burp-mcp-server

• MCP server and standalone CLI for Burp Suite Professional.
• Gives AI assistants like Claude Code full access to Burp - send requests, read proxy history, pull scanner findings, stage requests in Repeater/Intruder, and run race condition attacks.
• All with structured JSON output, body limits, and smart header filtering.

Why This Exists

• Burp's built-in MCP extension returns verbose HttpRequestResponse{...} blobs with no body limits, separate HTTP/1.1 and HTTP/2 tools, and 14+ tools that burn context tokens.
• This project replaces all of that:

Two Ways to Use

MCP Server (for AI assistants)
  Claude Code  -->  stdio  -->  burp-mcp-server (Go)  -->  SSE  -->  Burp Extension (port 9876)

Standalone CLI (for terminal)
  Terminal  -->  burp-cli (Python)  -->  Burp Proxy Listener (port 8080)  -->  Proxy History

MCP Server

Install

One-liner:

curl -fsSL https://raw.githubusercontent.com/c0tton-fluff/burp-mcp-server/main/install.sh | bash

Or download from Releases.

git clone https://github.com/c0tton-fluff/burp-mcp-server.git
cd burp-mcp-server
go build -o burp-mcp-server .

Quick Start

1. Enable MCP in Burp Suite

Burp Suite > MCP tab > toggle Enabled (default 127.0.0.1:9876).

Uncheck "Require approval for history access" for pentesting/CTF use.

2. Add to your MCP config

~/.mcp.json:

{
  "mcpServers": {
    "burp": {
      "command": "burp-mcp-server",
      "args": ["serve"],
      "env": {
        "BURP_MCP_URL": "http://127.0.0.1:9876/sse"
      }
    }
  }
}

3. Talk to Claude Code

"Send a GET request to https://example.com"
"Check proxy history for requests to /api"
"Show scanner findings"
"Create a Repeater tab for this login request"
"Batch send these 5 IDOR requests"
"Race the transfer endpoint with 20 requests"

Tools

HTTP

Proxy and Scanner

Staging

Encoding (local, no Burp roundtrip)

Response Format

Default (security headers only):

{
  "statusCode": 200,
  "headers": {
    "Content-Type": "application/json; charset=utf-8",
    "Set-Cookie": "session=abc123; HttpOnly; Secure"
  },
  "body": "{\"id\":1,\"username\":\"admin\",\"role\":\"superuser\"}",
  "bodySize": 52,
  "truncated": false
}

Headers-only mode (headersOnly: true) -- useful for recon and fingerprinting:

{
  "statusCode": 200,
  "headers": {
    "Content-Type": "text/html",
    "Server": "nginx/1.24.0",
    "X-Powered-By": "Express"
  },
  "bodySize": 87342
}

Race Condition Attack

burp_race_request implements the single-packet attack technique from James Kettle's research. It bypasses Burp's proxy entirely for timing precision.

How it works:

1. Opens N parallel TLS/TCP connections to the target
2. Sends all-but-last-byte of the HTTP request on each connection
3. Sends the final byte on all connections simultaneously (last-byte sync)
4. Reads and parses all responses in parallel

Same technique as Turbo Intruder -- but callable directly from Claude Code.

Features:

• Auto-calculates Content-Length from actual body
• Forces HTTP/1.1 via TLS ALPN (avoids HTTP/2 upgrade)
• Deduplicates identical responses by default (saves tokens)
• Returns structured results with per-response body limits

Deduplicated output (default):

{
  "groups": [
    {
      "statusCode": 200,
      "body": "{\"message\":\"Currency converted successfully\"}",
      "count": 18,
      "indices": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17]
    },
    {
      "statusCode": 400,
      "body": "{\"error\":\"Insufficient balance\"}",
      "count": 2,
      "indices": [18, 19]
    }
  ],
  "summary": "20 requests sent, responses: 18x 200, 2x 400"
}

Use showAll: true to get individual responses instead of groups.

Batch Requests

burp_batch_send sends up to 10 requests in parallel. Tag each request to identify it in results:

{
  "requests": [
    {"raw": "GET /api/users/1 HTTP/1.1\r\nHost: target.com\r\nAuthorization: Bearer user_token", "tag": "own-profile"},
    {"raw": "GET /api/users/2 HTTP/1.1\r\nHost: target.com\r\nAuthorization: Bearer user_token", "tag": "other-profile"},
    {"raw": "GET /api/users/1 HTTP/1.1\r\nHost: target.com", "tag": "no-auth"}
  ]
}

{
  "responses": [
    {"tag": "own-profile", "statusCode": 200, "body": "{\"id\":1,...}"},
    {"tag": "other-profile", "statusCode": 200, "body": "{\"id\":2,...}"},
    {"tag": "no-auth", "statusCode": 401, "body": "{\"error\":\"unauthorized\"}"}
  ],
  "summary": "3 requests, responses: 2x 200, 1x 401"
}

burp_send_request

burp_batch_send

Each request in the array:

burp_race_request

burp_get_proxy_history

burp_get_request

burp_get_scanner_issues

burp_create_repeater_tab / burp_send_to_intruder

burp_encode / burp_decode

Standalone CLI

Command-line client for Burp Suite. No MCP required -- sends requests through Burp's proxy listener so they appear in Proxy > HTTP History. Zero dependencies beyond Python stdlib.

Install

curl -fsSL https://raw.githubusercontent.com/c0tton-fluff/burp-mcp-server/main/install.sh | TOOL=cli bash

Or download from Releases.

Usage

Requires Burp Suite running with proxy listener on 127.0.0.1:8080 (default).

# Structured requests (proxied through Burp)
burp send GET https://target.com/api/users
burp send POST https://target.com/api/login -j '{"user":"admin","pass":"test"}'
burp send PUT https://target.com/api/profile -H "Authorization: Bearer tok" -j '{"role":"admin"}'

# Raw HTTP requests
burp raw -f request.txt target.com
echo -e 'GET / HTTP/1.1\r\nHost: example.com\r\n\r\n' | burp raw

# Race condition attack (last-byte sync, direct -- bypasses proxy)
burp race target.com -f transfer.txt -n 20

# Direct mode (skip proxy)
burp send GET https://target.com/api/health --direct

# Encode / decode
burp encode base64 "hello world"
burp decode url "%3Cscript%3E"
burp encode hex "test"

Commands

Flags

Troubleshooting

MCP logs: ~/.cache/claude-cli-nodejs/*/mcp-logs-burp/

Prerequisites

• Burp Suite Professional (Community edition has limited MCP support)
• Burp MCP Server extension from BApp Store (for MCP server features)
• Burp running before starting Claude Code or using the CLI

License

MIT