广告合作
MCP.so
登录

BurpMCP MCP Server

@swgee

代码仓库

基本信息

分类

开发工具

许可证

MIT

传输方式

stdio

作者

swgee

关于 BurpMCP MCP Server

Burp Suite Extension with MCP Server to enhance manual application security testing

#http#security#extension#web#ai#mcp#hacking#gemini#vulnerability#bugbounty#cve#burpsuite#claude#llm#chatgpt

BurpMCP MCP Server 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "burpmcp": {
      "autoApprove": [],
      "disabled": false,
      "timeout": 30,
      "url": "http://localhost:8181/mcp/sse",
      "transportType": "sse"
    }
  }
}

BurpMCP MCP Server 工具

工具列表暂未提供

当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。

点击上方按钮,直接连接服务器端点实时获取工具列表。

概览

What is BurpMCP?

BurpMCP is a Burp Suite extension that integrates with Model Context Protocol (MCP) clients like Claude Desktop and Cursor, allowing LLMs to assist in manual HTTP-based application security testing. It provides tools to save, send, and modify requests, generate Collaborator payloads, and view debug logs, serving as an AI-powered sidekick for security testers, vulnerability researchers, and bug bounty hunters.

How to use BurpMCP?

Download the jar from releases and load it into Burp. The MCP server runs by default on localhost port 8181 over SSE. Configure your MCP client (e.g., Cline, Dive) with the SSE URL http://localhost:8181/mcp/sse. For STDIO‑only clients like Claude Desktop, use the provided stdio-bridge.py script. To send a request, right‑click it in Burp and select Extensions -> Send to BurpMCP. Saved requests appear in the “Saved Requests” tab and can be retrieved by the LLM.

Key features of BurpMCP

  • Save requests for MCP clients to retrieve.
  • Send new HTTP/1.1 and HTTP/2 requests.
  • Resend saved requests with regex string replacements.
  • Generate Collaborator payloads and retrieve interactions.
  • View all MCP messages in server logs for debugging.

Use cases of BurpMCP

  • Autonomous testing of HTTP-based applications with LLM guidance.
  • Navigating unfamiliar attack surfaces with AI‑driven exploration.
  • Out‑of‑band vulnerability detection via Collaborator payloads.
  • Streamlining repeater‑like tasks for large numbers of requests.
  • Debugging LLM‑driven testing workflows by inspecting MCP messages.

常见问题

1

Why do models sometimes omit headers like Content‑Length or URL encoding?

This is a known model limitation, not a bug in BurpMCP. The LLM occasionally fails to add required components to requests.

2

What should I check if an HTTP/2 request fails?

Examine the request for forbidden headers. The HTTP/2 tool parameter specifies that such headers should be excluded, but the model may ignore this instruction.

3

How can I fix CRLF line endings in HTTP/1.1 requests?

Some MCP clients cannot send `\r\n`. BurpMCP can automatically replace LF with CRLF. Enable this feature in the extension settings.

4

Why does the LLM sometimes hang after an error response?

Some MCP clients do not acknowledge error responses promptly. The best workaround is to use a client that supports timeouts, such as Cline.

5

Are there limitations when resending requests over HTTP/2?

Headers are joined by newlines and re‑split before sending, and cookies become separate headers. This makes manual injection of newlines into header values difficult, limiting HTTP/2 protocol vulnerability testing.

评论

开发工具 分类下的更多 MCP 服务器

cve.now

Sazabi

Free, public vulnerability feed for coding agents. One deduplicated entry per CVE, GHSA or OSV id, merged from the CVE List, GitHub Advisories, OSV, NVD, CISA KEV, EPSS and Exploit-DB. check_stack scans a lockfile for kn

Yocoolab

Yocoolab

MCP server for AI Agents — exposes Yocoolab feedback threads and design selections as tools

1

FARPY

mangomunchr

Verified distributed compute for humans, applications, and agents. Submit Blender, Octane, and video workloads, route them across qualified GPUs, track asynchronous execution, download finished artifacts, and verify FARP

1

9apes

9apes

The 9apes MCP server lets an AI assistant read the GitHub Actions data 9apes already collects for your organization: runs, jobs, steps, and their durations. Ask it why a build got slower, which jobs take the longest, or

Vibgrate MCP

Vibgrate

Query your team's drift, vulnerability, and migration data from any AI assistant. Vibgrate MCP connects Cursor, Claude, ChatGPT, Windsurf, or VS Code to Vibgrate Cloud: 51 tools for DriftScores, CVEs and EOL runtimes, up

3
广告合作