BurpMCP-Ultra is a native Kotlin Burp Suite extension with an embedded MCP (Model Context Protocol) server. It exposes Burp's Montoya API as 149 structured tools over a token-secured local SSE transport, so an AI agent can run proxy history analysis, active scans, fuzzing, race conditions, OOB testing, custom scan checks, and guided exploitation — all from natural language.

Why BurpMCP-Ultra?

Competitor counts are indicative, based on each project's public tool list.

Quick Start

1. Build

git clone https://github.com/Cy-S3c/BurpMCP-Ultra.git
cd BurpMCP-Ultra
./gradlew shadowJar

Output: build/libs/burpmcp-ultra-2.1.0.jar (~13 MB). A JDK 17–21 must be installed — see Building from Source. Pre-built JARs are on the Releases page.

2. Load into Burp

1. Burp Suite Pro → Extensions → Add
2. Select the JAR
3. The BurpMCP-Ultra tab appears with a green "Running" status and your connection token

3. Connect Claude Code

{
  "mcpServers": {
    "burp": {
      "type": "sse",
      "url": "http://127.0.0.1:9876/",
      "headers": {
        "Authorization": "Bearer PASTE_TOKEN_FROM_SERVER_TAB"
      }
    }
  }
}

Add to ~/.claude.json or your project's .mcp.json.

⚠️ The token is required, and the endpoint is the root path / — not /sse. Copy the token from the Server tab of the BurpMCP-Ultra panel in Burp (it is also accepted as a ?token=… query parameter or an mcp_token cookie). Without it the server returns 401, and clients like Claude Code then fall back to OAuth discovery and fail with SDK auth failed: HTTP 404: Invalid OAuth error response.

4. Open Dashboard

Browse to http://127.0.0.1:9878 for the real-time web dashboard.

Tools

149 MCP tools across 36 categories. Names are stable; the authoritative count is server.tools.size, surfaced in the Server tab.

Proxy (13)

HTTP (13)

Scanner (13)

Collaborator (7)

Intruder & Repeater (4)

WebSocket (7)

Offensive & Recon (11)

Offensive tools that issue live requests are scope-gated (see Security).

Analysis (7)

Advanced Analysis (3)

Utilities (12)

Custom Scan Checks — BCheck (5) + Script (5)

Scope & Sitemap (8)

Config & Burp (16)

Platform (25)

Resources (8)

Read-only MCP resources an agent can fetch without a tool call: burp://proxy/history · burp://proxy/websocket/history · burp://scanner/issues · burp://sitemap · burp://scope · burp://config/project · burp://config/user · burp://organizer/items

Highlight Features

Guided Injection Probe

injection_probe(
  request: "GET /item?id=FUZZ HTTP/1.1\r\nHost: shop.com\r\n\r\n",
  host: "shop.com", port: 443,
  classes: ["sqli", "ssti", "lfi"]      # optional; default all
)

Marks the injection point with FUZZ, then confirms vulnerabilities with deterministic oracles — SQL error fingerprints, time-delay analysis, template math-evaluation (1337*1337 → 1787569), and file-content markers — returning only confirmed findings with the triggering payload. For blind/OOB classes, pair collaborator_* with http_fuzz.

JWT Attacks

jwt_attack(token: "eyJ...", mode: "crack", wordlist: ["secret", "changeme", ...])

alg:none forgery, RS→HS algorithm-confusion forging, weak-secret dictionary cracking, and full structural analysis.

Access-Control Sweep

auth_diff / access_control_sweep
  request: "GET /api/users/1 HTTP/1.1\r\nHost: api.com\r\n\r\n",
  auth_levels: [
    {"name": "admin", "header_name": "Authorization", "header_value": "Bearer admin"},
    {"name": "user",  "header_name": "Authorization", "header_value": "Bearer user"},
    {"name": "none"}
  ]

Replays the same request(s) across identities, diffs the responses, and flags IDOR, privilege escalation, and missing authorization.

Race Condition Testing

http_race(request: "POST /api/transfer HTTP/1.1\r\nHost: bank.com\r\n\r\n{\"amount\":100}",
          host: "bank.com", port: 443, count: 20)

Fires 20 identical requests simultaneously via Burp's parallel engine and analyzes status/length distributions to detect TOCTOU, double-spend, and limit-bypass bugs.

