# Bugcrowd Scraper (`rl1987/bugcrowd-scraper`) Actor

Scrapes publicly visible Bugcrowd data: the Crowdstream (public disclosed-submission activity feed), the public bug bounty program directory, and the researcher leaderboard/rankings.

- **URL**: https://apify.com/rl1987/bugcrowd-scraper.md
- **Developed by:** [R.L.](https://apify.com/rl1987) (community)
- **Categories:** Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.50 / 1,000 hacktivity (crowdstream) entries

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

**Bugcrowd Scraper** extracts publicly visible data from [Bugcrowd](https://bugcrowd.com), the
crowdsourced security/bug bounty platform, in three modes: the public **Crowdstream**
("hacktivity" equivalent — accepted/disclosed submission activity), the public **bug bounty
program directory**, and the **researcher points leaderboard**. It calls Bugcrowd's own
JSON endpoints directly (the same ones bugcrowd.com's own pages use), so it's fast and
doesn't render pages in a browser. Run it on the Apify platform to get scheduling, API
access, webhooks, and dataset export for free.

### Why use Bugcrowd Scraper?

- **Bug bounty market research** — see which companies run public programs, their reward
  ranges, industries, and access status (open vs. invite-only).
- **Vulnerability activity tracking** — monitor the public Crowdstream feed for
  accepted/disclosed submission activity across programs, by priority (P1-P5) and target.
- **Researcher/community insight** — pull the top-ranked researchers by points and valid
  submission count, all-time or past-month.
- **Competitive/vendor due diligence** — check whether a vendor runs a Bugcrowd program and
  what its reward structure looks like before engaging.

### How to use Bugcrowd Scraper

1. Click **Try for free** (or **Run**) on this Actor's page.
2. Pick a **Mode**: `hacktivity` (Crowdstream activity), `programs` (program directory), or
   `leaderboard` (researcher rankings).
3. Set **Max items** (0 = unlimited for `hacktivity`/`programs`; `leaderboard` is always
   capped at 100 by Bugcrowd itself).
4. For `hacktivity`/`programs`, optionally set a **Start page** to resume/skip ahead.
5. For `programs`, optionally set a **Search query** (e.g. `"okta"` or `"bank"`) to narrow
   the directory to matching programs, using the same search Bugcrowd's own program
   directory page offers. Not available for `hacktivity`/`leaderboard` — Bugcrowd's public
   pages have no keyword search for those.
6. Optionally turn on **Include full report** (`hacktivity`), or **Include target scope**
   / **Include bounty tiers** (`programs`) for deeper per-row detail — each costs 1-2
   extra HTTP requests (and a small extra charge) per row. See Known limitations below
   for the one piece of data that's genuinely not public (individual comment text).
7. For `leaderboard`, pick a **Leaderboard period** (`all-time` or `past-month`).
8. Click **Start** and watch results land in the dataset in real time.

### Input

| Field | Type | Description |
|---|---|---|
| `mode` | string | `hacktivity`, `programs`, or `leaderboard`. Required. |
| `maxItems` | integer | Max rows to scrape (0 = unlimited for `hacktivity`/`programs`). Default `100`. |
| `startPage` | integer | 1-indexed page to start from. Only used for `hacktivity`/`programs`. Default `1`. |
| `hacktivityIncludeFullReport` | boolean | `hacktivity` only. Fetch each disclosed submission's full write-up + public activity timeline (1 extra request per disclosed row). Default `false`. See caveats below. |
| `programsIncludeScope` | boolean | `programs` only. Fetch each program's target-group/scope list (1-2 extra requests per program, shared with `programsIncludeBountyTable`). Default `false`. |
| `programsIncludeBountyTable` | boolean | `programs` only. Fetch each program's full P1-P5 reward table per target group (1-2 extra requests per program, shared with `programsIncludeScope`). Default `false`. |
| `programsSearchQuery` | string | `programs` only. Keyword/text search over the program directory -- the real `search` param used by bugcrowd.com/engagements' own search box (verified live: e.g. `"okta"` narrows the ~250-program directory to 5 results). Full-text, not just a name match. Blank = full unfiltered directory. Not available for `hacktivity`/`leaderboard` -- Bugcrowd's public pages have no text search for those. |
| `leaderboardPeriod` | string | `all-time` or `past-month`. Only used for `leaderboard`. Default `all-time`. |
| `proxyConfiguration` | object | Optional proxy config. Not required — see Tips below. |

See the **Input** tab for the full schema with defaults.

