AI Recon & OSINT Automation with Claude — Bug Bounty Playbook 2026

A practical, copy-able recon pipeline built on Claude Code and MCP servers. Subfinder -> httpx -> nuclei -> Claude triage, plus JS endpoint extraction and parameter mining with LLM scoring.

Recon stack overview

ProjectDiscovery suite (subfinder, httpx, naabu, nuclei).
Claude Code as the orchestrator + triage brain.
MCP servers for shodan, github search, wayback machine.
Promptfoo for regression-testing your triage prompts.

End-to-end pipeline

subfinder -d target.com -all -silent \
  | httpx -silent -tech-detect -status-code \
  | tee live.txt
nuclei -l live.txt -severity medium,high,critical -o findings.txt
claude code 'Triage findings.txt; group by CWE, dedupe, suggest verification steps' > triage.md

JavaScript endpoint + secret extraction

Pipe collected JS files through Claude with a strict JSON-output prompt to extract endpoints, parameters, and high-entropy strings. Cross-reference against an allowlist to find new attack surface.

Extract from this JS: (1) HTTP endpoints with method, (2) param names and apparent types, (3) hardcoded secrets/URLs. Output strict JSON: {endpoints:[...], params:[...], secrets:[...]}

LLM-driven vuln triage

Nuclei produces noise. A two-stage Claude prompt (classifier + verifier) cuts false positives ~70%. Always require Claude to output the exact curl command for human verification — never auto-exploit.

Ethics & scope

Recon only what's in scope. Even passive DNS enumeration is out of scope on many programs. Read the rules of engagement every time.

FAQ

Does this replace Burp?

No. It speeds up the recon -> first-touch phase. Manual Burp work still wins on auth, business-logic, and chained vulns.

Token cost?

A medium-sized program (200 live hosts) typically costs $5-15 in Claude API for full triage. Cache aggressively.

AI-Powered Recon & OSINT Automation with Claude (2026)