claude-bug-bounty vs Specula
Autonomous bug-bounty agent for the terminal — recon, 20 vuln classes, a validation gate and submission-ready HackerOne/Bugcrowd reports. Runs as a Claude Code plugin or standalone on free providers. — versus — Agentic formal verification: coding agents write TLA+ specs and invariants of your distributed system, model-check them, and reproduce violations at code level. arXiv paper + public bug list.
Both point an agent at a codebase to hunt bugs autonomously. claude-bug-bounty hunts exploitable vulns for bounty reports; Specula hunts concurrency and protocol bugs via TLA+ model checking.
| claude-bug-bounty | Specula | |
|---|---|---|
| Stars | 4.1k | 338 |
| Forks | 733 | 36 |
| Language | Python | Python |
| License | MIT | Apache-2.0 |
| Last activity | 4 days ago | yesterday |
| Topics | security | coding |
| Curated connections | 2 | 1 |
claude-bug-bounty — the curator's take
For solo bounty hunters who want an agent to run recon→hunt→validate→report end to end: the strict validation gate before a finding becomes a report is the useful part (cuts false-positive noise reviewers hate), and standalone mode on Ollama means no subscription. NOT a replacement for skilled manual testing on serious targets, and point it ONLY at assets you're authorized to test — autonomous scanning of others' systems is illegal. Report quality still needs a human pass before submission.
Specula — the curator's take
The division of labor is right: the LLM writes the spec (the part humans never do), the model checker delivers ground truth (the part LLMs can't fake) — and the public spreadsheet of real bugs found in open-source systems is receipts most agentic tools don't have. When NOT: this is heavy machinery — Java+TLC, 32GB+ RAM, frontier agents (Opus/GPT-5.5 class) recommended; single-threaded CRUD code will never pay back the spec cost.