (engine.py). There is no bughunter help subcommand. With no subcommand, the CLI prints argparse help plus a short command list. Use bughunter --help for the full parser help. Global flags (before the subcommand):

​
Commands

​
setup / init

Configure and persist provider and model in ~/.bughunter/config.json.
--provider choices for non-interactive setup: ollama, groq, deepseek, claude, openai, grok, openrouter, orcarouter.

​
providers

List providers and API key status.

​
models

List models for the active provider and show the selected one.

​
status

Show hunt pipeline status.

​
chat / ask

Interactive AI hunting shell.

​
recon

Map the attack surface for a target domain or IP.

​
hunt

Run the full hunt pipeline. --quick runs fewer checks.

​
validate

Run the 7-Question Gate on a finding (argument or stdin).

​
triage

Fast triage (pass / kill / downgrade). Alias path for validation-style checks.

​
report

Write a submission-ready report.

​
chain

Build an A→B→C exploit chain from a bug description or findings directory.

​
mcp

MCP server, doctor, and tool catalog. See MCP.
Default subcommand when you run bughunter mcp alone is serve.

​
Alias summary