Skip to content
actionlake
Start free

Connectors · Identity & security

HackerOne MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to HackerOne and the rest of your systems. It gives your agent 167 HackerOne actions (79 reads, 69 writes and 19 that wait for a confirmation) and holds the HackerOne credential itself, so the agent never does. It paces HackerOne's limits and records every call.

Connect HackerOne freeSee pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp
the first call
do {  action: "hackerone.reports.list",  intent: "check which HackerOne account is connected"}# Get All Reports · read · 1 upstream call
  • 167actionsin one signed file
  • 79readlook, never change
  • 69writecreate and update
  • 19wait for a yesdestructive, confirmed first

Set up

Connect HackerOne in three steps.

  1. 01

    Add actionlake to Claude.

    Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.

    https://connect.actionlake.com/mcp
  2. 02

    Connect HackerOne.

    Username and secret. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.

    • api_identifierHackerOne API username
    • api_tokenHackerOne API token value, shown once when the token is created (Customer API) or at…
    account { op: "connections.requirements", service: "hackerone" }
# free: exactly what to paste, and what is found for you
  3. 03

    Make the first call. Check before a write.

    Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

    do    { action: "hackerone.reports.list" }# get all reports · read · 1 upstream callcheck { action: "hackerone.groups.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

HackerOne at a glance

Sign-in
Username and secret. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
You provide
api_identifierapi_token
Limits we pace to
600 calls a minute, per connection
API covered
HackerOne API v1 (Customer API and Hacker API)api.hackerone.com/v1
Built from
HackerOne's documentation, read 23 October 2026api.hackerone.comapi.hackerone.com
Service file
Version 1.0.0, signed (Ed25519)
Cached reads
76 of 79 reads, for up to 5 minutes; a write clears what it affects
Shared entities
6, so ask can line HackerOne up with your other systems
Data
Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in HackerOne.

167 actions in 78 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

  • 79readlook, never change
  • 69writecreate and update
  • 19destructivewait for a confirmation

  1. Reports

    17

    2 read · 13 write · 2 destructive

    Get All Reports · Get Report · Create Report · Update Assignee

  2. Campaigns

    6

    2 read · 3 write · 1 destructive

    Create Campaign · Get All Campaigns · Get Campaign · Launch Campaign

  3. Credentials

    6

    1 read · 3 write · 2 destructive

    Create a Credential · Get Credentials · Assign a Credential · Update a Credential

  4. Hacker report intents

    6

    2 read · 3 write · 1 destructive

    Create Report Intent (Hacker API) · Get Report Intents (Hacker API) · Submit Report Intent (Hacker API) · Get Report Intent (Hacker API)

  5. Assets

    5

    2 read · 3 write · 0 destructive

    Get All Assets · Create Asset · Get Asset · Update Asset

  6. Workboard views

    5

    2 read · 2 write · 1 destructive

    Create View · Get All Views · Get View · Delete View

  7. Workboards

    5

    2 read · 2 write · 1 destructive

    Create Workboard · Get All Workboards · Get Workboard · Delete Workboard

  8. Automations

    4

    2 read · 2 write · 0 destructive

    Get All Automations · Create Automation · Get Automation · Update Automation

70 more areas · 113 actions
  • Credential inquiries 4
  • Groups 4
  • Members 4
  • Report retests 4
  • Scope exclusions 4
  • Asset ports 3
  • Asset scopes 3
  • Automation runs 3
  • Hacker reports 3
  • Programs 3
  • Activities 2
  • Allowed reporters 2
  • Asset reachability 2
  • Asset scanner 2
  • Asset tag categories 2
  • Asset tags 2
  • Bounty suggestions 2
  • Credential inquiry responses 2
  • Cve requests 2
  • Eligibility settings 2
  • Hacker invitations 2
  • Hacker programs 2
  • Hacker report intent attachments 2
  • Hai completions 2
  • Report disclosure requests 2
  • Report escalations 2
  • Swag 2
  • Users 2
  • Allowed reporter activities 1
  • Allowed reporters history 1
  • Analytics 1
  • Asset imports 1
  • Automation run logs 1
  • Bounty table 1
  • Common responses 1
  • Email 1
  • Hacker balance 1
  • Hacker earnings 1
  • Hacker hacktivity 1
  • Hacker payouts 1
  • Hacker scope exclusions 1
  • Hacker structured scopes 1
  • Hacker weaknesses 1
  • Inboxes 1
  • Integrations 1
  • Invitations 1
  • Organization audit log 1
  • Organizations 1
  • Pending invitations 1
  • Program audit log 1
  • Program balance 1
  • Program bounties 1
  • Program external notifications 1
  • Program members 1
  • Program policy 1
  • Program transactions 1
  • Report attachments 1
  • Report bounties 1
  • Report comments 1
  • Report custom field values 1
  • Report participants 1
  • Report summaries 1
  • Report swag 1
  • Reporters 1
  • Structured scopes 1
  • Team messages 1
  • Thanks 1
  • Triage reviews 1
  • Weaknesses 1
  • Workboard view reports 1

Top actions

The HackerOne API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 21 of HackerOne's 21 action names are shared with at least one other connector, so an agent learns them once.

