bots.st/vulntel
vulntel
CVE and bounty intelligence for authorized testing
2609 ms
answered our call
- State
- Answered
- Protocol
- MCP 2025-06-18
- Tools listed
- 13
- Answered
- 3 of the last 3 calls
How to reach it
- MCP, HTTP
https://mcp.vulntel.com/mcp
What it can do
| Tool | What it says it does |
|---|---|
assist_submission | Submission & escalation co-pilot for a bug-bounty finding. Paste your DRAFT finding (and what you already tried / couldn't achieve) and get a grounded brief built from the closest REAL disclosed reports: (1) precedent & validity — is this an accepted class, with citable reports (ammunition if it… |
check_technology | Find vulnerabilities affecting a product across NVD (CPE) and OSV (package ecosystems), de-duplicated and ranked by priority/EPSS/CVSS. Distinct products that share a name are kept distinct. If one name maps to several VENDORS' unrelated products (e.g. "Sentry" → sentry, mobileiron, apache… |
corpus_stats | Corpus size and data freshness (CVE / KEV / EPSS counts and latest timestamps). |
enrich_cve | Full intelligence for a single CVE: CVSS, KEV status, EPSS, CISA SSVC (exploitation/automatable/technical_impact), P1-P4 priority with rationale, affected products/versions, Debian/Ubuntu/Alpine fixed builds per release (`distro_fixes`), and (live) public-exploit signal. Args: cve_id: e.g… |
find_attack_approaches | Find how bugs *like this* were actually FOUND — retrieve real disclosed bug-bounty report mechanic-cards whose approach is closest (by mechanism) to your query or a seed CVE. The "what approach worked on a bug like this, on which program, and what did it pay" layer: grounded in real… |
find_continuations | When you're STUCK mid-hunt: describe your POSITION — the attacker state/capabilities you hold, stripped of product names — and get the CONTINUATIONS that worked from positions like it, matched against the full disclosed-report BODIES (the concrete step/payload/precondition), not just the distilled… |
hunt_plan | Turn a recon'd stack into a ranked dig-order for authorized bug-hunting. For each discovered component, returns its top high-risk CVEs (KEV / CISA-SSVC- active / high-EPSS first) AND its `recurring_loci` — the bug classes (CWE) this product family repeatedly fails at, ranked by real in-the-wild… |
new_in_scope | Find FRESH attack surface: bounty-eligible assets that entered a public bug-bounty program's scope in the last `days` (HackerOne, Bugcrowd, Intigriti, YesWeHack, mirrored daily), the least-hunted surface there is. Raw scope additions are mostly not new (in one week 57 of 80 were re-added after a… |
observe | Scan a host's exposed stack and join it to the CVE corpus — the recon workhorse. Fingerprints the homepage + JS bundles (recovering the backend identity and API endpoints homepage detection misses on SPAs), then ranks against live KEV / SSVC-active / high-EPSS into a dig-order. Fetches only public… |
program_outcome_prior | At the START of an engagement on a bug-bounty PROGRAM, get a grounded prior over what bug classes have historically LANDED there — to decide what to look at first and what to skip. Built from real HackerOne disclosed reports: the class distribution for this program, each with LIFT over the global… |
search_public_code | Search public repositories for an exact code string; return WHERE it appears. Use it to hunt vendored / copy-pasted copies of known-vulnerable code: search a distinctive line or symbol from the vulnerable function, then FETCH AND READ the hits to judge which copies are still unpatched, reachable… |
search_vulns | Search the CVE corpus — one entry point, three retrieval modes picked from your arguments: - query= a concept / technique / weakness (e.g. "SSO SAML assertion replay", "deserialization gadget chain", "server-side request forgery cloud metadata"). By default it FUSES… |
verify_cve_claim | Fact-check a claim about a CVE against the corpus — catch hallucinations before they ship. Verifies: does the CVE exist; does it affect the claimed product at the claimed version; is the severity right; is it actually KEV-exploited. Returns per-assertion verdicts (supported / refuted… |
In its maker's words
Free hosted CVE intel for bug-bounty agents: CVE fact-check, attack approaches from paid H1 reports
- Website
- vulntel.com
- Source
- github.com/rozetyp/vulntel-mcp
- Publisher
- vulntel.com
- Listed from
- the official MCP Registry as
com.vulntel/mcp - Version
- 1.2.0, updated 3 Nov 2026
- Kinds of work
- Security and trust, Search and research, AI models and agent tools
The domain it lives on
- vulntel.com
- registered 14 Jul 2026 (4 months ago), at Cloudflare, Inc., its name does not resolve now
From our own crawl of domain names: registry records and the home page as our crawler last saw it.
Every call we made
| When | What happened | Time |
|---|---|---|
| Answered | 2609 ms | |
| Answered | 2326 ms | |
| Answered | 621 ms |
Next door
- paidforAssess an x402 seller before payment
- WhisperDNS-verifiable agent networking and control
- EchelonGraph CVE & ExposureCVE and internet exposure lookups
- RevClamp MCP ServerAudits payments, disputes, and VAT compliance
- APIEmpresas: Spanish company dataKYB checks using CIF, directors, sanctions, tenders, BORME
Is this your bot? Claim its address to add a verified badge and keep the listing current.