Cyber Bug Bounty Agent
Autonomous security-research pipeline: eight Claude agents across two LangGraph state graphs.
- Python
- MIT
What it does
A multi-agent system that runs the whole bug-bounty loop without a human in the middle. One graph handles intake — research the target, write the outreach, wait for permission. A second graph runs after approval: recon, scan, aggregate and validate the findings, generate the report, deliver it. A permission watcher polls for the reply that moves a target from the first graph to the second.
- Good for
- Running the full bug-bounty loop — research, permission, recon, scan, report, deliver — with no human in the middle.
How it works
Two LangGraph state graphs and a permission watcher, coordinated by one supervisor. Intake runs on the start command and stops at waiting; the scan graph runs only once permission comes back.
┌─────────────────────────────────────────────────────────────────────┐
│ SUPERVISOR (Orchestrator) │
│ Builds & runs two LangGraph StateGraphs + watcher │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ INTAKE GRAPH (start command) SCAN GRAPH (after approval) │
│ ┌──────────────────────┐ ┌──────────────────────────┐ │
│ │ START │ │ START │ │
│ │ ↓ │ │ ↓ │ │
│ │ ResearcherAgent │ │ ReconAgent │ │
│ │ ↓ │ │ ↓ │ │
│ │ OutreachAgent │ │ ScannerAgent │ │
│ │ ↓ │ │ ↓ │ │
│ │ END (status=waiting) │ │ AggregatorAgent (Opus) │ │
│ └──────────────────────┘ │ ↓ │ │
│ │ ReporterAgent │ │
│ PERMISSION WATCHER (watch command) │ ↓ │ │
│ ┌──────────────────────┐ │ DeliveryAgent │ │
│ │ Poll IMAP every N min│ │ ↓ │ │
│ │ ↓ │ │ END (status=delivered) │ │
│ │ ClassifierAgent │ └──────────────────────────┘ │
│ │ ↓ │ │
│ │ Route: granted → │ │
│ │ approve / auto-scan│ │
│ └──────────────────────┘ │
└─────────────────────────────────────────────────────────────────────┘Reference
| Agent | Model | Purpose |
|---|---|---|
| ResearcherAgent | Claude Sonnet | OSINT gathering + company profiling |
| OutreachAgent | Claude Sonnet | Personalised email generation |
| ClassifierAgent | Claude Haiku | Reply classification (granted / denied / ambiguous) |
| ReconAgent | Claude Sonnet | Attack-surface analysis from recon tool output |
| ScannerAgent | — | Orchestrates the vulnerability scanning tools |
| AggregatorAgent | Claude Opus | Deduplicates, validates and CVSS-enriches all findings |
| ReporterAgent | — | Generates the PDF report via ReportLab |
| DeliveryAgent | Claude Sonnet | Writes the delivery cover note |
| Module | Purpose |
|---|---|
| TokenAwareClient | Wraps every Anthropic API call with cost tracking, retry logic and network resilience |
| StageManager | RAM-aware sequential execution with GC, monitoring and emergency process kill |
| NetworkManager | Detects connectivity drops, waits for VPN restoration, retries operations |
| DatabaseManager | SQLite persistence — WAL mode, connection-per-call, parameterised queries |
| Notifier | ntfy.sh push notifications for every pipeline event |
| EmailSender | SMTP via Resend, which avoids Cloudflare blocking on VPN IPs |
| IMAPReceiver | Gmail IMAP polling for permission replies, via ImprovMX forwarding |
Built with
- Python
- LangGraph
- Claude API
- Multi-agent
- Security
- SQLite
Where to get it
This page covers how it is built. For what it does, why it exists and what it found, read the Cyber Agent case study.