Brave Search MCP Server

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (single unbound row, minimum) │ $10,000 │ $11,000 High │ $1,000 │ $1,250 Medium │ $250 │ $313 Low │ $100 │ $125 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Info disclosure 30 % Access control 25 % Injection 25 % Parsing/validation 15 % Latest advisories Loading the feed Overview This is the reference MCP server for the Brave Search API: roughly 1.3k GitHub stars, pushed daily, and one of the most commonly installed search connectors across Claude Desktop, Cursor, VS Code and Continue, because Brave Search is the default free-tier search API in a large share of MCP tutorials and starter configurations. Every install holds a live Brave Search API key, and every install feeds attacker-influenceable web content straight back into a host agent's context, so the blast radius is credential theft on one side and tool-result poisoning on the other, for a search tool, the classic indirect-prompt-injection delivery vehicle. Brave Software pays it on HackerOne under an org-wide GitHub scope that puts this repository on the same unbound reward row as everything else the program covers: $100 at Low, $250 at Medium, $1,000 at High and $10,000 at Critical, with range mode meaning those figures are minimums rather than fixed prices. sorona.xyz adds 1.25x on top of whatever Brave awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~7 hours First response ~10 hours Triage ~7 days Bounty In scope The program's declaration is a repository wildcard: any non-forked, non-archived repository under github.com/brave or github.com/brave-intl , carried as one source-code asset at critical maximum severity. brave/brave-search-mcp-server is one of them That repository in full, across both the stdio transport desktop clients spawn and the HTTP transport used when the server runs as a network service Its API-key handling: anywhere the Brave Search key can be read by an unintended party, written into a log, echoed back inside a tool result, or sent to a host it was never meant to reach The tool surface it exposes to MCP clients, including argument parsing and parameter validation, and anything that lets a caller reach a capability or endpoint the server did not intend to expose The response path that hands search results back to the host agent, where attacker-controlled page content crosses into an agent's context The HTTP transport's own request handling, covering authentication, origin checks and session binding, when the server is reachable by something other than the local client that spawned it Everything else the same declaration covers, on the same reward row: Brave's other repositories, the desktop and mobile browser builds, and Brave's web properties, api-dashboard.search.brave.com among them, the dashboard that issues the keys these installs hold Out of scope Forked and archived repositories under either GitHub organisation, which the wildcard scope carves out explicitly Chromium-inherited issues, which Brave routes to the Chromium team rather than paying for here GitHub wikis being publicly editable, which is a known and accepted configuration Non-default browser extensions and social media account takeovers Denial of service bugs, which the dated policy changelog entries place out of scope Prompt engineering that only produces an undesirable model response, with no data leakage or unauthorised action to show for it Most-valued findings Theft or leakage of the Brave Search API key held by every install, which is the highest-value class here because credential compromise is what each deployment actually stands to lose Command or argument injection through the tool-call path that reaches the host shell or steers the server's outbound HTTP client at an attacker-chosen target Indirect prompt injection carried in search results into the host agent, demonstrated through to exfiltration or an unauthorised tool call rather than left at the point of injection Access-control failure on the HTTP transport that lets an unrelated local process, or a remote caller, drive the server's tools with someone else's key Parser and validation flaws in response handling that crash the server or corrupt what the agent believes it received from search Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Give Brave a reasonable amount of time to resolve the issue before any public or third-party disclosure, and note that Brave reserves the right to publish first Only non-forked, non-archived repositories under github.com/brave and github.com/brave-intl are eligible, so check the repo's status before you start Chromium-inherited issues belong to the Chromium team rather than to this program, even when you found them through a Brave-shipped artifact Denial of service and non-default browser extension issues are closed without a bounty, per the program's dated policy changelog entries A prompt-injection finding needs demonstrated data leakage or an unauthorised action behind it; a model producing an undesirable string on its own is not a security report Program stats 497 Reports resolved $130k Bounties paid 100% Response efficiency Disclosure Disclosure is coordinated with Brave through HackerOne. The policy asks for a reasonable amount of time to resolve the issue before anything reaches the public or a third party, and Brave reserves the right to publish first. Timing sits with Brave, so hold the detail, including anything you would share with a third party, until it confirms a fix has shipped and you are clear to publish. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability