BurpMCP 是一个 Burp Suite 扩展，为应用安全测试人员、漏洞研究员和漏洞赏金猎人提供现代人工智能的增强。每天都有大型语言模型获得更大的上下文窗口、更快的响应时间以及更强的知识和推理能力。BurpMCP 让你在测试基于 HTTP 的应用时利用这些能力，成为一个超级智能的助手，帮助你导航陌生的攻击面并追踪复杂漏洞。

BurpMCP 专注于通过将 Burp Suite 与模型上下文协议（MCP）客户端如 Claude Desktop、Cursor 等集成，增强基于大型语言模型的手动应用安全测试，从而提示 AI 代表你自主进行测试，并完全控制和可视化模型的操作。

特色：

• ：notebook：扩展中的保存请求，供MCP客户端使用Get-Saved-Request工具检索
• ：hammer：发送新的 HTTP/1.1 和 HTTP/2 请求，并在请求日志标签页中查看
• :p encil2：用正则表达式字符串替换重发已保存的请求，以加快调整速度（类似LLM的Repeater）

BurpMCP

BurpMCP is a Burp Suite extension that augments application security testers, vulnerability researchers, and bug bounty hunters with modern AI. Every day, large language models gain larger context windows, faster response times, and improved knowledge and reasoning skills. BurpMCP lets you take advantage of these capabilities while testing HTTP-based applications, providing a super-intelligent sidekick to help navigate unfamiliar attack surfaces and chase down complex vulnerabilities.

BurpMCP focuses on enhancing manual application security testing with the help of LLMs by integrating Burp Suite with Model Context Protocol (MCP) clients like Claude Desktop, Cursor, etc. so you can prompt AI to perform autonomous testing on your behalf with full control and visibility of the model’s actions.

Features:

• :notebook: Save requests in the extension for MCP clients to retrieve using the Get-Saved-Request Tool
• :hammer: Send new HTTP/1.1 and HTTP/2 requests and view them in the Request Logs tab
• :pencil2: Resend saved requests with regex string replacements for faster tweaking (like Repeater for LLMs)
• :satellite: Generate Collaborator payloads and retrieve interactions for LLM-led out-of-band testing
• :microscope: View all MCP messages in the Server logs tab for easy debugging

The extension starts an MCP Server that interfaces directly with the Burp Suite extension API. For more information on Model Context Protocol, refer to the docs.

Installation

Download the jar file from the releases and load it into Burp to install.

The MCP server runs by default on localhost port 8181 over SSE. The configuration syntax varies depending on your MCP client, but here are a few examples:

Cline:

{
  "mcpServers": {
    "burpmcp": {
      "autoApprove": [],
      "disabled": false,
      "timeout": 30,
      "url": "http://localhost:8181/mcp/sse",
      "transportType": "sse"
    }
  }
}

Dive:

{
  "mcpServers": {
    "BurpMCP": {
      "transport": "sse",
      "url": "http://localhost:8181/mcp/sse"
    }
  }
}

To use BurpMCP with STDIO-only clients like Claude Desktop, download the stdio-bridge.py script and install the required dependencies:

pip3 install typer mcp

Then, add the following configuration to your claude_desktop_config.json. Make sure the host and port match what you configure in BurpMCP.

{
  "mcpServers": {
    "BurpMCP": {
      "command": "python3",
      "args": ["path/to/stdio-bridge.py", "http://localhost:8181/mcp/sse"],
      "env": {}
    }
  }
}

Usage

To send requests to BurpMCP, right-click any request and click `Extensions -> Send to BurpMCP".