広告掲載
MCP.so
ログイン

BurpMCP MCP Server

@swgee

リポジトリ

基本情報

カテゴリ

開発者ツール

ライセンス

MIT

トランスポート

stdio

作者

swgee

BurpMCP MCP Server について

Burp Suite Extension with MCP Server to enhance manual application security testing

#http#security#extension#web#ai#mcp#hacking#gemini#vulnerability#bugbounty#cve#burpsuite#claude#llm#chatgpt

BurpMCP MCP Server の設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "burpmcp": {
      "autoApprove": [],
      "disabled": false,
      "timeout": 30,
      "url": "http://localhost:8181/mcp/sse",
      "transportType": "sse"
    }
  }
}

BurpMCP MCP Server のツール

ツール一覧はまだありません

この掲載には表示できるツール一覧がまだありません。サーバーにツールがないという意味ではありません。対応機能はプロジェクトのドキュメントをご確認ください。

上のボタンでサーバーのエンドポイントに接続し、ツール一覧を取得できます。

概要

What is BurpMCP?

BurpMCP is a Burp Suite extension that integrates with Model Context Protocol (MCP) clients like Claude Desktop and Cursor, allowing LLMs to assist in manual HTTP-based application security testing. It provides tools to save, send, and modify requests, generate Collaborator payloads, and view debug logs, serving as an AI-powered sidekick for security testers, vulnerability researchers, and bug bounty hunters.

How to use BurpMCP?

Download the jar from releases and load it into Burp. The MCP server runs by default on localhost port 8181 over SSE. Configure your MCP client (e.g., Cline, Dive) with the SSE URL http://localhost:8181/mcp/sse. For STDIO‑only clients like Claude Desktop, use the provided stdio-bridge.py script. To send a request, right‑click it in Burp and select Extensions -> Send to BurpMCP. Saved requests appear in the “Saved Requests” tab and can be retrieved by the LLM.

Key features of BurpMCP

  • Save requests for MCP clients to retrieve.
  • Send new HTTP/1.1 and HTTP/2 requests.
  • Resend saved requests with regex string replacements.
  • Generate Collaborator payloads and retrieve interactions.
  • View all MCP messages in server logs for debugging.

Use cases of BurpMCP

  • Autonomous testing of HTTP-based applications with LLM guidance.
  • Navigating unfamiliar attack surfaces with AI‑driven exploration.
  • Out‑of‑band vulnerability detection via Collaborator payloads.
  • Streamlining repeater‑like tasks for large numbers of requests.
  • Debugging LLM‑driven testing workflows by inspecting MCP messages.

よくある質問

1

Why do models sometimes omit headers like Content‑Length or URL encoding?

This is a known model limitation, not a bug in BurpMCP. The LLM occasionally fails to add required components to requests.

2

What should I check if an HTTP/2 request fails?

Examine the request for forbidden headers. The HTTP/2 tool parameter specifies that such headers should be excluded, but the model may ignore this instruction.

3

How can I fix CRLF line endings in HTTP/1.1 requests?

Some MCP clients cannot send `\r\n`. BurpMCP can automatically replace LF with CRLF. Enable this feature in the extension settings.

4

Why does the LLM sometimes hang after an error response?

Some MCP clients do not acknowledge error responses promptly. The best workaround is to use a client that supports timeouts, such as Cline.

5

Are there limitations when resending requests over HTTP/2?

Headers are joined by newlines and re‑split before sending, and cookies become separate headers. This makes manual injection of newlines into header values difficult, limiting HTTP/2 protocol vulnerability testing.

コメント

「開発者ツール」の他のコンテンツ

SSH MCP Server

hypnosis

SSH MCP server for AI agents: remote commands, file transfer, log search and server audits through OpenSSH.

1

NextBlock CMS

NextBlock

Open-source Next.js + Supabase CMS with a per-site MCP server: scaffold a site, then create pages, posts, navigation, media and SEO from Claude, Cursor or any MCP client. Streamable HTTP with a bearer token you mint in y

Moxie Docs

Jackalope-Dev

Automated codebase documentation for GitHub: searchable docs, MCP context for AI agents, doc drift detection, and Friday Cleanup PRs.

1

UXKIN

Real UI references for AI coding agents: 500,000+ real screens, 15k+ website design systems with a DESIGN.md, and 30k+ UI elements, so your agent builds UI that looks real, not AI slop.

Agent Conductor

icohangar-ops

Agent conductor — AGENTS.md contract parser, SKILL.md registry, CHP decision engine over MCP

広告掲載