On this page
The Burp MCP server to use is PortSwigger's own MCP Server extension, free in
the BApp Store for Burp Pro and Community. It runs on 127.0.0.1:9876 with no
login. Burp asks before the AI sends a request or reads your history, but not
before every action. TrustedMCP grades it C.
What the Burp MCP server does
It lets an AI client use Burp's tools while Burp runs on your machine. The BApp Store page names PortSwigger staff as the authors, and the source is on GitHub.
The table comes from the extension's tool code. The middle column matters most, because it shows where you still get a say with the default settings.
| What the AI can do | Does Burp ask first? | Editions |
|---|---|---|
| Send HTTP/1.1 and HTTP/2 requests | Yes, per host | Pro, Community |
| Read and regex-search proxy HTTP and WebSocket history | Yes | Pro, Community |
| Read Organizer items | Yes | Pro, Community |
| Create Repeater tabs, send a request to Intruder | No (this fills the tab, it doesn't send anything) | Pro, Community |
| Read scanner issues | No | Pro only |
| Create Collaborator payloads and read interactions | No | Pro only |
| Read project and user settings | No (passwords are masked by default) | Pro, Community |
| Turn proxy intercept on or off, pause the task engine | No | Pro, Community |
| Read or change the message editor you have open | No | Pro, Community |
| Change project and user settings | Off until you tick a box | Pro, Community |
| URL and Base64 encoding, random strings | No | Pro, Community |
How we checked: we read the extension's source, its BApp Store page and its issue tracker on 2026-11-05. We didn't install it or run any tools.
Only point it at systems you have permission to test. The agent acts with your Burp and your network, and the responsibility stays with you.
How to set up the Burp Suite MCP server
1. Install the extension
- In Burp, open Extensions > BApp Store.
- Find MCP Server and install it. A new MCP tab appears.
- In that tab, check Enabled is ticked. The server listens on
http://127.0.0.1:9876.
You can also build it from source with ./gradlew embedProxyJar, which the
README covers. Keep Burp open while
you work, because the server runs inside it.
2. Connect your client
Claude Desktop. Use the installer button in the MCP tab, then restart Claude Desktop. Or edit the config by hand with PortSwigger's snippet, which starts a small proxy that talks to Burp:
{
"mcpServers": {
"burp": {
"command": "<path to Java executable packaged with Burp>",
"args": [
"-jar",
"/path/to/mcp/proxy/jar/mcp-proxy-all.jar",
"--sse-url",
"http://127.0.0.1:9876"
]
}
}
}
The installer option in the MCP tab can also extract that proxy jar for you.
Claude Code, Cursor and VS Code. PortSwigger doesn't publish a snippet for these. Its README says to give your MCP client the server URL, so these are our own translations of that URL. We haven't run them.
Claude Code:
claude mcp add --transport sse burp http://127.0.0.1:9876
Cursor (.cursor/mcp.json):
{
"mcpServers": {
"burp": { "url": "http://127.0.0.1:9876" }
}
}
VS Code (.vscode/mcp.json):
{
"servers": {
"burp": { "type": "sse", "url": "http://127.0.0.1:9876" }
}
}
More on each client: Claude Code MCP setup and VS Code MCP.
Codex and Streamable HTTP. PortSwigger's development repo
merged a /mcp endpoint and a Codex plugin
on 4 November 2026. The BApp Store still showed version 1.3.0, dated 28 May 2026,
when we checked, so don't assume your install serves /mcp yet.
How the approval prompts work
By default, Burp opens a dialog when the AI wants to do one of the gated actions.
- Sending a request: you see the target and can pick Allow Once, Always Allow Host, Always Allow Host:Port or Deny.
- Reading history or Organizer: you can pick Allow Once, Always Allow for that data type, or Deny. The dialog warns that this "may include sensitive data from previous web sessions."
For a long session, add your in-scope hosts to the auto-approve list in the MCP
tab instead of clicking through each one. It accepts host, host:port and
wildcards such as *.example.com. Keep it to the systems you're allowed to test.
If you turn the approval settings off, nothing stands between the model and your
targets.
Watch the Burp window. The call waits while the dialog is open, so it can look like your client has hung. If the client gives up first, click Deny. A report against 1.3.0 showed that clicking Allow after a timeout still sent the request, even though the client had already been told the call failed, so a retry would send it twice. The source was fixed on 27 October 2026, but check that you have a newer build before relying on that.
What can go wrong with an AI in Burp
Your proxy history goes to your AI provider. History holds session cookies, bearer tokens, and whatever else passed through the proxy. Once you allow access, the model's provider receives what the tool returns. The BApp page says so plainly: "Any data sent to external tools via this extension is subject to their data processing policies." Use a clean project per engagement, and check what your client contract allows before you connect. Always Allow on history is the setting we'd avoid.