ActionWhat it doesEffectSame name in
hackerone.members.listGet All MembersGet All Members.readidentity.user.list474 connectors
hackerone.groups.listGet All GroupsGet All Groups.readidentity.group.list262 connectors
hackerone.assets.listGet All AssetsGet All Assets.readasset.asset.list42 connectors
hackerone.groups.createCreate GroupCreate Group.writeidentity.group.create205 connectors
hackerone.members.getGet MemberGet Member.readidentity.user.get399 connectors
hackerone.assets.createCreate AssetCreate Asset.writeasset.asset.create27 connectors
hackerone.hacker_payouts.listGet Payouts (Hacker API)Get Payouts (Hacker API).readfinance.payout.list14 connectors
hackerone.automations.listGet All AutomationsGet All Automations.readautomation.workflow.list51 connectors
hackerone.automations.createCreate AutomationCreate Automation.writeautomation.workflow.create38 connectors
hackerone.reports.listGet All ReportsGet All Reports.readsecurity.vulnerability.list14 connectors
hackerone.automation_runs.listGet All Automation RunsGet All Automation Runs.readautomation.workflow_run.list27 connectors
hackerone.reports.redactRedact reportRedact report.destructivethis connector

Try it

Prompts to paste into Claude.

Each one names the HackerOne actions it will call, so you know what it reads and what it changes before you send it.

  1. Readread

    Which HackerOne tickets have been open the longest? Show me the ten oldest with their status.

    callshackerone.reports.list

  2. Writewrite

    Create Group in HackerOne. Show me exactly what you will send before you save it.

    callshackerone.groups.create

Governance for HackerOne

Destructive actions wait for a yes.

19 HackerOne actions are destructive. These are all of them:

  • Redact reporthackerone.reports.redact
  • Transfer Reporthackerone.reports.transfer
  • Remove Memberhackerone.members.remove
  • Delete Workboardhackerone.workboards.delete
  • Delete asset porthackerone.asset_ports.delete
  • Delete a Credentialhackerone.credentials.delete
  • Revoke a Credentialhackerone.credentials.revoke
  • Delete Viewhackerone.workboard_views.delete
  • Trigger Automationhackerone.automation_runs.trigger
  • Delete Scope Exclusionhackerone.scope_exclusions.delete
  • Remove Escalationhackerone.report_escalations.delete
  • Delete Credential Inquiryhackerone.credential_inquiries.delete
  • Delete Report Intent (Hacker API)hackerone.hacker_report_intents.delete
  • Delete Attachmentshackerone.report_attachments.delete_all
  • Delete Credential Inquiry Responsehackerone.credential_inquiry_responses.delete
  • Delete Report Intent Attachment (Hacker API)hackerone.hacker_report_intent_attachments.delete
  • Cancel Retesthackerone.report_retests.cancel
  • End Campaign Prematurelyhackerone.campaigns.end_prematurely
  • Cancel Disclosure Requesthackerone.report_disclosure_requests.cancel

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

dohackerone.members.removeconfirm_policy: human

Remove Member?

intent: the user asked me to remove Member

run suspended · waiting for a named person · key hackerone-agent cannot confirm itself
In the console, or from an emailed signed link.
a key for this connector
account {  op: "keys.create", name: "hackerone-agent",  allowed_actions: ["hackerone.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "hackerone.reports.redact", approver: "[email protected]" },    { match: "hackerone.reports.transfer", approver: "[email protected]" },    { match: "hackerone.members.remove", approver: "[email protected]" }  ]}
Illustrative. Scoped to HackerOne only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What HackerOne costs on actionlake.

Every HackerOne action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call HackerOne refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

  • 1upstream call per actionall 167 HackerOne actions
  • 167actions pageeach page of a long list is one call
  • 76reads can be cacheda cache hit costs nothing
  • 100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every HackerOne action.

167 actions by area: the id your agent calls, what it does, and its effect.

