Spec Driven Development
by formulahendry
MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.
Runs on your computer★ 440MITUpdated 14 months ago
Install
Bounty Operator
Overview
Description from the maker (original English)
Argues against a security finding or a draft bug bounty report before you submit it.
PopNx MCP’s three pillars
These three are never merged into one score: opinions, measurements and popularity are different things.
- User voiceiNo reviews yetReviews open together with accounts in a later step
- Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
- UsageiNot measured yet★ –
What you can do with it
We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.
- Connection: Runs in the cloud
- Transport: Streamable HTTP
- Category: Other
- You need to fill in: Authorization, X-Provider-Key
Install
Pick the AI app you use, then copy the settings.
Before you install
- Basic checks: 1 of 1 passed
- Runs on the maker’s server: what you ask it goes through their server.
- You fill in yourself:
Authorization,X-Provider-Key
Values marked secret are keys to your account. Never share them or paste them into a chat.
You need
- Runs in the cloudNothing to install; it connects over the internet
Which app do you use?
Pick your app above. We remember it, so next time the button says “Install in …”.
This address needs a key in a request header, which the add-connector menu cannot set. Use Claude Code, Cursor or VS Code instead.
Run this in your terminal
claude mcp add --transport http bounty-operator https://bountyoperator.com/api/mcp --header 'Authorization: Bearer {token}' --header 'X-Provider-Key: your-value'Fill in the empty values before running it.
Or copy the settings yourself
Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json
{
"mcpServers": {
"bounty-operator": {
"url": "https://bountyoperator.com/api/mcp",
"headers": {
"Authorization": "Bearer {token}",
"X-Provider-Key": "your-value"
}
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
Or copy the settings yourself
Paste into .vscode/mcp.json in your project
{
"servers": {
"bounty-operator": {
"type": "http",
"url": "https://bountyoperator.com/api/mcp",
"headers": {
"Authorization": "Bearer {token}",
"X-Provider-Key": "your-value"
}
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
This address needs a key in a request header, which the add-connector menu cannot set. Use Claude Code, Cursor or VS Code instead.
Your choice stays on this device in a cookie; no account needed.
Values you fill in
Authorizationsecret HTTP headerConnection token from the account panel at bountyoperator.com. The account and run_review tools use it; every other tool works with none.X-Provider-Keysecret HTTP headerAPI key of the model provider that run_review calls.
These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.
What it can do
We have not read this server’s tool list yet; we check endpoints in rotation.
Basic checksi
We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 6, 2026
- ✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account bountyoperator, which owns the repo
- … Not checked yet
Still maintained
We have not read this repo from GitHub yet
- … Not checked yet
Has a licence
We have not read this repo from GitHub yet
- … Not checked yet
Endpoint responds
Not checked yet; we check endpoints in rotation
- … Not checked yet
Sign-in with OAuth
Not checked yet; we check endpoints in rotation
- … Not checked yet
No hidden instructions in tool descriptions
Not checked yet; we read the tool list when we check the endpoint
Compared with others in Otheri
- More stars than 0% of the other 32484 servers in this category
- Published to the registry more recently than 63% of the other 32484 servers in this category
- Basic checks equal to or better than 100% of the other 32484 servers in this category
Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.
Common questions
Is Bounty Operator safe?
It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.
What keys or codes does it need?
You need to fill in: Authorization, X-Provider-Key
Does it run on my computer or in the cloud?
It runs in the maker’s cloud. Connect over the internet with nothing to install, but what you send passes through the maker’s servers.
Is it still maintained?
The GitHub repo last changed –, and the latest version (0.9.18) reached the registry 22 days ago.
Which apps can use it?
Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.
What can I use instead?
In the same category: Spec Driven Development, Remote Desktop Commander, Recta
Alternatives
Servers in the same category from other makers, sorted by stars.
Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi
Remote Desktop Commander
by desktop-commander
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
Runs in the cloud★ 211Updated yesterday
Install
Recta
by RectaBuild
Cheaper cross-chain stablecoin routes for AI agents; 5 % of the verified saving, nothing if none.
Computer or cloudUpdated today
Install
README from the maker
Open the README
Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.
Bounty Operator MCP
Make your strongest case before you submit.
Check your proof, make the impact explicit, and catch missing evidence before the triager has to ask.
This is the MCP server for Bounty Operator. Your agent names the files, the server scans them for secrets and returns the review request, your agent's own model writes the review, and the server checks every cited line and builds the evidence packet. Preparing a review and building the packet need no account and no key.
That route covers the three core profiles. Every other profile, and seven of the eight gauntlet stages, runs as a hosted review on the Bounty Operator service with your own provider key.
Install
Two routes. Both work today.
Remote endpoint
Nothing to install. One line per client.
