BountyForge: A Claude Code Skill That Fans Out Eight Security Agents

The Problem BountyForge Targets: One Hunter, Many Surfaces

A single bug bounty target rarely has one attack surface. A DeFi protocol ships Solidity contracts, an admin web console, a REST API, a subdomain estate and an oracle integration. Working all of those by hand means context switching between a fuzzer, a proxy, a chain explorer and a notes file, and the notes file is usually where the report quality dies. BountyForge is aimed at that gap. It is a skill for Claude Code, written in Python, that spins up eight specialized agents in parallel, each pointed at a different surface of the same target. The README names them: Web/API, Smart Contract, Access Control, Business Logic, Crypto/Math, Race Conditions, Economic Security and Recon. Each agent has a stated remit. The Access Control agent looks at role bypass, init hijack, confused deputy and proxy admin. The Economic Security agent looks at flash loans, oracle manipulation, inflation attacks and DeFi tokenomics. The intended user is a solo hunter or a small team that already works inside Claude Code and wants the triage and write-up steps compressed. The README's own framing is blunt about the alternative: 'AI slop gets you rate-limited; BountyForge gets you paid.' That is marketing copy, not a measured claim, and it should be read as such.

How the Eight Agents and the Report Pipeline Fit Together

The mechanism described in the README is a fan-out then a fan-in. Eight agents run in parallel against the target. Their findings are then deduplicated, passed through what the README calls gate-evaluated checks, scored with CVSS, and formatted into a report for one of five output formats: HackerOne, Bugcrowd, Intigriti, Immunefi or Generic. The deduplication and gating steps are the part that matters, because eight agents pointed at one codebase will produce overlapping hits, and a report that lists the same missing access control check five times is worse than a report that lists it once with a clear reproduction. The README does not spell out the gate logic for the skill itself. It points to release v3.1.0, which it says adds 'Al-Mizaan v3 deep validation gates, SIS-MD passive intelligence integration, agent isolation checks,' and refers readers to CHANGELOG.md for detail. That file is not in the supplied material, so the exact gate criteria cannot be confirmed here. What can be confirmed is the shape: parallel agents, a dedup and gate stage, CVSS scoring, then a format-specific template. Local tooling is a separate layer. When Claude Code execution is enabled, the skill can orchestrate CLI tools the README lists by name: nmap, ffuf, amass, sqlmap, gobuster, curl, httpx, wfuzz, zap and burpsuite. The skill does not ship those tools. It calls whatever is on PATH.

Installation: A Git Clone, a Skill Upload, and an Optional MCP

There are two install paths and they are not equivalent. For Claude Code in a terminal, the README gives one command: git clone https://github.com/Gabson0x/bountyforge.git ~/.claude/skills/bountyforge, followed by starting a fresh Claude Code session, because skills load at startup. For Claude.ai on web or app, you go to Customize then Skills, enable Code execution under Settings then Capabilities, and upload the .skill file from the Releases page. The second path is the one that matters if you want the local tooling layer, since the skill needs shell access to call nmap or sqlmap. There is an optional companion MCP server for Solidity scanning, added with: claude mcp add bug-bounty-intelligence -- npx -y bug-bounty-intelligence-mcp@latest. The same server can be declared in ~/.claude/settings.json under an mcpServers key with command npx and args ["-y", "bug-bounty-intelligence-mcp@latest"]. The README lists three MCP tools: scan_contract, which it says costs $5 USDC on Base to submit a public Solidity repo; get_scan_report, free, to poll status; and list_vulnerability_patterns, free, which the README describes as acceptance rates from 1,032 reconciled Sherlock findings. BountyForge is said to auto-detect the MCP and use list_vulnerability_patterns for pre-hunt bug-class prioritization. Note the cost model: the open-source skill is free to clone, but one of its optional integrations takes a payment on Base.