The site you're testing can talk to your agent. Every response the model reads is written by the target, and a hostile page can include instructions aimed at the model. That's prompt injection, and a pentest is close to the worst case: you're pointing the agent at untrusted content on purpose, while it holds tools that can send requests. Host approval limits where those requests can go, which is why a broad auto-approve list is a real risk.
Requests are real. An approved request hits the live target. A model that retries, or that decides to try a state-changing call, can change data or trip alerts. Read the request in the dialog rather than approving on the hostname alone.
There's no login on the server. Any program on your machine can reach the port
without a key. Burp blocks browser requests and checks the Host and Origin
headers, which protects against a malicious web page, but not against other local
software. Approval prompts still apply to those callers, but the ungated actions
in the table don't.
Leave the host at 127.0.0.1. The MCP tab lets you change the host, but the
server has no login or TLS, so don't expose it on a network. Two more settings to
leave alone: Enable tools that can edit your config should stay off unless
you need it for one job, and credential masking should stay on. Masking covers
Burp's own password, certificate_password and hashed_key settings, not secrets
stored under other names.
To cut down what the model can do from the client side, see how to limit MCP tools.
Burp MCP troubleshooting
| What you see | Likely cause | What to do |
|---|---|---|
| Connection refused | Burp is closed, the server isn't enabled, or you changed the port | Open Burp, check the MCP tab, match the port in your client |
| A call hangs, then times out | Burp is waiting on an approval dialog | Answer the dialog, or add the host to auto-approve |
Blocked DNS rebinding attack from host in the extension output, 403 |
You're connecting by an address other than localhost or 127.0.0.1, for example from WSL |
Run the client on the same machine as Burp and connect by a loopback address |
Blocked browser request without Origin header, 403 |
Your client's user agent looks like a browser | Use the stdio proxy instead |
| No scanner or Collaborator tools | You're on Community Edition | Those need Burp Pro |
User has disabled configuration editing |
The settings tools are off by default | Tick the box only if you need them |
| Scanner tool returns the same few issues | Open report on the tracker | Check the issues in Burp itself for now |
For general connection errors, see MCP server not working.
Official extension or a community Burp MCP server?
We graded only PortSwigger's extension. These are described, not graded:
- Burp-MCP-Unrestricted is an unofficial fork that adds site map, scan and crawl tools. Its README says the official extension suits a short, supervised session and points you to the BApp Store for the supported version.
- Custom AI Agent (formerly Burp AI Agent) is a bigger extension with its own AI features. Its README warns users of 1.0.0 or earlier to read its security advisories and upgrade, because audit files could hold the MCP token.
- BurpMCP-Ultra advertises 150 tools for Burp Pro. Check what that many tool definitions cost you in context.
More tools means more that can run against a live target, so read the source first.
Don't confuse any of these with the
Burp Suite DAST MCP server.
That's a separate PortSwigger product: it runs in the DAST web server at
https://<your-dast-hostname>/mcp/v1 and signs in with an API key.
How we graded it
| Check | Points | Why |
|---|---|---|
| Authentication | 0 of 30 | No login of any kind on the local server. Approval prompts help, but they aren't authentication |
| Maintenance | 25 of 25 | Commits on 3 and 4 November 2026 from more than one PortSwigger developer |
| Known CVEs | 25 of 25 | None in NVD or in GitHub's advisories for the extension |
| Transport safety | 14 of 20 | Loopback HTTP and a stdio proxy, no shell-out, but no TLS |
Overall: grade C. Almost all of the deduction is the missing login. Grades come from public data and aren't an audit. See how we score servers and what makes MCP servers risky.
Need an MCP server with real sign-in and narrow permissions for your own security tooling? Tell us what you need to connect.
Frequently asked questions
Does Burp Suite have an official MCP server?
Yes. PortSwigger publishes the MCP Server extension in the BApp Store, with its source in the PortSwigger/mcp-server repo on GitHub.
Does Burp MCP work with Burp Community Edition?
Yes. The extension lists both Pro and Community as supported. You lose the Pro-only features, which are scanner issues and Collaborator.
Is the Burp MCP server free?
The extension is free, and Community Edition works with it. You still pay for your AI client or model, and for Burp Pro if you want the scanner and Collaborator tools.
What port does Burp MCP use?
127.0.0.1:9876 by default. You can change the host and port under advanced
options in the MCP tab. If you do, update your client to match.
Can the AI run Burp Scanner through MCP?
Not with the current tools. It can read scanner issues on Pro, but starting a scan is only an open pull request on GitHub.
Is the Burp MCP server safe to use?
TrustedMCP grades it C, mainly because the local server has no
login. It's safest with the host on 127.0.0.1, approvals on, a short auto-approve
list, and a separate Burp project for each job. The bigger risk is the content: your
history goes to your AI provider, and the sites you test can try to steer the model.
Why does Claude or Cursor say the Burp server failed to connect?
Burp has to be running first, with Enabled ticked in the MCP tab. The server lives inside Burp, so it stops when Burp closes. If you use the proxy, also check the Java path and the jar path in your config.