Official

PortSwigger MCP Server

Burp Suite interactions managed directly within AI clients via MCP connectivity.

Data last scanned today · Reviewed yesterday

63★ 989KotlinGPL-3.0

Overview

This extension bridges Burp Suite to MCP-compatible AI clients, enabling automated interaction with security tools. It provides both an SSE MCP server and a stdio proxy for Claude Desktop integration, allowing users to control Burp settings and operations through an AI interface. The setup requires Java and the jar command to build from source via Gradle. Once compiled, the resulting JAR is loaded directly into the Burp Suite Extensions tab, where users can further refine connectivity through the dedicated MCP configuration panel.

Our verdict

With a high-risk security score of 30/100, this tool requires careful handling. The primary concern is the lack of any authentication method, meaning any local process with access to your configuration can interface with the server. Additionally, the server does not feature a read-only mode, and enabling config editing tools grants broad write access to Burp configuration files. Due to these significant access risks, this server should only be used in trusted, isolated development environments.

Maintained by 14 individual contributors
Zero direct dependencies minimize supply-chain surface
Actively maintained with a commit within the last month

No authentication mechanisms implemented
No read-only mode to restrict write access
Community-maintained rather than official vendor support

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›What are the system prerequisites for building this extension?

You must have Java installed and available in your system's PATH, and the 'jar' command must be executable and available in your PATH.

›How can I enable tools that modify Burp configuration files?

You must check the 'Enable tools that can edit your config' checkbox within the MCP tab of the Burp Suite UI.

›How does the extension work with Claude Desktop?

Since Claude Desktop currently only supports STDIO MCP servers, the extension uses a proxy server that connects to the Burp instance running at a local port, typically 127.0.0.1:9876.

›Is manual configuration available for Claude Desktop?

Yes, you can manually update your claude_desktop_config.json file by adding an entry to the mcpServers object that points to the packaged proxy JAR and your Burp MCP server URL.

›Can I use an MCP client that supports SSE directly?

Yes, you can connect your client directly to the Burp MCP server using its URL, typically http://127.0.0.1:9876 or http://127.0.0.1:9876/sse.