Claude Code
claude mcp add --transport http bounty-operator https://bountyoperator.com/api/mcpCodex
codex mcp add bounty-operator --url https://bountyoperator.com/api/mcpCursor, in ~/.cursor/mcp.json or .cursor/mcp.json in a project:
{ "mcpServers": { "bounty-operator": { "url": "https://bountyoperator.com/api/mcp" } } }Local server
This package. It reads files by path, keeps review preparation on your machine and adds run_gauntlet_plan. Node 22 or later, no dependencies. npx installs it from the tarball the site serves.
Claude Code
claude mcp add --transport stdio bounty-operator -- npx -y https://bountyoperator.com/dl/bounty-operator-mcp.tgzCodex
codex mcp add bounty-operator -- npx -y https://bountyoperator.com/dl/bounty-operator-mcp.tgzCursor, in ~/.cursor/mcp.json or .cursor/mcp.json in a project:
{ "mcpServers": { "bounty-operator": { "command": "npx", "args": ["-y", "https://bountyoperator.com/dl/bounty-operator-mcp.tgz"] } } }Any other client: command npx, arguments -y https://bountyoperator.com/dl/bounty-operator-mcp.tgz, transport stdio.
On Windows outside WSL, Claude Code starts npx through cmd: end the command with -- cmd /c npx -y https://bountyoperator.com/dl/bounty-operator-mcp.tgz.
The package is coming to npm as bounty-operator-mcp. Until it is published, the tarball URL above is the install.
A first request to try:
Use bounty-operator to prepare a Solidity review of src/Vault.sol. Answer the request it returns, then build the packet.Tools
| Tool | Call it | It returns | Needs |
|---|---|---|---|
list_profiles | When you do not know which review fits | The review profiles, each with hosted true or false, the gauntlet order, the verdicts, the providers and models | Nothing |
prepare_review | Before reviewing code or a draft report with your own model | For a core profile: SHA-256 manifest, privacy findings, reviewer instructions, output format, the request to answer | Nothing |
run_gauntlet_plan | For the full pre-submission run | The eight stages in order with the tool that runs each, the Context fields still empty, the call that ends the run | Nothing |
build_packet | After writing the review | Verdict, reference check, the Markdown evidence packet | Nothing |
account | Before a hosted review | Plan, reviews used today, reset time | Token |
run_review | To run a review on a provider's model | The review, its verdict, the reference check, the remaining allowance | Token and provider key |
Six tools here, five on the remote endpoint: run_gauntlet_plan is local only.
Limits per call: 50 files, 120 KB per file, 240 KB and 20,000 lines in total.
Core and hosted profiles
prepare_review takes the three core profiles: general (Code security review), solidity (Solidity review) and report (Challenge a draft report). Their method is in this package and your agent's own model answers the request.
Every other profile is hosted: scope, provenance, prior-art, poc, severity, triage, report-edit and scanner. Each runs on the Bounty Operator service through run_review, on your own provider key. The method of a hosted profile is added on the service. It is not in this package and no tool returns it.
For a hosted profile:
list_profilesreturns it withhosted: true.prepare_reviewfails with the codehosted_profilebefore any file is read.run_reviewruns it and uses one hosted review. A review the provider blocks under its usage policy is not counted. The two profiles no list shows,verdictandpanel, are the last step of the gauntlet and of a panel review: they run on Operator only.
{"profile": "triage", "error": "Triager simulation runs on the server. Call run_review with profile \"triage\": it needs BOUNTY_OPERATOR_TOKEN and the provider key in this server's environment.", "code": "hosted_profile" }
Files by path
prepare_review and run_review take paths, files, or both.
pathsare read by the server from its working directory:["report.md", "src/Vault.sol"]. The agent does not have to send the file text.filescarry the text inline:[{ "name": "src/Vault.sol", "content": "..." }].
A path resolves under the working directory and nowhere else. The server refuses .., an absolute path outside the directory, and a link that leaves it. File contents go to the review and are never returned: a result holds the label, size, line count and SHA-256 of each file.
A client that starts the server outside your project sets BOUNTY_OPERATOR_ROOT to the project folder.
The privacy check
Every call scans the files first. A secret blocks the call and the result lists file, line and kind of each match, never the matched text. An email or IP address stops the call until you repeat it with acknowledgeWarnings: true. run_review runs this check on your machine before anything is sent.
Prompts
Three prompts, listed by clients that support them as slash commands:
| Prompt | What it does |
|---|---|
challenge-report | Checks every claim in a draft report against the code it cites, then builds the packet |
solidity-review | Maps entry points and invariants in the contracts you name |
gauntlet | Takes a finding through the eight stages in order and ends with one verdict |
In Claude Code: /mcp__bounty-operator__gauntlet.
