Skip to content
Burp Suite MCP Server

Burp Suite MCP Server

by PortSwigger
Released
GPL-3.0
Repository Docs
Developer Tools

Summary

PortSwigger's official Burp Suite extension exposing proxy history, Repeater and scanning to AI agents over MCP.

Features

  • Runs as a Burp Suite extension, exposing your live Burp session over MCP
  • Gives agents access to captured proxy history and existing target scope
  • Send modified requests back through Burp from an AI client
  • Bundled installer writes the MCP client configuration automatically
  • Kotlin implementation, GPL-3.0 licensed, built with Gradle

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

  1. Open your agent's MCP configuration file.
  2. Merge the snippet below into it.
  3. Restart the agent — the "Burp Suite MCP Server" tools will be available.
{
  "mcpServers": {
    "burp-suite-mcp-server": {
      "command": "<path to Java executable packaged with Burp>",
      "args": [
        "-jar",
        "/path/to/mcp/proxy/jar/mcp-proxy-all.jar",
        "--sse-url",
        "<your Burp MCP server URL>"
      ]
    }
  }
}

Description

PortSwigger's official MCP server is a Burp Suite extension rather than a standalone process. Once loaded, it opens Burp's own capabilities to any MCP-compatible AI client, so an assistant can work against the traffic and findings already sitting in your Burp session instead of starting a fresh scan from nothing.

That framing is what makes it useful for real web-security work. The proxy history, the requests you have already captured and the target scope you have already defined are the context an agent needs to be worth anything on an engagement — and this server hands it that context directly. An assistant can read through captured traffic, reason about a request, and send modified versions back through Burp, turning the tedious middle of a manual test into something you can direct in prose.

Installation is a build-and-load step: clone the repository, run ./gradlew embedProxyJar, then add the resulting burp-mcp-all.jar through Burp's Extensions tab. The extension ships an installer that writes the MCP client configuration for you. Clients connect through a bundled proxy jar pointed at the Burp MCP server's SSE URL, so Java and the jar command must be on your PATH. It is written in Kotlin and released under GPL-3.0.

The obvious caution applies and is worth stating plainly: this gives an AI model the ability to send crafted HTTP traffic to whatever Burp is pointed at. Use it only against systems you are authorised to test, and keep Burp's target scope tight.

Related MCP Servers

MCP: Engram

by Gentleman Programming

New

Persistent memory for coding agents as a single Go binary — SQLite and FTS5 behind MCP, an HTTP API, a CLI and a TUI, with no Node, Python or Docker required.

Developer Tools
1 views

MCP: agent-device

by Callstack

New

Give a coding agent a live feedback loop on real mobile, TV and desktop apps — inspect, tap, type and capture evidence on iOS, Android and HarmonyOS over MCP or a CLI.

Developer Tools
3 views

MCP: Weights & Biases MCP Server

by Weights & Biases

New

The official W&B MCP server: query experiment runs, Weave LLM traces, artifacts and registries in natural language, and write findings back as a W&B report.

Developer Tools
3 views

MCP: Replicate MCP Server

by Replicate

Featured

Replicate's official MCP server: search thousands of hosted models, read their schemas, and run predictions on image, video, audio and language models from inside an agent.

Developer Tools
5 views
Browse all MCP servers →