The Deepseek Environment Variables and What They Imply

The README documents a Deepseek Pro setup that redirects Claude Code's model endpoints. On macOS or Linux you export ANTHROPIC_BASE_URL=https://api.deepseek.com/anthropic, then ANTHROPIC_MODEL=deepseek-v4-pro, ANTHROPIC_DEFAULT_OPUS_MODEL=deepseek-v4-pro, ANTHROPIC_DEFAULT_SONNET_MODEL=deepseek-v4-pro, ANTHROPIC_DEFAULT_HAIKU_MODEL=deepseek-v4-flash, CLAUDE_CODE_SUBAGENT_MODEL=deepseek-v4-flash and CLAUDE_CODE_EFFORT_LEVEL=max, plus ANTHROPIC_AUTH_TOKEN with your token. Then you bind the repo with deepseek export --project . --key "$ANTHROPIC_AUTH_TOKEN" --mode pro and start Claude CLI from the same shell. This is worth pausing on. The skill is not tied to Anthropic's own models. It overrides the base URL so that the eight agents run on Deepseek, with the Haiku slot mapped to a flash model and the subagent model also set to flash. That is a deliberate cost choice: the parallel agents are the expensive part of the design, so the cheaper model handles subagent work while the pro model handles the main loop. The README's Windows instructions are truncated in the supplied material, ending mid-sentence at 'Use these variables in the'. Treat the Windows path as documented in intent but not verifiable here. The privacy implication is plain: if you use this setup, your target code and findings leave your machine for api.deepseek.com.

Where BountyForge Breaks Down

Three limitations stand out from the material. First, the licence is unknown. The repository metadata supplied lists no license identifier, and the README does not state one. For a tool that orchestrates nmap and sqlmap against live targets and gets installed into ~/.claude/skills, that is a real gap. You cannot tell whether you may redistribute it, bundle it into an internal platform, or use it at a company without a separate conversation. Second, the gate logic is referenced but not shown. The README says v3.1.0 added 'Al-Mizaan v3 deep validation gates' and points to CHANGELOG.md, which is not in the supplied material. Whether those gates reduce false positives, and how, cannot be checked from what is here. Third, the tool inherits every constraint of its environment. It calls local scanners; it does not ship them. If nmap is not on PATH, the Recon agent has less to work with. And the whole design assumes Claude Code with code execution enabled, which many managed deployments restrict. There is also a scope problem the README does not address: parallel automated testing against a live target is exactly the behaviour that program rules tend to restrict, and a deduplicated CVSS-scored report does not change what the traffic looks like from the target's side. Nothing in the material describes a rate limiter or a scope guard.

BountyForge Versus Slither Plus a Manual Review

The obvious alternative for the smart contract half of this tool is Slither, the static analyzer for Solidity, usually paired with a manual review and a fuzzing harness. The difference in approach is structural, not incremental. Slither parses the contract into an intermediate representation and runs a fixed set of detectors; its output is deterministic, reproducible and explainable line by line. BountyForge routes the contract through language models with a prompt that names bug classes, and its value is in the breadth of classes it will try and the report it writes at the end. Determinism is traded for coverage and for write-up speed. That trade is defensible for the classes in the README's table, especially the ones Slither does not model well, such as business logic abuse, state machine skips and economic attacks. It is a bad trade when you need a result you can defend to a triager who asks why the tool flagged a line. The parallel-agent design also means the same contract is read several times by different prompts, which is where the deduplication stage earns its place. If you already run Slither in CI, BountyForge does not replace it; the README positions the Al-Mizaan MCP as a companion scanner rather than a substitute.

Maintenance, Releases and the Hosted Split

The release history supplied shows v1.1.0 in May 2026 with Deepseek integration and expanded web vectors, v2.0.0 in July 2026 described as a Full Bug Bounty Engine, and v3.0.0 in August 2026 described as a Zero-Day Hunting Engine AI skill. The README then announces v3.1.0 with the Al-Mizaan gates. That is four releases in roughly four months, which tells you the interface is still moving. Anything you script against the skill's output format should be treated as unstable. There is also a split worth understanding before you commit: the README describes a hosted service at bountyforge.xyz that runs 'the same engine' in Firecracker microVMs, with the pipeline recon to hunt to triage to H1-ready report in a browser, and says hosted skill releases are managed from this repository. The repository you clone and the hosted product are not the same artifact, even if the engine is shared. The hosted version solves the environment problem, since you do not need nmap and sqlmap locally, and it charges for that. The self-hosted version keeps your target data on your own machine, which the Deepseek variable setup complicates. Licence terms for the hosted service are not stated in the supplied material.

Editorial conclusion

Adopt BountyForge if you already run Claude Code with code execution enabled on a machine where you are willing to put nmap, ffuf and sqlmap on PATH, and if your targets are in scope for automated testing. Do not adopt it if you need a licence you can read before shipping it inside a company, or if you expect the hosted pipeline at bountyforge.xyz to be the same artifact you cloned. Verify three things first: the LICENSE file, whether references/setup.md still matches the environment variables in the README, and whether the bug-bounty-intelligence MCP is a dependency you are willing to accept.

Official sources

1. Gabson0x/bountyforge on GitHub
2. Issues
3. README
4. Releases