Skip to content
Burp Suite MCP Server

Burp Suite MCP Server

by PortSwigger
Released
9 views
GPL-3.0
Repository Docs
Developer Tools

Summary

PortSwigger's official Burp Suite extension exposing proxy history, Repeater and scanning to AI agents over MCP.

Features

  • Runs as a Burp Suite extension, exposing your live Burp session over MCP
  • Gives agents access to captured proxy history and existing target scope
  • Send modified requests back through Burp from an AI client
  • Bundled installer writes the MCP client configuration automatically
  • Kotlin implementation, GPL-3.0 licensed, built with Gradle

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

  1. Open your agent's MCP configuration file.
  2. Merge the snippet below into it.
  3. Restart the agent — the "Burp Suite MCP Server" tools will be available.
{
  "mcpServers": {
    "burp-suite-mcp-server": {
      "command": "<path to Java executable packaged with Burp>",
      "args": [
        "-jar",
        "/path/to/mcp/proxy/jar/mcp-proxy-all.jar",
        "--sse-url",
        "<your Burp MCP server URL>"
      ]
    }
  }
}

Description

PortSwigger's official MCP server is a Burp Suite extension rather than a standalone process. Once loaded, it opens Burp's own capabilities to any MCP-compatible AI client, so an assistant can work against the traffic and findings already sitting in your Burp session instead of starting a fresh scan from nothing.

That framing is what makes it useful for real web-security work. The proxy history, the requests you have already captured and the target scope you have already defined are the context an agent needs to be worth anything on an engagement — and this server hands it that context directly. An assistant can read through captured traffic, reason about a request, and send modified versions back through Burp, turning the tedious middle of a manual test into something you can direct in prose.

Installation is a build-and-load step: clone the repository, run ./gradlew embedProxyJar, then add the resulting burp-mcp-all.jar through Burp's Extensions tab. The extension ships an installer that writes the MCP client configuration for you. Clients connect through a bundled proxy jar pointed at the Burp MCP server's SSE URL, so Java and the jar command must be on your PATH. It is written in Kotlin and released under GPL-3.0.

The obvious caution applies and is worth stating plainly: this gives an AI model the ability to send crafted HTTP traffic to whatever Burp is pointed at. Use it only against systems you are authorised to test, and keep Burp's target scope tight.

Related MCP Servers

MCP: Mux MCP Server

by Mux

New

Official MCP server for the Mux video API, built on a code-execution scheme: the agent writes TypeScript against the SDK and runs it in a Deno sandbox.

Developer Tools
8 views

MCP: ripwire

by Red Hat

Featured

Red Hat's zero-dependency C++23 code-context engine — ranked call graphs and blast-radius analysis, indexing a repo in under half a second with no server and no database.

Developer Tools
9 views

MCP: Graft

by Trail

Featured

Builds a searchable markdown graph of your repo so coding agents stop re-exploring it on every task — reported 42% fewer tokens and 46% fewer tool calls.

Developer Tools
8 views

MCP: Expo MCP Server

by Expo

Featured

Expo's official remote MCP server — searches Expo docs, installs compatible SDK packages, triggers and monitors EAS builds, and drives iOS/Android simulators.

Developer Tools
7 views
Browse all MCP servers →