---
title: "Burp Suite MCP Server: Connect an AI to Burp (PortSwigger)"
url: "https://mcpshelf.co/servers/burp-suite"
description: "PortSwigger's Burp extension lets an assistant send requests, read proxy history, fill Repeater and Intruder, and see scanner issues. Install and config."
updated: "2026-10-27"
site: "MCP Shelf"
---

# Burp Suite MCP

> Lets an assistant send requests, read proxy history and use Repeater in Burp Suite.

Source: https://mcpshelf.co/servers/burp-suite  
Markdown: https://mcpshelf.co/servers/burp-suite.md  
Generated: 2026-10-27T13:27:24.370Z

## Facts

- **Name:** Burp Suite MCP
- **Tagline:** Lets an assistant send requests, read proxy history and use Repeater in Burp Suite.
- **Description:** Burp Suite MCP is PortSwigger's official extension that lets an assistant send and read HTTP traffic, work with Repeater and Intruder, and query proxy history in Burp Suite.
- **Repository:** https://github.com/PortSwigger/mcp-server
- **Install:** `claude mcp add --transport sse burp http://127.0.0.1:9876`
- **Transport:** stdio (local)
- **Auth:** Needs `Enabled`
- **Tools exposed:** 27: `send_http1_request`, `send_http2_request`, `create_repeater_tab`, `create_repeater_tab_http2`, `send_to_intruder`, `url_encode`, `url_decode`, `base64_encode`, `base64_decode`, `generate_random_string`, `set_project_options`, `set_user_options`, `get_scanner_issues`, `generate_collaborator_payload`, `get_collaborator_interactions`, `get_proxy_http_history`, `get_proxy_http_history_regex`, `get_organizer_items`, `get_organizer_items_regex`, `get_proxy_websocket_history`, `get_proxy_websocket_history_regex`, `set_task_execution_engine_state`, `set_proxy_intercept_state`, `set_active_editor_contents`, `output_project_options`, `output_user_options`, `get_active_editor_contents`
- **Category:** Developer tools (https://mcpshelf.co/categories/developer-tools)
- **Stats:** 1.3K GitHub stars, last commit 16 Oct 2026, 0 upvotes on MCP Shelf
- **Install check:** Needs your setup first
- **Listed:** 2026-10-27
- **Page updated:** 2026-10-27

## Full description

### What is Burp Suite MCP?

**Burp Suite MCP is PortSwigger's official extension that lets an assistant send and read HTTP traffic, work with Repeater and Intruder, and query proxy history in Burp Suite.**

PortSwigger, the company behind Burp Suite, publishes this extension. Once it is loaded, Burp runs a small MCP server on your computer, and the model can send HTTP/1.1 and HTTP/2 requests, search the proxy and WebSocket history, open requests in Repeater or Intruder, encode and decode values, and switch interception on or off. In Burp Suite Professional it can also read scanner issues and make Collaborator payloads for out-of-band testing.

Burp asks before the model sends a request or reads your history, unless you turn those prompts off. Tools that change Burp’s settings stay off until you tick a box. Use it only on systems you are allowed to test.

|  |  |
| --- | --- |
| Made by | PortSwigger (PortSwigger/mcp-server) |
| GitHub | https://github.com/PortSwigger/mcp-server |
| Licence | GPL-3.0 |
| GitHub stars | 1.3K |
| Last commit | 16 Oct 2026 |
| Tools | 27 |
| Runs on | Your computer |
| Install check | Needs your setup first |
| Category | [Developer tools](https://mcpshelf.co/categories/developer-tools) |
| Setup checked | 27 Oct 2026 |
| Page updated | 27 Oct 2026 |

**Our check:** It needs something our Linux test machine does not have (an account, a desktop app, a Mac or a running service), so on 27 Oct 2026 we read its tools from the source code instead of running this config. The npm package called mcp-server is an unrelated project. This server is a Burp extension, installed inside Burp.

#### MCP Shelf take

> Burp Suite needs something our Linux test machine does not have (an account, an app or a service), so on 27 Oct 2026 we read its source and counted 27 tools. 9 of the 27 only read; the other 18 can change things. Other directories point at a package with the same name that belongs to someone else; the config on this page installs the real one. It sits 20th of 21 in its category on our shelf by GitHub stars (1.3K).

— MCP Shelf tests (numbers from our own runs), tested on 27 Oct 2026

### What tools does Burp Suite MCP have?

We listed 27 tools on 27 Oct 2026. 9 only read; the rest can change things or run commands.

