Bounty Copilot

An AI driven, authorized bug bounty toolkit. A browser extension and a Burp extension feed a local agent, the brain, that runs the whole flow from capture to a submission ready report.

Authorized testing only. A hard scope floor gates every active request, destructive and denial of service actions are blocked, and traffic is identified rather than anonymised. You are responsible for testing only the assets you are permitted to test.

What it is

Bounty Copilot turns scattered manual testing into one guided workflow. You capture traffic in your browser or in Burp, and a local agent takes it from there. It runs scope gated active probing, IDOR and blind vulnerability detection, AI assisted triage, exploit chain synthesis, CVSS scoring, proof of concept drafting, and a clean report bundle ready to submit to a program.

Everything runs locally on 127.0.0.1. Nothing is sent to a third party cloud, and your findings stay on your own machine.

How it works

browser extension or Burp
        │
        ▼
   local agent (the brain)
        │
   scope floor  ──►  probes and out of band checks  ──►  triage
        │
   exploit chain synthesis  ──►  CVSS, PoC, report, submission bundle

Two editions

AI edition. The brain uses your logged in Claude Code session, so there is no API key to manage. You get deep analysis, chain discovery, smart prioritisation, and AI written reports.

Offline edition. A local rules brain with no AI, while the full deterministic toolchain still runs. Start it with ./run-offline.sh.

Safety first

This is a dual use offensive tool, and it is built to keep you inside the rules of engagement.

• Default deny scope engine. Out of scope always wins. Wildcards never match the apex, and CIDR, port, and path rules are all honoured.
• Every active request passes through a single audited choke point. Anything out of scope returns a 403 and is logged.
• Destructive and denial of service actions are blocked by design.
• The launcher runs a scope self test on startup and refuses to run if it fails.

Quick start

./run.sh            # AI edition (Claude Code logged in), or ./run-offline.sh
# note the printed local token, then:
#   Browser: chrome://extensions  ->  Load unpacked  ->  browser-ext/   (paste token in the popup)
#   Burp:    Extensions  ->  Add  ->  Java  ->  build with burp-ext/build.sh
./package.sh        # build dist/ (chrome and firefox zips, burp jar, agent)

Data lives in ~/.bounty-copilot/ (db.sqlite, token, evidence/), with directory mode 0700.

Layout

agent/         the brain. FastAPI on 127.0.0.1:8717 (scope floor, probes, OOB, AI, output)
browser-ext/   MV3 extension for Chrome and Firefox. capture, JS and secret mining, DOM sink mining
burp-ext/      Montoya Java extension. passive checks plus agent gated active probing
docs/          design specs, ARCHITECTURE.md, and agent/playbooks/

See ARCHITECTURE.md for the full design.

Support

If Bounty Copilot saves you time, you can support the work and help keep it moving.

☕ Buy me a coffee: https://www.buymeacoffee.com/archnexus707

📧 Reach me directly: archnexus707@gmail.com

Every coffee genuinely helps, and it is appreciated.

Author

Built by Dickson Godwin Massawe (archnexus707).

License

Licensed under the MIT License. See LICENSE. Use it only for authorized security testing.