Inline Fuzzer (3 modes)

# FUZZ keyword
http_fuzz(request: "GET /api?id=FUZZ HTTP/1.1\r\nHost: api.com\r\n\r\n", host: "api.com",
          port: 443, payloads: ["1", "admin", "../../etc/passwd"])
# §section§ markers (like Intruder)   |   # byte offsets: positions: [[12, 15]]
# built-in payload libraries via:     payload_library: "xss" | "sqli" | "lfi" | ...

Custom Scan Checks

# BCheck DSL
bcheck_create(name: "AWS Key Leak", type: "passive_response",
              match_pattern: "AKIA[0-9A-Z]{16}", severity: "high", confidence: "firm")
# Script mode — multi-step active check
scancheck_create_active(name: "SSTI", steps: [
  {"payload": "{{7*7}}", "response_conditions": [
    {"location": "response_body", "pattern": "49", "condition_type": "contains"}]}])

API Schema Import

api_import_openapi(spec_json: "<swagger/openapi JSON>", auth_header: "Authorization",
                   auth_value: "Bearer …", send_requests: true, add_to_sitemap: true)

Parses OpenAPI 3.x / Swagger 2.0 (resolving $ref), generates real requests with sample parameters/bodies for every endpoint, and optionally sends them — populating proxy history and sitemap. Out-of-scope sends are skipped and reported.

Passive Intelligence Extraction

passive_intel(max_items: 2000, in_scope_only: true)

Scans captured traffic for 30+ patterns with entropy de-noising to cut false positives:

• Cloud credentials — AWS keys, Google/Slack/Stripe/GitHub tokens
• Tokens & secrets — JWTs, Bearer/Basic auth, private keys
• Personal data — emails, internal IPs, phone numbers
• Cloud resources — S3/Azure/GCS buckets
• Infrastructure — internal URLs, GraphQL endpoints, API paths
• Errors & fingerprints — stack traces, SQL errors, server/framework versions
• Sensitive paths — /admin, /.env, /.git, /debug, /actuator

Security Model

BurpMCP-Ultra runs three local servers (SSE 9876/9877, dashboard 9878). Binding to 127.0.0.1 is not a trust boundary, so the transport is hardened and offensive tools are governed by operator-only controls the agent cannot change.

Transport hardening

• Host-header allowlist — defeats DNS rebinding.
• Origin lockdown — rejects cross-origin browser requests; CORS only advertises loopback.
• Per-session token — required on every request (Authorization: Bearer, mcp_token cookie, or ?token=). The dashboard uses an HttpOnly cookie, so the token never lives in a URL.

Operator governance (configured in Burp, not via MCP)

• mcp_scope_mode — off / warn / enforce. Every live-request tool passes through a central scope gate (http_*, auth_diff, api_import_openapi, recon_*, graphql_probe, cors_probe, access_control_sweep, injection_probe).
• mcp_allow_destructive — default false; blocks burp_shutdown and config import.
• Append-only audit log of security-relevant tool calls (~/.burpmcp-ultra-audit.jsonl).

Additional defenses: ReDoS-safe regex, CRLF header validation, and response/WebSocket size caps.

Web Dashboard

Open http://127.0.0.1:9878 for the real-time dashboard:

• Live Activity Stream with noise filtering (auto-hides Google/Apple/Microsoft connectivity checks)
• Attack Vector Detection — badges for AUTH, API, PARAMS, UPLOAD, ADMIN, DATA endpoints
• Request Detail Panel — click any item for full request info + send-to-tool actions
• Stats Bar — live counters for events, in-scope hosts, and attack-vector categories
• Filter Controls — type filters, URL search, noise toggle
• Active Rules — view all proxy, traffic, and session rules
• Connection Info — transport URLs and a ready-to-paste MCP client config

Setup Guides

{
  "mcpServers": {
    "burp": {
      "type": "sse",
      "url": "http://127.0.0.1:9876/",
      "headers": { "Authorization": "Bearer PASTE_TOKEN_FROM_SERVER_TAB" }
    }
  }
}

sudo apt install caddy

:9900 {
    reverse_proxy 127.0.0.1:9876 {
        transport http { read_timeout 0  write_timeout 0  response_header_timeout 0 }
        flush_interval -1
        header_up Connection {>Connection}
        header_up Upgrade {>Upgrade}
    }
}

sudo systemctl restart caddy

{
  "mcpServers": {
    "burp": {
      "type": "sse",
      "url": "http://127.0.0.1:9900/",
      "headers": { "Authorization": "Bearer PASTE_TOKEN_FROM_SERVER_TAB" }
    }
  }
}

