Burp MCP Agents

six2dez233stars

Practical setup guides and helpers to connect Burp Suite MCP Server to multiple AI backends (Codex, Gemini, Ollama, ...).

Install Run on PlugMCP

GitHub

Run on PlugMCP

1# Burp MCP Agents

README.mdMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

Install from the publisher. Not a PlugMCP endpoint.

Run on PlugMCP

Host a copy with our keys and logs.

No packaged release in the registry yet. Follow the repository README.

RepositoryPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
License: MIT
Last checked: 2026-10-28

Stars: 233
Tools: —
Uptime: —

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install Burp MCP Agents?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Burp MCP Agents need an API key?

No required environment variable is listed on this record.

What transport does Burp MCP Agents use?

Burp MCP Agents runs locally over stdio.

When was Burp MCP Agents last checked?

Last checked 2026-10-28. Practical setup guides and helpers to connect Burp Suite MCP Server to multiple AI backends (Codex, Gemini, Ollama, ...).

From the publisher

Documentation

Burp MCP Agents

Practical setup guides and helpers to connect Burp Suite MCP Server to multiple AI backends (Codex, Gemini, Ollama, LM Studio).

This repo focuses on wiring, safety-first workflows, and reusable prompts to analyze real Burp traffic.

No fuzzing. No blind scanning. Only real traffic + reasoning.

What this is

Burp MCP Agents is a collection of:

• Backend setup guides (Codex, Gemini, Ollama, LM Studio) • Caddy proxy configuration for MCP SSE • Prompt templates for passive analysis and reporting

Architecture

Burp Suite MCP Server
▲
│
MCP Bridge
│
┌──────────────────────────────────────────────┐
│              │              │                │
Codex CLI   Ollama Agent   Gemini CLI   LM Studio Agent

Supported Backends

Backend	Mode	Privacy	Difficulty
Codex CLI	Cloud	Medium	Easy
Ollama	Local	Full	Advanced
Gemini CLI	Cloud	Medium	Easy
LM Studio	Local	Full	Advanced

Quick start

All setups require:

Burp MCP Server plguin enabled
Caddy reverse proxy (see common/caddy_setup.md)
One backend of your choice

Install the Burp MCP Server extension

Download the Burp MCP Server extension (MCP server jar) from: https://portswigger.net/bappstore/9952290f04ed4f628e624d0aa9dccebc
In Burp Suite: Extender → Extensions → Add → select the jar or from BApp Store.
Start the extension and confirm it listens on 127.0.0.1:9876.

Codex CLI

See: codex/README.md

Example models

Model	Use
gpt-5.2-codex	General use
gpt-5.1	Faster
gpt-5-mini	Low resource

Ollama (fully local)

See: ollama/README.md

Example models

Model	VRAM	Notes
llama3.1:8b-instruct	8GB+	Small, fast
qwen2.5:14b-instruct	16GB	Mid size
llama3.1:70b-instruct	48GB+	Large, high VRAM

Gemini CLI

See: gemini-cli/README.md

Example models

Model	Notes
gemini-2.0-flash	Fast
gemini-2.0-pro	Deeper reasoning

LM Studio (local OpenAI-compatible)

See: lmstudio/README.md

Example models

Model	Notes
llama-3.1-8b-instruct	Small, fast
qwen2.5-14b-instruct	Mid size
llama-3.1-70b-instruct	Large, high VRAM

Prompts

The real power lives in prompts/:

Prompt	Purpose
passive_hunter.md	Broad passive vuln surfacing
idor_hunter.md	IDOR/BOLA discovery
auth_flow_mapper.md	Auth vs unauth access mapping
ssrf_redirect_hunter.md	SSRF/open redirect candidates
logic_flaw_hunter.md	Multi-step logic issues
session_scope_hunter.md	Token scope/audience misuse
rate_limit_abuse_hunter.md	Rate-limit and abuse gaps
report_writer.md	Evidence-based reporting

See prompts/README.md for usage guidance.

Optional launchers

You can use the backend launchers to auto-start Caddy and shut it down when the backend exits.

Source them directly:

source /path/to/burp-mcp-agents/codex/burpcodex.sh
source /path/to/burp-mcp-agents/gemini-cli/burpgemini.sh
source /path/to/burp-mcp-agents/ollama/burpollama.sh
source /path/to/burp-mcp-agents/lmstudio/burplmstudio.sh

Then run:

burpcodex
burpgemini
burpollama deepseek-r1:14b
burplmstudio llama-3.1-8b-instruct

To make these available in every shell, add the source lines to your ~/.zshrc.

What this enables

You are not running a scanner. You are reviewing real traffic with assisted reasoning.

