SkillFoxx

Type a name, a task or a service

Burp Suite MCP Server

Burp Suite MCP Server Extension

PortSwigger's official extension that exposes Burp Suite to AI clients over MCP for working with web traffic during testing

MCP serverHigh risk

portswigger/mcp-serverAuthor: PortSwigger

Install

git clone https://github.com/PortSwigger/mcp-server.git
cd mcp-server
./gradlew embedProxyJar

Then load build/libs/burp-mcp-all.jar in Burp: Extensions, Add, type Java.

This is third-party code. Review the repository files before installing.

What it does

The extension runs an MCP server inside Burp Suite, giving the agent access to Burp tools over the protocol. By default the server listens on 127.0.0.1:9876 over SSE, and a stdio proxy jar is bundled for clients that only support stdio. Claude Desktop gets an installer that writes the config automatically. Tools that can change Burp configuration are enabled by a separate checkbox. Developers can add their own tools in Kotlin.

Who it is for. For penetration testers and web application security specialists working in Burp Suite.

Good fit when

  • You want an agent to analyze intercepted requests and responses
  • You want to speed up routine work in an authorized application test
  • You want to write your own MCP tools for Burp

Not a fit when

  • You lack written permission to test the target system
  • The traffic holds data that must not go to a cloud model

Example request

Review the latest requests to /api/login in Burp history and flag suspicious headers

Limitations

Requires Burp Suite, Java and the jar command on PATH; the extension is built from source with Gradle. The server is available only while Burp runs. The server itself is local, but traffic content goes to whatever model the agent uses. Use only within authorized testing.

How to disable. Uncheck Enabled on Burp's MCP tab or unload the extension on the Extensions tab. Remove the burp block from the client config.

MCP

Transport
sse, stdio
Authentication
not required

Security check

  • Gives the agent access to intercepted traffic, including tokens and cookies
  • Can change Burp configuration when the checkbox is enabled

README in short

The README covers prerequisites, building the jar with Gradle and loading the extension into Burp. It explains the MCP tab settings, connecting Claude Desktop via installer or manually, and connecting directly over SSE or through the stdio proxy. It ends with a brief guide to adding custom tools. GPL-3.0 licensed.

FAQ

What if my client supports only stdio?

Extract the proxy via the extension installer and run java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876.

Can the agent change Burp settings?

Only if Enable tools that can edit your config is checked on the MCP tab.

Editors’ pick

NVIDIA's open stack for running OpenClaw, Hermes and LangChain Deep Agents in OpenShell sandboxes with network policy and managed inference

CLIHigh risk22.5K
Editors’ pick

Static code analysis with rules that look like source code, plus a built-in MCP server for AI agents

CLIMedium risk16.6K

Trail of Bits skills

Trail of Bits Skills Marketplace

Editors’ pick

Trail of Bits plugin marketplace for security work: smart contracts, C/C++ and Rust review, Semgrep, CodeQL and fuzzing

PluginMedium risk7.1K

A cybersecurity skill library: forensics, incident response, pentesting, cloud and malware analysis mapped to MITRE ATT&CK and NIST

SkillHigh risk32.8K