Burp Suite와 현대 AI 사이의 다리.

이름에 대한 참고: 이 확장은 Custom AI Agent(이전 명칭 Burp AI Agent)로 공개됩니다. PortSwigger의 BApp 스토어 명명 요구사항을 준수하고 Burp Suite에 내장된 Burp AI 제공자와의 혼동을 피하기 위해 이름이 변경되었습니다. GitHub 저장소(github.com/six2dez/burp-ai-agent), 문서 사이트(burp-ai-agent.six2dez.com), 구성 디렉터리(~/.burp-ai-agent/)는 연속성을 위해 burp-ai-agent 식별자를 유지합니다.

Custom AI Agent는 Burp Suite의 확장 프로그램으로, AI를 보안 워크플로우에 통합합니다. 로컬 모델이나 클라우드 제공업체를 사용하고, MCP를 통해 외부 AI 에이전트를 연결하며, 수동 및 능동 스캐너가 취약점을 찾아내는 동안 수동 테스트에 집중하세요.

[! 중요] **1.0.0 이전 버전을 사용 중이라면, 보안 권고문을 읽고 최신 릴리스인 1.1.0.0.으로 업그레이드하세요. Audit 로그온으로 작성된 Audit 파일은 MCP 토큰과 전체 프롬프트를 저장할 수 있으며, 우클릭을 하세요 “AI에게 전송” 컨텍스트는 프라이버시 모드를 우회할 수 있습니다; 두 권고 모두 어떤 자격 증명을 교체해야 하는지 명시합니다. 이들 중 어느 곳에도 CVE나 GHSA 식별자가 발급된 적이 없습니다.

v1에 새로운 소식은 무엇이 있을까요.

Custom AI Agent

The bridge between Burp Suite and modern AI.

A note on the name: This extension is published as Custom AI Agent (formerly Burp AI Agent). It was renamed to comply with PortSwigger’s BApp Store naming requirements and to avoid confusion with Burp Suite’s built-in Burp AI provider. The GitHub repository (github.com/six2dez/burp-ai-agent), the documentation site (burp-ai-agent.six2dez.com), and the configuration directory (~/.burp-ai-agent/) keep the burp-ai-agent identifier for continuity.

Custom AI Agent is an extension for Burp Suite that integrates AI into your security workflow. Use local models or cloud providers, connect external AI agents via MCP, and let passive/active scanners find vulnerabilities while you focus on manual testing.

[!IMPORTANT] If you are running 1.0.0 or earlier, read the security advisories and upgrade to the latest release, 1.1.0. Audit files written with Audit logging on may hold the MCP token and full prompts, and right-click “send to AI” context could bypass the privacy mode; both advisories say which credentials to rotate. No CVE or GHSA identifier has been issued for any of them.

What’s new in v1.1.0

Two builds from one repository, built for the BApp Store resubmission. Full detail in CHANGELOG.md.

• Two builds. The BApp Store build (./gradlew bappJar) has the 8 extension-native MCP tools, Burp AI and the six HTTP backends. The GitHub full build (./gradlew fullJar) has all 59 MCP tools, the five CLI backends, the external MCP client and the opt-in auto-queue. Both are on Releases, each with a .sha256. Load only one at a time; Which Build? compares them.
• The BApp Store build’s AI gate. The BApp Store build runs on Burp Community and Burp Professional; it sends AI requests only while Burp’s “Use AI” setting is enabled for the extension, and with it off it loads and refuses every AI request.
• Passive scans send nothing to the target. Passive findings the AI Active Scanner can test are listed as suggested targets in its queue dialog, in both builds, and you queue them by hand: nothing is sent to a target before you confirm.
• Clean unload. Unloading leaves no thread, timer or MCP listener of the extension running and starts no new request to an AI provider.
• Issue details are HTML-encoded. Payloads, values taken from the target and AI text show as literal text in Burp’s issue view and reports.
• The AI scanners start OFF at every load, in both builds; switching one on lasts until Burp unloads the extension.

What’s new in v1.0.1