### Output

Each dataset item is one row from the selected mode. Examples:

**`hacktivity`:**

```json
{
  "mode": "hacktivity",
  "id": "13bd6066-7fdb-46c1-a464-7ac1af833486",
  "engagementName": "ClickHouse",
  "engagementUrl": "https://bugcrowd.com/engagements/clickhouse",
  "researcherUsername": "0x88",
  "researcherProfileUrl": "https://bugcrowd.com/h/0x88",
  "points": 5,
  "priority": 4,
  "target": "https://cloud.langfuse.com/",
  "submissionStateText": "Submission accepted on target: https://cloud.langfuse.com/",
  "acceptedAt": "16 Aug 2026",
  "disclosed": true,
  "disclosureReportUrl": "https://bugcrowd.com/disclosures/8c24664f-682e-43b6-83eb-885508405ac3/xml-external-entity-injection-in-nasa-cmr-ingest-api-info-dump",
  "fullReport": {
    "title": "XML External Entity Injection in NASA CMR Ingest API - info dump",
    "summaryAuthor": "thomasito",
    "summaryText": "An XXE vulnerability was identified in NASA's Common Metadata Repository that enabled unauthenticated arbitrary file reads and server-side request forgery (SSRF). ...",
    "summaryHtml": "<p>An XXE vulnerability was identified...</p>",
    "activityTimeline": [
      { "key": "submission.created", "verb": "created the submission", "actorName": "thomasito", "createdAt": "2025-10-26T00:04:45Z", "substate": null, "isComment": false },
      { "key": "comment.created", "verb": "sent a", "actorName": "brunoc_bugcrowd", "createdAt": "2025-10-27T11:23:02Z", "substate": null, "isComment": true }
    ],
    "reportUrl": "https://bugcrowd.com/disclosures/8c24664f-682e-43b6-83eb-885508405ac3/xml-external-entity-injection-in-nasa-cmr-ingest-api-info-dump"
  }
}
```

`fullReport` is only populated when `hacktivityIncludeFullReport: true` **and** the row is
publicly disclosed; otherwise it's `null`. Note `activityTimeline` entries carry event
metadata (who, when, what kind of event) but not the actual text of each comment —
Bugcrowd doesn't render individual comment bodies on the public disclosure page (see
"Known limitations" below).

**`programs`** (with `programsIncludeScope: true, programsIncludeBountyTable: true`):

```json
{
  "mode": "programs",
  "name": "Nubank Brasil Managed Bug Bounty Program",
  "programUrl": "https://bugcrowd.com/engagements/nubank",
  "rewardSummary": "$50 - $4,000",
  "minReward": "$50",
  "maxReward": "$4,000",
  "industryName": "Finance",
  "accessStatus": "open",
  "engagementTypeLabel": "Bug Bounty",
  "scopeRank": 4,
  "targetGroups": [
    {
      "groupName": "Core Assets",
      "inScope": true,
      "targets": [
        { "name": "Nubank Android: Play Store", "uri": "https://play.google.com/store/apps/details?id=com.nu.production", "category": "android", "tags": ["Android"] },
        { "name": "prod-*.nubank.com.br", "uri": null, "category": "api", "tags": [] }
      ]
    },
    { "groupName": "Out of Scope", "inScope": false, "targets": [ { "name": "*.nuinternational.com", "uri": null, "category": null, "tags": [] } ] }
  ],
  "bountyTiers": [
    { "groupName": "Core Assets", "inScope": true, "p1": { "min": 2000, "max": 4000 }, "p2": { "min": 1000, "max": 2000 }, "p3": { "min": 300, "max": 600 }, "p4": { "min": 50, "max": 100 } },
    { "groupName": "Primary Assets", "inScope": true, "p1": { "min": 1000, "max": 2000 }, "p2": { "min": 600, "max": 1000 }, "p3": { "min": 300, "max": 400 }, "p4": { "min": 50, "max": 100 } }
  ]
}
```

`targetGroups` and `bountyTiers` are only fetched when `programsIncludeScope` /
`programsIncludeBountyTable` are `true` — both `null` by default. They're derived from
the same public, unauthenticated source: the program's engagement-brief "Targets" tab
data (see "Known limitations" for how this was found and verified). `targetGroups` is
`[{groupName, inScope, targets: [{name, uri, category, tags}]}]`; `bountyTiers` is
`[{groupName, inScope, p1..p5: {min, max}}]` (whole-currency units, USD for USD-priced
programs) — reward ranges can differ per target group within the same program.

