1. Conduid
  2. Developer Tools
  3. Burp MCP Agents
MCP server · Developer Tools

Burp MCP Agents

by · github.com/six2dez/burp-mcp-agents

Practical setup guides and helpers to connect Burp Suite MCP Server to multiple AI backends (Codex, Gemini, Ollama, ...).

Unclaimed MIT last commit 7 months ago devtools
InstallView source
71Good

Scored 3 months ago · breakdown

About Burp MCP Agents

Burp MCP Agents is an MCP server published by six2dez in the Developer Tools category: practical setup guides and helpers to connect Burp Suite MCP Server to multiple AI backends (Codex, Gemini, Ollama, ...). It has been installed 0 times through Conduid.

The repository has 194 stars and 33 forks, with the last commit 7 months ago. Six months or more without a commit doesn't mean the server is broken, but check the open issues (0) before depending on it in production.

Install

Install
npx burp-mcp-agents

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about Burp MCP Agents

Powered by Claude · Grounded in docs

I know everything about Burp MCP Agents. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

  • ·README presentNot checked yet.
  • ·License declaredNot checked yet.
  • ·Tests presentNot checked yet.
  • ·Dependencies pinnedNot checked yet.
  • ·No dynamic code executionNot checked yet.
  • !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.

README

Burp MCP Agents

Practical setup guides and helpers to connect Burp Suite MCP Server to multiple AI backends (Codex, Gemini, Ollama, LM Studio).

This repo focuses on wiring, safety-first workflows, and reusable prompts to analyze real Burp traffic.

No fuzzing. No blind scanning. Only real traffic + reasoning.

What this is

Burp MCP Agents is a collection of:

• Backend setup guides (Codex, Gemini, Ollama, LM Studio) • Caddy proxy configuration for MCP SSE • Prompt templates for passive analysis and reporting

Architecture

Burp Suite MCP Server
▲
│
MCP Bridge
│
┌──────────────────────────────────────────────┐
│              │              │                │
Codex CLI   Ollama Agent   Gemini CLI   LM Studio Agent

Supported Backends

Backend Mode Privacy Difficulty
Codex CLI Cloud Medium Easy
Ollama Local Full Advanced
Gemini CLI Cloud Medium Easy
LM Studio Local Full Advanced

Quick start

All setups require:

  1. Burp MCP Server plguin enabled
  2. Caddy reverse proxy (see common/caddy_setup.md)
  3. One backend of your choice

Install the Burp MCP Server extension

  1. Download the Burp MCP Server extension (MCP server jar) from: https://portswigger.net/bappstore/9952290f04ed4f628e624d0aa9dccebc
  2. In Burp Suite: Extender → Extensions → Add → select the jar or from BApp Store.
  3. Start the extension and confirm it listens on 127.0.0.1:9876.

Codex CLI

See: codex/README.md

Example models

Model Use
gpt-5.2-codex General use
gpt-5.1 Faster
gpt-5-mini Low resource

Ollama (fully local)

See: ollama/README.md

Example models

Model VRAM Notes
llama3.1:8b-instruct 8GB+ Small, fast
qwen2.5:14b-instruct 16GB Mid size
llama3.1:70b-instruct 48GB+ Large, high VRAM

Gemini CLI

See: gemini-cli/README.md

Example models

Model Notes
gemini-2.0-flash Fast
gemini-2.0-pro Deeper reasoning

LM Studio (local OpenAI-compatible)

See: lmstudio/README.md

Example models

Model Notes
llama-3.1-8b-instruct Small, fast
qwen2.5-14b-instruct Mid size
llama-3.1-70b-instruct Large, high VRAM

Prompts

The real power lives in prompts/:

Prompt Purpose
passive_hunter.md Broad passive vuln surfacing
idor_hunter.md IDOR/BOLA discovery
auth_flow_mapper.md Auth vs unauth access mapping
ssrf_redirect_hunter.md SSRF/open redirect candidates
logic_flaw_hunter.md Multi-step logic issues
session_scope_hunter.md Token scope/audience misuse
rate_limit_abuse_hunter.md Rate-limit and abuse gaps
report_writer.md Evidence-based reporting

See prompts/README.md for usage guidance.

Optional launchers

You can use the backend launchers to auto-start Caddy and shut it down when the backend exits.

Source them directly:

source /path/to/burp-mcp-agents/codex/burpcodex.sh
source /path/to/burp-mcp-agents/gemini-cli/burpgemini.sh
source /path/to/burp-mcp-agents/ollama/burpollama.sh
source /path/to/burp-mcp-agents/lmstudio/burplmstudio.sh

Then run:

burpcodex
burpgemini
burpollama deepseek-r1:14b
burplmstudio llama-3.1-8b-instruct

To make these available in every shell, add the source lines to your ~/.zshrc.

What this enables

You are not running a scanner. You are reviewing real traffic with assisted reasoning.

README mirrored from the source repository 3 months ago. The original is authoritative.

Questions

About Burp MCP Agents

How do I install Burp MCP Agents?

Run npx burp-mcp-agents, then add the server to your MCP client's configuration. Conduid has recorded 0 installs, so the command is known to work with current clients.

Is Burp MCP Agents safe to use with an AI agent?

Its trust score is 71 out of 100 (good). It passes 0 of 1 static security checks; the failures are listed above. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Burp MCP Agents still maintained?

The last commit was 7 months ago, with 0 open issues. That's long enough that you should check whether the maintainer is responding to issues before depending on it.