Burp MCP Agents

six2dez233stars

Practical setup guides and helpers to connect Burp Suite MCP Server to multiple AI backends (Codex, Gemini, Ollama, ...).

Install Run on PlugMCP

GitHub

Run on PlugMCP

1# Burp MCP Agents

README.mdMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

Install from the publisher. Not a PlugMCP endpoint.

Run on PlugMCP

Host a copy with our keys and logs.

No packaged release in the registry yet. Follow the repository README.

RepositoryPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
License: MIT
Last checked: 2026-10-28

Stars: 233
Tools: —
Uptime: —

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install Burp MCP Agents?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Burp MCP Agents need an API key?

No required environment variable is listed on this record.

What transport does Burp MCP Agents use?

Burp MCP Agents runs locally over stdio.

When was Burp MCP Agents last checked?

Last checked 2026-10-28. Practical setup guides and helpers to connect Burp Suite MCP Server to multiple AI backends (Codex, Gemini, Ollama, ...).

From the publisher

Documentation

Burp MCP Agents

Practical setup guides and helpers to connect Burp Suite MCP Server to multiple AI backends (Codex, Gemini, Ollama, LM Studio).

This repo focuses on wiring, safety-first workflows, and reusable prompts to analyze real Burp traffic.

No fuzzing. No blind scanning. Only real traffic + reasoning.

What this is

Burp MCP Agents is a collection of:

• Backend setup guides (Codex, Gemini, Ollama, LM Studio) • Caddy proxy configuration for MCP SSE • Prompt templates for passive analysis and reporting

Architecture

Burp Suite MCP Server
▲
│
MCP Bridge
│
┌──────────────────────────────────────────────┐
│              │              │                │
Codex CLI   Ollama Agent   Gemini CLI   LM Studio Agent

Supported Backends

Backend	Mode	Privacy	Difficulty
Codex CLI	Cloud	Medium	Easy
Ollama	Local	Full	Advanced
Gemini CLI	Cloud	Medium	Easy
LM Studio	Local	Full	Advanced

Quick start

All setups require:

Burp MCP Server plguin enabled
Caddy reverse proxy (see common/caddy_setup.md)
One backend of your choice

Install the Burp MCP Server extension

Download the Burp MCP Server extension (MCP server jar) from: https://portswigger.net/bappstore/9952290f04ed4f628e624d0aa9dccebc
In Burp Suite: Extender → Extensions → Add → select the jar or from BApp Store.
Start the extension and confirm it listens on 127.0.0.1:9876.

Codex CLI

See: codex/README.md

Example models

Model	Use
gpt-5.2-codex	General use
gpt-5.1	Faster
gpt-5-mini	Low resource

Ollama (fully local)

See: ollama/README.md

Example models

Model	VRAM	Notes
llama3.1:8b-instruct	8GB+	Small, fast
qwen2.5:14b-instruct	16GB	Mid size
llama3.1:70b-instruct	48GB+	Large, high VRAM

Gemini CLI

See: gemini-cli/README.md

Example models

Model	Notes
gemini-2.0-flash	Fast
gemini-2.0-pro	Deeper reasoning

LM Studio (local OpenAI-compatible)

See: lmstudio/README.md

Example models

Model	Notes
llama-3.1-8b-instruct	Small, fast
qwen2.5-14b-instruct	Mid size
llama-3.1-70b-instruct	Large, high VRAM

Prompts

The real power lives in prompts/:

Prompt	Purpose
passive_hunter.md	Broad passive vuln surfacing
idor_hunter.md	IDOR/BOLA discovery
auth_flow_mapper.md	Auth vs unauth access mapping
ssrf_redirect_hunter.md	SSRF/open redirect candidates
logic_flaw_hunter.md	Multi-step logic issues
session_scope_hunter.md	Token scope/audience misuse
rate_limit_abuse_hunter.md	Rate-limit and abuse gaps
report_writer.md	Evidence-based reporting

See prompts/README.md for usage guidance.

Optional launchers

You can use the backend launchers to auto-start Caddy and shut it down when the backend exits.

Source them directly:

source /path/to/burp-mcp-agents/codex/burpcodex.sh
source /path/to/burp-mcp-agents/gemini-cli/burpgemini.sh
source /path/to/burp-mcp-agents/ollama/burpollama.sh
source /path/to/burp-mcp-agents/lmstudio/burplmstudio.sh

Then run:

burpcodex
burpgemini
burpollama deepseek-r1:14b
burplmstudio llama-3.1-8b-instruct

To make these available in every shell, add the source lines to your ~/.zshrc.

What this enables

You are not running a scanner. You are reviewing real traffic with assisted reasoning.