| Tool | Kind | What it is for |
| --- | --- | --- |
| `send_http1_request` | changes | Sends a raw HTTP/1.1 request and returns the response. |
| `send_http2_request` | changes | Sends an HTTP/2 request built from pseudo-headers, headers and a body. |
| `create_repeater_tab` | changes | Opens an HTTP/1.1 request in a new Repeater tab. |
| `create_repeater_tab_http2` | changes | Opens an HTTP/2 request in a new Repeater tab. |
| `send_to_intruder` | changes | Sends a request to Intruder. |
| `url_encode` | changes | URL-encodes a string. |
| `url_decode` | changes | URL-decodes a string. |
| `base64_encode` | changes | Base64-encodes a string. |
| `base64_decode` | changes | Base64-decodes a string. |
| `generate_random_string` | changes | Makes a random string of a given length and character set. |
| `set_project_options` | changes | Merges JSON into the project settings. Off unless config editing is allowed. |
| `set_user_options` | changes | Merges JSON into the user settings. Off unless config editing is allowed. |
| `get_scanner_issues` | reads | Lists the scanner's findings. Professional only. |
| `generate_collaborator_payload` | changes | Makes a Collaborator address for out-of-band testing. Professional only. |
| `get_collaborator_interactions` | reads | Checks for DNS, HTTP or SMTP hits on Collaborator payloads. Professional only. |
| `get_proxy_http_history` | reads | Pages through the proxy HTTP history. |
| `get_proxy_http_history_regex` | reads | Pages through the proxy history entries that match a regular expression. |
| `get_organizer_items` | reads | Pages through items saved in Organizer. |
| `get_organizer_items_regex` | reads | Pages through Organizer items that match a regular expression. |
| `get_proxy_websocket_history` | reads | Pages through the WebSocket history. |
| `get_proxy_websocket_history_regex` | reads | Pages through WebSocket messages that match a regular expression. |
| `set_task_execution_engine_state` | changes | Pauses or resumes Burp's task engine. |
| `set_proxy_intercept_state` | changes | Turns proxy interception on or off. |
| `set_active_editor_contents` | changes | Replaces the text in that editor. |
| `output_project_options` | changes | Exports the project settings as JSON, with credentials filtered out by default. |
| `output_user_options` | changes | Exports the user settings as JSON. |
| `get_active_editor_contents` | reads | Reads the message editor you have focused in Burp. |

### How do I install Burp Suite MCP?

#### What you need first

- Burp Suite Community or Professional
- The MCP Server extension, from the BApp Store or built from source
- Java, which comes bundled with Burp

1. In Burp, open Extensions > BApp Store and install MCP Server. To build it yourself instead, clone the repository, run ./gradlew embedProxyJar and add build/libs/burp-mcp-all.jar under Extensions > Add.
2. Open the new MCP tab and check that the server is enabled. It listens on http://127.0.0.1:9876 by default.
3. Use the tab's installer to write the Claude Desktop config, or to extract the proxy jar for other clients.

#### Claude Code

Where: Your terminal, with Burp open

```bash
claude mcp add --transport sse burp http://127.0.0.1:9876
```

Claude Code can talk to the extension's SSE server directly, so no proxy jar is needed. Change the address if you set another host or port in Burp's MCP tab.

#### Cursor

Where: ~/.cursor/mcp.json, or .cursor/mcp.json in a project

```json
{
  "mcpServers": {
    "burp-suite": {
      "command": "/path/to/burp/java",
      "args": [
        "-jar",
        "/path/to/mcp-proxy-all.jar",
        "--sse-url",
        "http://127.0.0.1:9876"
      ]
    }
  }
}
```

#### Claude Desktop

Where: claude_desktop_config.json (Settings → Developer → Edit Config)

```json
{
  "mcpServers": {
    "burp-suite": {
      "command": "/path/to/burp/java",
      "args": [
        "-jar",
        "/path/to/mcp-proxy-all.jar",
        "--sse-url",
        "http://127.0.0.1:9876"
      ]
    }
  }
}
```

Easier: use the installer in Burp's MCP tab, which writes this entry with the right Java and jar paths. Restart Claude Desktop while Burp is running.

#### VS Code

Where: .vscode/mcp.json in your project

```json
{
  "servers": {
    "burp-suite": {
      "type": "stdio",
      "command": "/path/to/burp/java",
      "args": [
        "-jar",
        "/path/to/mcp-proxy-all.jar",
        "--sse-url",
        "http://127.0.0.1:9876"
      ]
    }
  }
}
```

#### Windsurf

Where: ~/.codeium/windsurf/mcp_config.json

```json
{
  "mcpServers": {
    "burp-suite": {
      "command": "/path/to/burp/java",
      "args": [
        "-jar",
        "/path/to/mcp-proxy-all.jar",
        "--sse-url",
        "http://127.0.0.1:9876"
      ]
    }
  }
}
```

#### ChatGPT

Where: Not supported

ChatGPT only connects to remote servers by URL. This one runs on your computer, so use Claude, Cursor or VS Code.

Clients that support SSE can skip the proxy and connect straight to http://127.0.0.1:9876. Otherwise point "command" at the Java that ships with Burp and the first path at the proxy jar the installer extracted.

