Burp Suite MCP Server
Burp Suite MCP Server Extension
PortSwigger's official extension that exposes Burp Suite to AI clients over MCP for working with web traffic during testing
- 1,261 ★ on the repository
- Last commit
- GPL-3.0
Broad access
Why this level
- Gives the agent access to intercepted traffic, including tokens and cookies
- Can change Burp configuration when the checkbox is enabled
Install
- Works in
Manual install
git clone https://github.com/PortSwigger/mcp-server.git
cd mcp-server
./gradlew embedProxyJarThen load build/libs/burp-mcp-all.jar in Burp: Extensions, Add, type Java.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Gives the agent access to intercepted traffic, including tokens and cookies
- Can change Burp configuration when the checkbox is enabled
This is third-party code. Review the repository files before installing.
What it does
The extension runs an MCP server inside Burp Suite, giving the agent access to Burp tools over the protocol. By default the server listens on 127.0.0.1:9876 over SSE, and a stdio proxy jar is bundled for clients that only support stdio. Claude Desktop gets an installer that writes the config automatically. Tools that can change Burp configuration are enabled by a separate checkbox. Developers can add their own tools in Kotlin.
Who it is for. For penetration testers and web application security specialists working in Burp Suite.
Good fit when
- You want an agent to analyze intercepted requests and responses
- You want to speed up routine work in an authorized application test
- You want to write your own MCP tools for Burp
Not a fit when
- You lack written permission to test the target system
- The traffic holds data that must not go to a cloud model
Example request
Review the latest requests to /api/login in Burp history and flag suspicious headersMCP
- Transport
- sse, stdio
- Authentication
- not required
Limitations
Requires Burp Suite, Java and the jar command on PATH; the extension is built from source with Gradle. The server is available only while Burp runs. The server itself is local, but traffic content goes to whatever model the agent uses. Use only within authorized testing.
How to disable. Uncheck Enabled on Burp's MCP tab or unload the extension on the Extensions tab. Remove the burp block from the client config.
FAQ
What if my client supports only stdio?
Extract the proxy via the extension installer and run java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876.
Can the agent change Burp settings?
Only if Enable tools that can edit your config is checked on the MCP tab.
How is the official Burp Suite MCP Server different from third-party ones?
It is the official PortSwigger extension. It starts an MCP server inside Burp Suite, and the agent gets Burp tools for working with web traffic during testing. By default the server listens on 127.0.0.1:9876 over SSE.
What if my client supports only stdio?
Connect the client through a stdio proxy bridge to the SSE address 127.0.0.1:9876, as described in the extension README. It works in Claude Desktop, Claude Code and Cursor. Risk is high because the agent sees traffic, test only permitted targets.
Discussion
No questions or reviews yet.
Related
MCP serversA Burp Suite Professional extension that runs an MCP server and gives an agent the scanner, proxy and other Burp tools
Burp Suite extension with AI: analyzes requests, runs scanners and opens Burp over MCP to Claude Desktop, Claude Code, Codex and Gemini CLI
A bridge between an MCP client and a Kali Linux terminal so the agent can run nmap, sqlmap, hydra and other tools for authorized pentesting and CTF
A native MCP plugin for the x64dbg debugger: the agent drives debugging over HTTP, sets breakpoints, steps through code, reads and patches memory
An offensive security MCP server: the agent runs 150+ pentest and recon tools and drives automated target assessments
x64dbg MCP
x64dbg MCP Server Plugin
An x64dbg and x32dbg plugin with an MCP server of 79 tools and 11 Claude Code commands for crash analysis, tracing and memory dumps
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Burp Suite MCP Server (this entry) | yes | not required | 1,261 | |
| Caido Skills | yes | 286 | the official Caido skill for agents | |
| Custom AI Agent | no | not required | 1,559 | burp Suite extension with AI |
| Charles MCP Server | no | API key | 331 | an MCP server for Charles Proxy |
README in short
The README covers prerequisites, building the jar with Gradle and loading the extension into Burp. It explains the MCP tab settings, connecting Claude Desktop via installer or manually, and connecting directly over SSE or through the stdio proxy. It ends with a brief guide to adding custom tools. GPL-3.0 licensed.