Pricing
Flat, published pricing. Terms disclosed up front. No sales call to get a number.
Every paid engagement starts only after you sign a scope authorization. Start free, upgrade when you need depth.
| Service | Price | Includes | Turnaround |
|---|---|---|---|
| Free Security Snapshot | $0 | Automated external surface check of one domain. Top-level findings summary, no report. A taste of what we see. | Instant |
| MCP/API Quick Scan | $49 | Self-serve automated scan of one public MCP server or API endpoint. Auth, injection, and exposure checks. Machine-generated PDF report. No human validation. | Results within 1 hour |
| MCP Security Audit | $1,500 | Automated testing plus human validation of every finding on one MCP server. Tool-poisoning, prompt-injection paths, auth flaws, data exposure. Written report with reproduction steps and fix guidance. | 48 hours |
| Continuous Retesting | $1,500/mo | We re-verify your fixed findings and re-scan your scope on every change, monthly report plus instant alerts on regressions. Cancel anytime. | Ongoing |
| Pentest Evidence Package | $2,500 | Point-in-time assessment with an auditor-ready report: methodology, findings, evidence, and remediation status. Built for SOC 2 / ISO 27001 / vendor questionnaires. | 5 business days |
| Full Engagement | $9,500 | Deep assessment of your full external scope: web, APIs, MCP servers, cloud exposure. Human-led with AI-powered breadth, executive summary, debrief call, and one free retest of fixes. | 2–3 weeks |
| Custom Engagement | Quote | Larger scopes, internal networks, red-team style objectives, or recurring programs. Tell us what you need. | Scoped together |
Email hello@bugbountyteam.com with your domain and what you need. Reply within one business day with a scope and a price.
Start an order or email hello@bugbountyteam.com
Bug Bounty