Reports17
  • hackerone.reports.assignUpdate Assigneewrite
  • hackerone.reports.change_stateChange Statewrite
  • hackerone.reports.close_commentsClose Commentswrite
  • hackerone.reports.createCreate Reportwrite
  • hackerone.reports.getGet Reportread
  • hackerone.reports.listGet All Reportsread
  • hackerone.reports.mark_ineligible_for_bountyMark as Ineligible for Bountywrite
  • hackerone.reports.redactRedact reportdestructive
  • hackerone.reports.transferTransfer Reportdestructive
  • hackerone.reports.update_cvesUpdate CVEswrite
  • hackerone.reports.update_inboxesUpdate inboxeswrite
  • hackerone.reports.update_referenceUpdate Referencewrite
  • hackerone.reports.update_severityUpdate Severitywrite
  • hackerone.reports.update_structured_scopeUpdate Structured Scopewrite
  • hackerone.reports.update_tagsUpdate Report Tagswrite
  • hackerone.reports.update_titleUpdate Titlewrite
  • hackerone.reports.update_weaknessUpdate Weaknesswrite
Campaigns6
  • hackerone.campaigns.createCreate Campaignwrite
  • hackerone.campaigns.end_prematurelyEnd Campaign Prematurelydestructive
  • hackerone.campaigns.getGet Campaignread
  • hackerone.campaigns.launchLaunch Campaignwrite
  • hackerone.campaigns.listGet All Campaignsread
  • hackerone.campaigns.updateUpdate Campaignwrite
Credentials6
  • hackerone.credentials.assignAssign a Credentialwrite
  • hackerone.credentials.createCreate a Credentialwrite
  • hackerone.credentials.deleteDelete a Credentialdestructive
  • hackerone.credentials.listGet Credentialsread
  • hackerone.credentials.revokeRevoke a Credentialdestructive
  • hackerone.credentials.updateUpdate a Credentialwrite
Hacker report intents6
  • hackerone.hacker_report_intents.createCreate Report Intent (Hacker API)write
  • hackerone.hacker_report_intents.deleteDelete Report Intent (Hacker API)destructive
  • hackerone.hacker_report_intents.getGet Report Intent (Hacker API)read
  • hackerone.hacker_report_intents.listGet Report Intents (Hacker API)read
  • hackerone.hacker_report_intents.submitSubmit Report Intent (Hacker API)write
  • hackerone.hacker_report_intents.updateUpdate Report Intent (Hacker API)write
Assets5
  • hackerone.assets.archiveArchive Assetswrite
  • hackerone.assets.createCreate Assetwrite
  • hackerone.assets.getGet Assetread
  • hackerone.assets.listGet All Assetsread
  • hackerone.assets.updateUpdate Assetwrite
Workboard views5
  • hackerone.workboard_views.createCreate Viewwrite
  • hackerone.workboard_views.deleteDelete Viewdestructive
  • hackerone.workboard_views.getGet Viewread
  • hackerone.workboard_views.listGet All Viewsread
  • hackerone.workboard_views.updateUpdate Viewwrite
Workboards5
  • hackerone.workboards.createCreate Workboardwrite
  • hackerone.workboards.deleteDelete Workboarddestructive
  • hackerone.workboards.getGet Workboardread
  • hackerone.workboards.listGet All Workboardsread
  • hackerone.workboards.updateUpdate Workboardwrite
Automations4
  • hackerone.automations.createCreate Automationwrite
  • hackerone.automations.getGet Automationread
  • hackerone.automations.listGet All Automationsread
  • hackerone.automations.updateUpdate Automationwrite
Credential inquiries4
  • hackerone.credential_inquiries.createCreate a Credential Inquirywrite
  • hackerone.credential_inquiries.deleteDelete Credential Inquirydestructive
  • hackerone.credential_inquiries.listGet Credential Inquiriesread
  • hackerone.credential_inquiries.updateUpdate Credential Inquirywrite
Groups4
  • hackerone.groups.createCreate Groupwrite
  • hackerone.groups.getGet Groupread
  • hackerone.groups.listGet All Groupsread
  • hackerone.groups.updateUpdate Groupwrite
Members4
  • hackerone.members.getGet Memberread
  • hackerone.members.listGet All Membersread
  • hackerone.members.removeRemove Memberdestructive
  • hackerone.members.updateUpdate Memberwrite
Report retests4
  • hackerone.report_retests.approveApprove Retestwrite
  • hackerone.report_retests.cancelCancel Retestdestructive
  • hackerone.report_retests.rejectReject Retestwrite
  • hackerone.report_retests.requestRequest Retestwrite
Scope exclusions4
  • hackerone.scope_exclusions.createCreate Scope Exclusionwrite
  • hackerone.scope_exclusions.deleteDelete Scope Exclusiondestructive
  • hackerone.scope_exclusions.listGet Scope Exclusionsread
  • hackerone.scope_exclusions.updateUpdate Scope Exclusionwrite
Asset ports3
  • hackerone.asset_ports.createCreate asset portwrite
  • hackerone.asset_ports.deleteDelete asset portdestructive
  • hackerone.asset_ports.listList asset portsread
Asset scopes3
  • hackerone.asset_scopes.archiveArchive asset scopeswrite
  • hackerone.asset_scopes.createAdd asset to scopewrite
  • hackerone.asset_scopes.updateUpdate asset scopewrite
Automation runs3
  • hackerone.automation_runs.getGet Automation Runread
  • hackerone.automation_runs.listGet All Automation Runsread
  • hackerone.automation_runs.triggerTrigger Automationdestructive
Hacker reports3
  • hackerone.hacker_reports.createCreate Report (Hacker API)write
  • hackerone.hacker_reports.getGet Report (Hacker API)read
  • hackerone.hacker_reports.listGet Reports (Hacker API)read
Programs3
  • hackerone.programs.getGet Programread
  • hackerone.programs.listGet All Programsread
  • hackerone.programs.list_mineGet Your Programsread
Activities2
  • hackerone.activities.getGet Activityread
  • hackerone.activities.queryQuery Activitiesread
Allowed reporters2
  • hackerone.allowed_reporters.listGet Allowed Reportersread
  • hackerone.allowed_reporters.username_historyGet Allowed Reporter username historyread
Asset reachability2
  • hackerone.asset_reachability.checkCheck Asset Reachabilitywrite