**`leaderboard`:**

```json
{
  "mode": "leaderboard",
  "period": "all-time",
  "rank": 1,
  "username": "todayisnew",
  "points": 50052,
  "validSubmissions": 4519,
  "profileUrl": "https://bugcrowd.com/h/todayisnew",
  "countryCode": "CA"
}
```

You can download the dataset in various formats such as JSON, HTML, CSV, or Excel from
the **Storage → Dataset** tab or via the API.

### Data table

| Field | Modes | Description |
|---|---|---|
| `mode` | all | Which mode produced this row. |
| `engagementName`, `engagementUrl`, `target`, `priority`, `points`, `submissionStateText` | `hacktivity` | Crowdstream activity row: program, target, severity priority, points awarded, human-readable state. |
| `researcherUsername`, `researcherProfileUrl` | `hacktivity` | The researcher credited, if their name is public on that row (some rows are anonymized by the researcher's own privacy settings). |
| `disclosed`, `disclosureReportUrl` | `hacktivity` | Whether the submission was publicly disclosed, and (if so) the link to its full public disclosure report page. |
| `fullReport` | `hacktivity` | Only when `hacktivityIncludeFullReport: true` and `disclosed: true`: `{title, summaryAuthor, summaryText, summaryHtml, activityTimeline, reportUrl}` — the full researcher write-up plus a public activity/event timeline (not full comment text; see Known limitations). `null` otherwise. |
| `name`, `programUrl`, `rewardSummary`, `minReward`, `maxReward`, `industryName`, `accessStatus`, `scopeRank` | `programs` | Program directory listing: name, reward range, industry, whether it's open or invite-only, and a 1-5 scope difficulty rank. |
| `targetGroups` | `programs` | Only when `programsIncludeScope: true`: the program's target-group/asset scope list, `[{groupName, inScope, targets: [{name, uri, category, tags}]}]`, from the program's public engagement-brief page. `null` when the flag is off or the fetch failed. |
| `bountyTiers` | `programs` | Only when `programsIncludeBountyTable: true`: the program's P1-P5 reward table per target group, `[{groupName, inScope, p1..p5: {min, max}}]`. `null` when the flag is off or the fetch failed. |
| `rank`, `username`, `points`, `validSubmissions`, `profileUrl`, `countryCode` | `leaderboard` | Researcher's leaderboard rank, points, valid submission count, and public profile link. This is the full set of fields Bugcrowd's public leaderboard endpoint exposes — see Known limitations for why there's no deeper per-researcher "track record" (badges, per-program breakdown, first-to-find count). |

### Pricing

This Actor uses **Pay-Per-Event** pricing. You're charged per row returned, priced by how
data-rich that row type is:

| Event | Price | Charged when |
|---|---|---|
| Hacktivity (Crowdstream) entry | $0.0015 | Per `hacktivity` row pushed |
| Hacktivity full report | $0.003 | Per disclosed `hacktivity` row where `fullReport` was successfully fetched (`hacktivityIncludeFullReport: true`) |
| Program listing | $0.001 | Per `programs` row pushed |
| Program scope/bounty detail | $0.0025 | Per `programs` row where `targetGroups` and/or `bountyTiers` was successfully fetched from the public engagement brief (`programsIncludeScope` / `programsIncludeBountyTable`) |
| Leaderboard entry | $0.0008 | Per `leaderboard` row pushed |

A typical exploratory run (a few hundred rows) costs well under $1. Set `maxItems` to
control spend directly.

### Tips

- `leaderboard` mode is always capped at 100 rows (that's Bugcrowd's own limit on this
  endpoint) — `maxItems` above 100 has no additional effect there.
- Use `startPage` to resume a large `hacktivity`/`programs` crawl without re-scraping
  earlier pages.
- All endpoints used by this Actor responded without a proxy or special headers during
  development. Only enable **Proxy configuration** (residential recommended) if you start
  seeing blocking or Cloudflare challenges — it's off by default to keep runs cheap and fast.

