Skip to content
Burp Suite MCP Server

Burp Suite MCP Server

by PortSwigger
Released
GPL-3.0
Repository Docs
Developer Tools

Summary

PortSwigger's official Burp Suite extension exposing proxy history, Repeater and scanning to AI agents over MCP.

Features

  • Runs as a Burp Suite extension, exposing your live Burp session over MCP
  • Gives agents access to captured proxy history and existing target scope
  • Send modified requests back through Burp from an AI client
  • Bundled installer writes the MCP client configuration automatically
  • Kotlin implementation, GPL-3.0 licensed, built with Gradle

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

  1. Open your agent's MCP configuration file.
  2. Merge the snippet below into it.
  3. Restart the agent — the "Burp Suite MCP Server" tools will be available.
{
  "mcpServers": {
    "burp-suite-mcp-server": {
      "command": "<path to Java executable packaged with Burp>",
      "args": [
        "-jar",
        "/path/to/mcp/proxy/jar/mcp-proxy-all.jar",
        "--sse-url",
        "<your Burp MCP server URL>"
      ]
    }
  }
}

Description

PortSwigger's official MCP server is a Burp Suite extension rather than a standalone process. Once loaded, it opens Burp's own capabilities to any MCP-compatible AI client, so an assistant can work against the traffic and findings already sitting in your Burp session instead of starting a fresh scan from nothing.

That framing is what makes it useful for real web-security work. The proxy history, the requests you have already captured and the target scope you have already defined are the context an agent needs to be worth anything on an engagement — and this server hands it that context directly. An assistant can read through captured traffic, reason about a request, and send modified versions back through Burp, turning the tedious middle of a manual test into something you can direct in prose.

Installation is a build-and-load step: clone the repository, run ./gradlew embedProxyJar, then add the resulting burp-mcp-all.jar through Burp's Extensions tab. The extension ships an installer that writes the MCP client configuration for you. Clients connect through a bundled proxy jar pointed at the Burp MCP server's SSE URL, so Java and the jar command must be on your PATH. It is written in Kotlin and released under GPL-3.0.

The obvious caution applies and is worth stating plainly: this gives an AI model the ability to send crafted HTTP traffic to whatever Burp is pointed at. Use it only against systems you are authorised to test, and keep Burp's target scope tight.

Related MCP Servers

MCP: Everything

by Model Context Protocol

A reference/test server that exercises every MCP feature — prompts, resources, tools, and sampling — for building and debugging clients.

Developer Tools

MCP: MCPJam Inspector

by MCPJam

Testing and evaluation workbench for MCP server authors — inspect tools and prompts, debug OAuth step by step, and score behaviour across 16 client configurations before shipping.

Developer Tools

MCP: MATLAB MCP Server

by MathWorks

MathWorks' official MCP server: let Claude Code, Copilot or Codex run MATLAB code, lint it and execute unit tests on your local install.

Developer Tools

MCP: Time

by Model Context Protocol

Time and timezone utilities — get the current time in any timezone and convert between zones.

Developer Tools
Browse all MCP servers →