  • hackerone.asset_reachability.getGet Asset Reachability Statusread
Asset scanner2
  • hackerone.asset_scanner.getGet asset scanner configurationread
  • hackerone.asset_scanner.updateUpdate asset scanner configurationwrite
Asset tag categories2
  • hackerone.asset_tag_categories.createCreate Asset Tag Categorywrite
  • hackerone.asset_tag_categories.listGet All Asset Tag Categoriesread
Asset tags2
  • hackerone.asset_tags.createCreate Asset Tagwrite
  • hackerone.asset_tags.listGet All Asset Tagsread
Bounty suggestions2
  • hackerone.bounty_suggestions.createCreate bounty suggestionwrite
  • hackerone.bounty_suggestions.listList bounty suggestionsread
Credential inquiry responses2
  • hackerone.credential_inquiry_responses.deleteDelete Credential Inquiry Responsedestructive
  • hackerone.credential_inquiry_responses.listGet Credential Inquiry Responsesread
Cve requests2
  • hackerone.cve_requests.createCreate a CVE Requestwrite
  • hackerone.cve_requests.listGet all CVE Requestsread
Eligibility settings2
  • hackerone.eligibility_settings.getGet Eligibility Settingread
  • hackerone.eligibility_settings.listGet All Eligibility Settingsread
Hacker invitations2
  • hackerone.hacker_invitations.createInvite Hackers to Programwrite
  • hackerone.hacker_invitations.listGet Hacker Invitationsread
Hacker programs2
  • hackerone.hacker_programs.getGet Program (Hacker API)read
  • hackerone.hacker_programs.listGet Programs (Hacker API)read
Hacker report intent attachments2
  • hackerone.hacker_report_intent_attachments.deleteDelete Report Intent Attachment (Hacker API)destructive
  • hackerone.hacker_report_intent_attachments.listGet Report Intent Attachments (Hacker API)read
Hai completions2
  • hackerone.hai_completions.createCreate Completion (Preview)write
  • hackerone.hai_completions.getGet Completions (Preview)read
Report disclosure requests2
  • hackerone.report_disclosure_requests.cancelCancel Disclosure Requestdestructive
  • hackerone.report_disclosure_requests.createUpdate Disclosure Requestwrite
Report escalations2
  • hackerone.report_escalations.createEscalate Reportwrite
  • hackerone.report_escalations.deleteRemove Escalationdestructive
Swag2
  • hackerone.swag.listGet Awarded Swagread
  • hackerone.swag.mark_sentMark Swag as Sentwrite
Users2
  • hackerone.users.getGet Userread
  • hackerone.users.get_by_idGet User By IDread
Allowed reporter activities1
  • hackerone.allowed_reporter_activities.listGet Allowed Reporter Activitiesread
Allowed reporters history1
  • hackerone.allowed_reporters_history.listGet Allowed Reporters Historyread
Analytics1
  • hackerone.analytics.getGet Analytics Dataread
Asset imports1
  • hackerone.asset_imports.getRetrieve an assets importread
Automation run logs1
  • hackerone.automation_run_logs.listGet Automation Run Logsread
Bounty table1
  • hackerone.bounty_table.getGet Bounty Tableread
Common responses1
  • hackerone.common_responses.listGet Common Responsesread
Email1
  • hackerone.email.sendSend emailwrite
Hacker balance1
  • hackerone.hacker_balance.getGet Balance (Hacker API)read
Hacker earnings1
  • hackerone.hacker_earnings.listGet Earnings (Hacker API)read
Hacker hacktivity1
  • hackerone.hacker_hacktivity.listGet Hacktivity (Hacker API)read
Hacker payouts1
  • hackerone.hacker_payouts.listGet Payouts (Hacker API)read
Hacker scope exclusions1
  • hackerone.hacker_scope_exclusions.listGet Scope Exclusions (Hacker API)read
Hacker structured scopes1
  • hackerone.hacker_structured_scopes.listGet Structured Scopes (Hacker API)read
Hacker weaknesses1
  • hackerone.hacker_weaknesses.listGet Weaknesses (Hacker API)read
Inboxes1
  • hackerone.inboxes.listGet All Inboxesread
Integrations1
  • hackerone.integrations.listGet Integrationsread
Invitations1
  • hackerone.invitations.createCreate An Invitationwrite
Organization audit log1
  • hackerone.organization_audit_log.listGet Audit Logread
Organizations1
  • hackerone.organizations.list_mineGet Your Organizationsread
Pending invitations1
  • hackerone.pending_invitations.listGet Pending Invitationsread
Program audit log1
  • hackerone.program_audit_log.listGet Audit Logread
Program balance1
  • hackerone.program_balance.getGet Your Programs Balanceread
Program bounties1
  • hackerone.program_bounties.awardAward Bountywrite
Program external notifications1
  • hackerone.program_external_notifications.createNotify External Platformwrite
Program members1
  • hackerone.program_members.listGet Program Membersread
Program policy1
  • hackerone.program_policy.updateUpdate Policywrite
Program transactions1
  • hackerone.program_transactions.listGet Payment Transactionsread
Report attachments1
  • hackerone.report_attachments.delete_allDelete Attachmentsdestructive
Report bounties1
  • hackerone.report_bounties.awardAward Bountywrite
Report comments1
  • hackerone.report_comments.createCreate Commentwrite
Report custom field values1
  • hackerone.report_custom_field_values.updateManage Custom Field Valueswrite
Report participants1
  • hackerone.report_participants.addAdd participantwrite
Report summaries1
  • hackerone.report_summaries.createAdd Summarywrite
Report swag1
  • hackerone.report_swag.awardAward Swagwrite
Reporters1
  • hackerone.reporters.listGet Reportersread
Structured scopes1
  • hackerone.structured_scopes.listGet Structured Scopesread
Team messages1
  • hackerone.team_messages.sendSend Messages to Hackerswrite
Thanks1
  • hackerone.thanks.listGet Thanks to Hackersread
Triage reviews1
  • hackerone.triage_reviews.listGet Triage Reviewsread
Weaknesses1
  • hackerone.weaknesses.listGet Weaknessesread
Workboard view reports1
  • hackerone.workboard_view_reports.listGet View Reportsread