### Known limitations

- **Program scope/target lists and P1-P5 reward tables ARE public — no login needed.**
  An earlier version of this Actor claimed this data required a Bugcrowd researcher
  login, based on testing only the `/engagements/<handle>/target_groups.json` and
  `/rewards.json` routes (which do redirect to the login-gated Hacker Portal). That
  conclusion was wrong: the real bugcrowd.com engagement brief page (e.g.
  `bugcrowd.com/engagements/nubank`) renders a full "Targets" tab — target-group names,
  in/out-of-scope status, per-asset name/URI/category/tags, and a P1-P5 reward table per
  target group — without any login, verified with a real headless-browser session on a
  logged-out page. That page fetches the data from `GET /engagements/<handle>/
  changelog.json` (list of published brief revisions) then `GET /engagements/<handle>/
  changelog/<id>.json` (full detail for the "Latest" revision), both confirmed public
  with a bare `curl` (no cookies, no proxy) across open bug-bounty programs (`nubank`,
  `okta`) and VDPs (`nasa-vdp`) alike. `programsIncludeScope` / `programsIncludeBountyTable`
  now use this real mechanism and return real data. The scope-adjacent `scopeRank`
  (1-5 difficulty score) remains included on every `programs` row regardless of these
  flags, as before.
- **Full comment text on disclosed submissions is not public.** `hacktivityIncludeFullReport`
  successfully fetches the full researcher write-up (the actual vulnerability
  description/PoC) from each disclosed submission's public disclosure page — that part
  works reliably. Its `activityTimeline`, however, only carries comment/state-change
  *metadata* (who, when, what kind of event) because Bugcrowd's public disclosure page
  doesn't render individual comment bodies server-side; that content is fetched by the
  same login-gated Hacker Portal SPA as above.
- **Keyword search exists for `programs`, not for `hacktivity`/`leaderboard`.** The
  public program directory page has a real search box; it fires `GET
  /engagement_listings.json?search=<term>&...`, and the same `search` param also works
  on the `engagements.json` endpoint this Actor already uses for `programs` (confirmed
  live: `search=okta` narrows Bugcrowd's ~250-program directory to 5 hits, `search=bank`
  to ~40, a nonsense term to 0) — wired up as `programsSearchQuery`. The public
  Crowdstream and Leaderboard pages, by contrast, have no text search box and no
  `search`-style query parameter on `crowdstream.json` / `leaderboard/data` — only
  toggles/dropdowns (accepted/disclosed, priority, country, period), all already covered
  by existing inputs. No fabricated search param was added for those two modes.
- **No public per-researcher "track record" beyond the leaderboard.** Each researcher's
  `/h/<username>` profile page is a client-rendered SPA shell with no embedded data and
  no discovered public JSON API (confirmed again during this round of development — the
  page is identical in size/shape whether logged in or not, and ships no server-rendered
  stats). `leaderboard` mode already surfaces every field Bugcrowd's public leaderboard
  endpoint exposes (rank, username, points, valid submissions, country, profile URL) —
  there are no additional unused fields on that endpoint to add. Deeper track-record data
  (badges, first-to-find count, per-program point breakdown, response history) simply
  isn't available without a login, so no `researchers` mode or extra leaderboard flag was
  added rather than fabricate one.

### Cyber recon toolkit

Part of the **Cyber recon toolkit** — OSINT, attack-surface recon, and vulnerability-intel data collection for security research:

- [HackerOne Scraper](https://apify.com/rl1987/hackerone-scraper) — Scrapes public HackerOne data: Hacktivity disclosed reports, program directory, researcher leaderboard.
- [Intigriti Scraper](https://apify.com/rl1987/intigriti-scraper) — Scrapes public Intigriti data: bug bounty/VDP program directory, researcher leaderboard and profiles.
- [CVE Scraper](https://apify.com/rl1987/cve-scraper) — CVE.org vulnerability info scraper.
- [TLSX - TLS Data Gathering and Analysis](https://apify.com/rl1987/pd-tlsx) — Fast, configurable TLS grabber for TLS-based data collection and analysis.
- [BGP.HE.NET Recon Scraper](https://apify.com/rl1987/bgphenet-scraper) — Scrapes ASN, prefix, IP, and DNS recon data from bgp.he.net.
- [gau - Get All URLs](https://apify.com/rl1987/gau-wrapper) — Fetch known URLs from Wayback Machine, Common Crawl, AlienVault OTX, and URLScan.
- [Git Email Extractor](https://apify.com/rl1987/git-email-extractor) — Shallow-clones git repos and extracts contributor emails from commit history.
- [Wappalyzer Technology Lookup](https://apify.com/rl1987/wappalyzer-tech-lookup) — Detect the technology stack behind any website using Wappalyzer.
- [Meta Tags Scraper](https://apify.com/rl1987/meta-tags-scraper) — Web page metadata scraper (meta tags, Open Graph, Twitter Card).
- [Universal Contact Extractor](https://apify.com/rl1987/universal-contact-extractor) — Extract phone numbers, emails and social media URLs from web pages.
- [Web Text Extractor](https://apify.com/rl1987/web-text-extractor) — Extract clean text or Markdown content from web pages.