Checked against the project's own install docs on 27 Oct 2026: https://github.com/PortSwigger/mcp-server#readme, https://portswigger.net/bappstore

### How do I configure Burp Suite MCP?

| Setting | Kind | Required | What it does |
| --- | --- | --- | --- |
| `Enabled` | config | yes | In Burp's MCP tab: whether the server is running. |
| `Enable tools that can edit your config` | config | no | Lets the two set_*_options tools change Burp's settings. Off by default. |
| `Require approval for HTTP requests` | config | no | Burp asks you before each request the model sends. On by default; you can pre-approve targets. |
| `Require approval for project data access` | config | no | Burp asks before the model reads the proxy history, WebSocket history or Organizer. On by default. |
| `Host and port` | config | no | Where the server listens. Default http://127.0.0.1:9876. Example: `127.0.0.1:9876` |

### What can Burp Suite MCP read and change?

**It can read**

- Proxy, WebSocket and Organizer history
- Scanner issues and Collaborator hits, in Professional
- Burp's settings, with credentials filtered

**It can change**

- Sends real HTTP requests to targets
- Repeater and Intruder tabs, interception and the task engine
- Burp's settings, only if config editing is turned on

**Safer setup:** Keep both approval prompts on, pre-approve only targets in your scope, and leave config editing off.

### Good for

- Replaying and tweaking a request from the proxy history
- Searching captured traffic for tokens, errors or interesting parameters
- Explaining scanner findings in plain language

### Burp Suite MCP not working? Common fixes

**Claude Desktop cannot reach Burp**
Burp must be running with the extension loaded and enabled before you start the client. Check the MCP tab.

**java: command not found**
Point the command at the Java that ships inside Burp. The installer in the MCP tab fills this in for you.

**Requests fail with 400 errors**
Line endings may be wrong. The extension fixes literal \r\n in headers; for HTTP/2 targets use the HTTP/2 tools and keep headers out of the body.

**Scanner and Collaborator tools are missing**
They only load in Burp Suite Professional.

### What are the alternatives to Burp Suite MCP?

| Server | What it does | Tools | Runs on | Licence | Stars |
| --- | --- | --- | --- | --- | --- |
| [Burp Suite MCP](https://mcpshelf.co/servers/burp-suite) | Lets an assistant send requests, read proxy history and use Repeater in Burp Suite. | 27 | Your computer | GPL-3.0 | 1.3K |
| [Ref MCP](https://mcpshelf.co/servers/ref) | Docs search for coding agents that returns only the part of the page that matters. | 2 | Your computer or hosted | MIT | 1.2K |
| [Desktop Commander](https://mcpshelf.co/servers/desktop-commander) | A terminal, file search and surgical file edits for your assistant. | 25 | Your computer | MIT | 10.1K |
| [Serena](https://mcpshelf.co/servers/serena) | IDE-style "find symbol" and "edit symbol" for an agent, backed by language servers. | 3 (REPL) | Your computer | GPL-3.0 | 30.8K |
| [Context7](https://mcpshelf.co/servers/context7) | Pulls current, version-specific library docs into the conversation. | 2 | Your computer or hosted | MIT | 63.8K |
| [GitHub](https://mcpshelf.co/servers/github) | GitHub's own server for repos, issues, pull requests and Actions. | 46 | Hosted or your computer | MIT | 34K |

### Burp Suite MCP FAQ

#### How do I connect Burp Suite to Claude?

Install MCP Server from Burp's BApp Store, check that it is enabled in the new MCP tab, then use that tab's installer for Claude Desktop. Keep Burp open while you work.

#### How do I add Burp Suite MCP to Claude Code?

With Burp running and the extension enabled, run claude mcp add --transport sse burp http://127.0.0.1:9876. Clients without SSE support use the proxy jar the extension can extract.

#### Does it work with Burp Suite Community?

Yes, most tools do. The scanner and Collaborator tools need Burp Suite Professional.

#### Can the model attack sites on its own?

It can only send requests through Burp, and by default Burp asks you to approve them first. Test only systems you have permission to test, and keep those prompts on.

#### Is Burp Suite MCP safe to use?

It gives the model access to your proxy history, which can hold cookies and tokens. Keep the approval prompts for requests and project data on, and leave config editing off.

#### Is it on npm?

No. The npm package named mcp-server is unrelated. This is a Burp extension from PortSwigger.

#### Why does Claude Desktop not see Burp?

Burp must be running with the extension enabled before Claude starts, and the config must point at the Java bundled with Burp and the extracted proxy jar.

#### Is Burp Suite MCP free?

The extension is free and GPL-3.0 licensed. Burp Suite Community is free; Professional is a paid product.

Full docs on GitHub: https://github.com/PortSwigger/mcp-server

## Notes for agents

Fetch these instead of parsing the HTML page:

- llms.txt: https://mcpshelf.co/llms.txt
- llms-full.txt: https://mcpshelf.co/llms-full.txt
- ai.txt: https://mcpshelf.co/ai.txt
- Full catalog (.md): https://mcpshelf.co/catalog.md
- API spec: https://mcpshelf.co/openapi.json
- MCP server: https://mcpshelf.co/mcp
- MCP manifest: https://mcpshelf.co/.well-known/mcp.json
- Developer docs: https://mcpshelf.co/developers

MCP endpoint (Streamable HTTP, no key): https://mcpshelf.co/mcp. REST API: https://mcpshelf.co/api/v1.