Burp MCP服务器

Burp MCP Server

Burp Suite extension that exposes an MCP server, letting LLM-powered tools interact with Burp's proxy, scanner, and intercept features.

Features

• 30 MCP tools across categories: HTTP requests, proxy history, encoding, scanner, Collaborator, intercept, config, editor, Repeater/Intruder
• Agent intercept — hold Burp Proxy traffic so the MCP client can inspect, modify, forward, or drop requests and responses
• Streamable HTTP transport on configurable host:port (default 127.0.0.1:9876)
• No approval prompts — every tool works as soon as the client connects. Approving individual tool calls is left to your MCP client (e.g. Claude Code's permission prompts), as in caido-mcp-server
• Auto-restart — the server restarts automatically when you change the bind host or port

Requirements

• Burp Suite (Community or Professional)
• Java 21+

Installation

Download

Grab the latest JAR from build/libs/, or build from source:

./gradlew shadowJar

The output JAR is build/libs/burp-mcp-server-1.0.0.jar.

Load in Burp

1. Open Burp Suite
2. Go to Extensions → Add
3. Set Extension type to Java
4. Select the JAR file
5. Click Next — the MCP tab will appear

MCP Client Setup

The MCP server listens at http://<host>:<port>/mcp (default http://127.0.0.1:9876/mcp).

Claude Code CLI

claude mcp add --transport http burp http://127.0.0.1:9876/mcp

.mcp.json

Add to your project's .mcp.json:

{
  "mcpServers": {
    "burp": {
      "type": "http",
      "url": "http://127.0.0.1:9876/mcp"
    }
  }
}

Claude Desktop

Add to your Claude Desktop config (claude_desktop_config.json):

{
  "mcpServers": {
    "burp": {
      "type": "http",
      "url": "http://127.0.0.1:9876/mcp"
    }
  }
}

Generic

Any MCP client that supports HTTP transport can connect to http://<host>:<port>/mcp.

Configuration

All settings are configurable from the MCP → Server tab in Burp Suite and persist across sessions. Changing the bind host or port restarts the server automatically.

The server has no authentication and no approval step: any program that can reach the port can drive Burp. Keep the bind host on 127.0.0.1 unless you intend to expose it.

Requests sent by a web browser (anything carrying an Origin header) are refused with 403, so a web page open in your browser cannot drive Burp — including through DNS rebinding. MCP clients such as Claude Code send no Origin header and are unaffected; browser-based MCP clients are not supported.

Tools

HTTP Requests

Burp UI Integration

Encoding / Utilities

Configuration

Proxy History

Capture → Mutate → Replay

Take a real browser request captured in proxy history, mutate one field, and resend it byte-faithfully (header order, casing, cookies preserved) so the request stays browser-faithful — the analog of manual Repeater/Intruder, driven programmatically.

Fingerprint note: these tools send via Burp's HTTP stack, so the TLS/JA3 the target sees is Burp's unless Burp egresses through a browser-JA3 upstream (e.g. an impersonating MITM proxy). The captured request supplies faithful HTTP-layer bytes; the upstream supplies the TLS fingerprint.

Scanner & Collaborator (Professional Edition only)

Agent Intercept

Agent Intercept

The agent intercept holds HTTP traffic passing through Burp Proxy (e.g. from a browser using Burp as its proxy) so the MCP client can decide what happens to each message. It is:

• not Burp's own Proxy → Intercept — that queue is driven from Burp's UI and the Montoya API cannot read it, which is why this extension keeps a queue of its own;
• not an intercept of the MCP connection — traffic between your agent and Burp is never held.

Turn it on with set_mcp_intercept_enabled, or with Hold proxy traffic for the agent under MCP → Server. Held messages appear in the MCP → Agent Intercept tab, where you can also forward, edit, or drop them by hand.

Workflow

1. Enable — call set_mcp_intercept_enabled with enabled: true; Burp begins holding proxied traffic
2. Inspect — call get_intercepted_requests / get_intercepted_responses to list held messages
3. Read — call get_intercepted_message_detail with a message ID to view the full raw HTTP content
4. Act — either:
   • forward_intercepted_message to send it on (optionally supply modifiedRaw or replacements to alter the content)
   • drop_intercepted_message to silently discard it
5. Disable — call set_mcp_intercept_enabled with enabled: false to auto-forward all remaining messages and stop intercepting

Limits

• Timeout: 10 minutes — unhandled messages are auto-forwarded after this period
• Max pending: 50 messages — when the queue is full, new messages pass through without being held

License

MIT