### Did you find this useful?

⭐ Rate this actor on Apify! Your feedback helps other users find it and helps us keep improving it.

### FAQ & disclaimers

This Actor only accesses **publicly visible** Bugcrowd data — the same Crowdstream,
program directory, and leaderboard pages anyone can view at bugcrowd.com without logging
in. It does not use, require, or store login credentials, and it cannot access private
program details, non-public submissions, or authenticated researcher data. There is no
crawlable public directory of individual researcher profiles beyond the leaderboard: each
researcher's `/h/<username>` profile page is a client-rendered single-page app with no
discovered public JSON API, so a separate "researchers" mode was not implemented — the
`leaderboard` mode already surfaces the public researcher directory data (rank, username,
points, valid submissions, country, profile link) that Bugcrowd exposes.

Use this Actor in accordance with Bugcrowd's Terms of Service. Website structures and
APIs can change — if the Actor stops returning data, please open an issue on the Actor's
Issues tab. Need a custom variant (different fields, sites, or pipelines)? Reach out via
Apify's custom development services.

# Actor input Schema

## `mode` (type: `string`):

Which public Bugcrowd data set to scrape. "hacktivity" walks the public Crowdstream (disclosed/accepted submission activity feed). "programs" walks the public bug bounty program directory. "leaderboard" fetches the researcher points leaderboard/rankings (also the only crawlable public researcher directory Bugcrowd exposes).

## `maxItems` (type: `integer`):

Maximum number of rows to scrape. Set to 0 for unlimited (walks every available page for hacktivity/programs; leaderboard is always capped at 100 by Bugcrowd itself).

## `startPage` (type: `integer`):

1-indexed page number to start from. Only used in "hacktivity" and "programs" modes.

## `hacktivityIncludeFullReport` (type: `boolean`):

For publicly disclosed (disclosed=true) Crowdstream rows, fetch the disclosure report page and include the full researcher write-up plus a public activity/comment-event timeline (not full comment text -- Bugcrowd only renders comment metadata publicly). Costs 1 extra HTTP request and an extra charge per disclosed row, and adds latency. Off by default to keep the cheap default path unchanged.

## `programsIncludeScope` (type: `boolean`):

Fetch each program's target-group/scope list (targetGroups: group name, in/out-of-scope, and per-asset name/URI/category/tags), reverse-engineered from the public bugcrowd.com engagement brief page's own "Targets" tab (public, unauthenticated -- see the Actor README for details). Costs 1-2 extra HTTP requests per program (shared with programsIncludeBountyTable if both are enabled) and adds latency. Off by default.

## `programsIncludeBountyTable` (type: `boolean`):

Fetch each program's full P1-P5 reward table per target group (bountyTiers), from the same public, unauthenticated source as programsIncludeScope -- see the Actor README for details. Costs 1-2 extra HTTP requests per program (shared with programsIncludeScope if both are enabled) and adds latency. Off by default.

## `programsSearchQuery` (type: `string`):

Keyword/text search over the program directory, passed straight through as the real `search` query parameter the public bugcrowd.com/engagements page's own search box uses (verified live: narrows the 250-program directory to ~40 results for "bank" and 5 for "okta"). It is a full-text search (matches taglines/descriptions too, not just the program name), not a strict name filter. Leave blank to scrape the full unfiltered directory. Not available for hacktivity or leaderboard modes -- Bugcrowd's public Crowdstream and Leaderboard pages have no text search UI or parameter.

## `leaderboardPeriod` (type: `string`):

Time window for the researcher leaderboard. Bugcrowd currently only supports "all-time" and "past-month".

## `proxyConfiguration` (type: `object`):

Optional proxy settings. All endpoints used by this Actor (bugcrowd.com/crowdstream.json, bugcrowd.com/engagements.json, bugcrowd.com/leaderboard/data) were observed to work without a proxy or special headers during development. Enable a residential proxy only if you start seeing blocking or Cloudflare challenges.

## Actor input object example

```json
{
  "mode": "hacktivity",
  "maxItems": 100,
  "startPage": 1,
  "hacktivityIncludeFullReport": false,
  "programsIncludeScope": false,
  "programsIncludeBountyTable": false,
  "programsSearchQuery": "",
  "leaderboardPeriod": "all-time",
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}
```

# Actor output Schema

## `rows` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("rl1987/bugcrowd-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("rl1987/bugcrowd-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call rl1987/bugcrowd-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,rl1987/bugcrowd-scraper"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/r250xTxNhpbYX3Iw7/builds/JW58bIC38ePlehKfJ/openapi.json