The gauntlet
Eight stages, in the order that ends a weak report early: scope, provenance, prior art, proof, severity, triager, report, verdict. run_gauntlet_plan returns the plan and names the tool that runs each stage. Seven stages are hosted and run through run_review, so the run needs a connection token and a provider key. The report stage is a core profile: prepare_review returns its request and your agent's own model answers it. Each review is passed forward as stage- - .md, and the run ends with build_packet. The verdict is one of submit, rewrite-then-submit, prove-first, hold-duplicate, drop.
A run uses seven hosted reviews. Free covers one hosted review per UTC day, so a full run takes Operator. The plan carries the count under hosted, and account returns the allowance before the run starts.
Hosted reviews
run_review runs any profile on a provider's model with your own API key and returns the review checked. It is the only way to run a hosted profile from an agent. It uses the same allowance as the website: one hosted review per UTC day on Free, any profile, and unlimited on Operator at US$10 per month.
Three result fields say when the text is not a review. truncated is true when the provider cut the answer short. refused is true when the model or the provider declined. blocked is set when the review was blocked: anthropic-cyber, anthropic-reasoning or openai-cyber for that provider's safeguards, guardrail for a guardrail on the key or its account, policy for any other block under a usage policy. A blocked review is never counted. After a refusal or a block, do not call again with the same model: use another model or provider, or prepare_review for a core profile.
- Sign in at bountyoperator.com and create a connection in the account panel. The token starts with
bok_and is shown once. - Start the server with the token and one provider key in its environment.
claude mcp add --transport stdio --env BOUNTY_OPERATOR_TOKEN=bok_... --env OPENROUTER_API_KEY=sk-or-... bounty-operator -- npx -y https://bountyoperator.com/dl/bounty-operator-mcp.tgzCodex, in ~/.codex/config.toml:
[mcp_servers.bounty-operator]command = "npx" args = ["-y", "https://bountyoperator.com/dl/bounty-operator-mcp.tgz"] env_vars = ["BOUNTY_OPERATOR_TOKEN", "OPENROUTER_API_KEY"] tool_timeout_sec = 1200
A hosted review ends within 270 seconds. On a Bounty Operator model it runs for up to 15 minutes: the first request after a quiet spell can wait up to 10 minutes for the model to start, and the progress message says so while it does. Codex stops a tool call after 60 seconds by default, so keep the tool_timeout_sec line.
The token and the key are read from the environment. Neither is a tool argument, and both are removed from every result.
The remote endpoint takes the same two values as headers: Authorization: Bearer and X-Provider-Key: . The commands for each client are at bountyoperator.com/mcp.
For Novita AI, set NOVITA_API_KEY locally (and include it in Codex's env_vars) and call run_review with "provider": "novita". Create a key at Novita Key Management. The default is deepseek/deepseek-v4.1-flash; zai-org/glm-5.3-flash is also listed. Both local and remote list_profiles expose the provider and its models. On the remote endpoint, pass the Novita key in X-Provider-Key, not as a tool argument. Novita bills model usage separately; selecting it does not change the app's default provider or enable a fallback. Signup attribution is never sent with inference requests.
For Nebius Token Factory, set NEBIUS_API_KEY locally (and include it in Codex's env_vars) and call run_review with "provider": "nebius". Create a key at Nebius Token Factory. The default is deepseek-ai/DeepSeek-V4.1-Flash; zai-org/GLM-5.3-Flash and moonshotai/Kimi-K3 are also listed. Requests ask Nebius not to store the answer. On the remote endpoint, pass the Nebius key in X-Provider-Key, not as a tool argument. Nebius bills model usage separately; selecting it does not change the app's default provider or enable a fallback.
Environment
| Variable | Purpose |
|---|---|
BOUNTY_OPERATOR_TOKEN | Connection token for account and run_review |
BOUNTY_OPERATOR_MODEL | Model id run_review uses when the call names none |
BOUNTY_OPERATOR_ROOT | Absolute path of the project folder that paths resolve under. Default: the working directory |
OPENROUTER_API_KEY, ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY, XAI_API_KEY, DEEPSEEK_API_KEY, MISTRAL_API_KEY, GROQ_API_KEY, NOVITA_API_KEY, NEBIUS_API_KEY, INFRON_API_KEY, ORCAROUTER_API_KEY, BOUNTYOPERATOR_API_KEY | Provider key for run_review, one per provider |
What the server reaches
list_profiles,prepare_review,run_gauntlet_planandbuild_packetrun on your machine with no network call.accountandrun_reviewcallhttps://bountyoperator.comwith your token.run_reviewsends the files and your provider key. The service adds the method of the profile, passes the request and the key to the provider for that one request and returns the review. It stores no files, keys or review text.- The server reads the files you name under the working directory. It writes nothing to disk and runs no code from the files.
When a call fails
A failed call returns isError with one JSON object:
Only the beginning is shown; read the rest in the repo