{
  "mcpServers": {
    "burp": {
      "command": "npx",
      "args": ["-y", "supergateway", "--sse", "http://127.0.0.1:9876/", "--header", "Authorization: Bearer PASTE_TOKEN_FROM_SERVER_TAB"]
    }
  }
}

chmod +x configs/setup.sh
./configs/setup.sh

Architecture

+---------------------------------------------------+
|                BURP SUITE PRO                      |
|  +---------------------------------------------+  |
|  |        BurpMCP-Ultra Extension              |  |
|  |                                             |  |
|  |  Montoya API --> Bridge Layer (32 bridges)  |  |
|  |       |                |                    |  |
|  |  Event Bus    Tool Registry (149 tools)     |  |
|  |       |                |                    |  |
|  |       +------- MCP Server Core -------+     |  |
|  |               (Kotlin SDK 0.8.3)      |     |  |
|  |                    |                  |     |  |
|  |         +----------+----------+       |     |  |
|  |     SSE :9876  SSE :9877  Dashboard   |     |  |
|  |                            :9878      |     |  |
|  +---------------------------------------------+  |
+---------------------------------------------------+

Tech Stack

Requirements

To run (inside Burp):

• Burp Suite Professional 2025.x or later
• Java 17+ — provided by Burp's bundled JRE (nothing to install)

To build from source:

• A JDK 17–21 (LTS) installed. Building under Java 22+ (including Burp's bundled Java 25) is incompatible with the Kotlin 2.1.20 / Ktor 3.2.3 / MCP SDK toolchain and yields a JAR whose MCP SSE ports silently fail to bind. You do not need JDK 17 as your default, though: the build pins both compilation and the Gradle daemon to a JDK 17 toolchain (gradle/gradle-daemon-jvm.properties), so ./gradlew auto-runs under JDK 17 as long as one is installed and discoverable.
• Gradle 8.x — included via the committed wrapper (./gradlew / gradlew.bat).

Building from Source

The Gradle wrapper is committed, so no separate Gradle install is needed.

Linux / macOS

git clone https://github.com/Cy-S3c/BurpMCP-Ultra.git
cd BurpMCP-Ultra
# Gradle auto-selects an installed JDK 17 for the build daemon, so this works even if your
# default `java` is Burp's Java 25. If no JDK 17 is discoverable, install one (or set JAVA_HOME).
./gradlew shadowJar
# Output: build/libs/burpmcp-ultra-2.1.0.jar

Windows (PowerShell / cmd)

git clone https://github.com/Cy-S3c/BurpMCP-Ultra.git
cd BurpMCP-Ultra
:: Gradle auto-selects an installed JDK 17 for the build daemon, so this works even if your
:: default java is Burp's Java 25. If no JDK 17 is discoverable, install one (or set JAVA_HOME).
gradlew.bat shadowJar
:: Output: build\libs\burpmcp-ultra-2.1.0.jar

If no JDK 17 is found, Gradle fails with a clear "no compatible daemon JVM" error instead of silently producing a broken JAR. Kotlin 2.1.20 cannot even compile the Gradle build scripts under Java 22+, which is why the daemon is pinned to JDK 17.

Project Structure

BurpMCP-Ultra/
├── build.gradle.kts              # Build configuration
├── gradle/                       # Wrapper + daemon-JVM pin (JDK 17)
├── configs/                      # Ready-to-use config files (Caddyfile, MCP JSON, setup.sh)
├── src/main/kotlin/com/burpmcp/ultra/
│   ├── core/                     # Extension entry point + helpers
│   ├── bridge/                   # 32 Montoya API bridges
│   ├── tools/                    # 36 tool category modules (149 tools)
│   ├── safety/                   # Scope gate, action policy, ReDoS-safe regex
│   ├── transport/                # MCP server + dashboard + security
│   ├── events/                   # Unified event bus
│   ├── state/                    # State management
│   └── ui/                       # Swing UI tab
├── src/test/                     # 105 unit tests
└── docs/                         # Tool catalog + capability review

Contact & Support

• 🐛 Bugs & feature requests: GitHub Issues
• 📦 Releases & changelog: GitHub Releases
• 💬 Quick reach: Telegram @D4RK_V0RT3X

License

MIT