If you hunt bug bounties, you know the pattern: you find something that looks real, you spend two or three days building a proof of concept, you submit it, and it comes back marked Duplicate. Someone else saw the same thing four hours before you did.
This isn't a rare bad day. Write-ups from people who've done this for a while put duplicate and rejected reports at somewhere between 50 and 80 percent of everything submitted. That's not a skill problem. It's a timing and information problem: you can't know a bug is already known until after you've done the expensive part.
Solodit already helps here — it's a free, searchable index of thousands of historical findings from Sherlock and Code4rena, and if you haven't used it, use it. But it lives in a browser tab you have to remember to check. It doesn't live inside the tools you're already using while you read the code.
That's the specific gap we built 3ilm-mcp for. It's a free MCP server — the same protocol Claude and other AI coding agents use to call tools — with a search index of 1,032 exact-reconciled findings from Sherlock audit contests, tagged by vulnerability pattern (reentrancy, oracle manipulation, access control, and so on), with acceptance rates per pattern so you can see which bug classes actually get paid versus which ones die at triage regardless of how correct they are.
The point isn't that this replaces judgment. It's that the question "has this exact pattern been seen before, and does this category of finding usually survive triage" is worth asking before you sink two days into a PoC, not after a rejection tells you the answer for free.
If you want the harder version of the same question answered — a full scan of a specific repo against known patterns, with an actual report — there's a paid tier for that too (bug-bounty-intelligence-mcp, a few dollars via x402 or card). But the free pattern search costs nothing to try, and if it saves you from writing one more PoC for a bug someone already reported, it's already paid for itself.
Install:
npm install -g 3ilm-mcp
Then point your MCP-compatible agent at it and ask it whether a pattern you're looking at has come up before.
Top comments (0)