Questions

The HackerOne MCP server, answered.

Is there a HackerOne MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 167 HackerOne actions across reports, campaigns, credentials and hacker report intents, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by HackerOne.

What do I need to connect HackerOne?

HackerOne API username and HackerOne API token value, shown once when the token is created (Customer API) or at…. The free call account { op: "connections.requirements", service: "hackerone" } lists exactly what to paste.

Can an AI agent delete or change things in HackerOne?

Only if its key allows it, and only with an explicit confirmation. 19 HackerOne actions are destructive, including redact report, transfer Report and remove Member. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my HackerOne API limit?

actionlake paces every call to the limits in the HackerOne service file: 600 calls a minute per connection. Repeated reads are answered from cache (76 HackerOne actions can be), which never reaches HackerOne.

What does a HackerOne action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (167 HackerOne actions page). Cache hits, searches, dry runs and calls HackerOne refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which HackerOne API does it cover?

The HackerOne API v1 (Customer API and Hacker API) at api.hackerone.com/v1. It is built from HackerOne's documentation as read on 23 October 2026. 167 actions in 78 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my HackerOne data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your HackerOne credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

More connectors like HackerOne

Shares the most action names with

Joins with, on shared entities

Browse

actionlake is independent. It is not made or endorsed by HackerOne; the name is the vendor's own. Counts are from the HackerOne service file, version 1.0.0.

Give your agent HackerOne today.

Connect HackerOne freeSee pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.