Issue Creation (MCP)

The issue_create MCP tool lets an AI client create Burp issues programmatically.

Tool Details

Property	Value
Tool name	issue_create
Category	Issues
Native	Yes (registered in both the BApp Store and full builds)
Unsafe	No
Default enabled	Yes
Pro only	No

Workflow Sequence

Input Parameters

Parameter	Type	Required	Description
name	String	Yes	Issue title (for example, SQL Injection in login parameter).
detail	String	Yes	Full evidence and technical narrative.
severity	String	Yes	INFORMATION, LOW, MEDIUM, HIGH.
confidence	String	Yes	CERTAIN, FIRM, TENTATIVE.
baseUrl	String	Yes	URL where issue was found.
remediation	String	No	Recommended remediation.
background	String	No	Optional issue background.
remediationBackground	String	No	Optional remediation background.
typicalSeverity	String	No	Typical severity override (defaults to severity).
httpRequest	String	No	Raw HTTP request attachment.
httpResponseContent	String	No	Raw HTTP response attachment.
targetHostname	String	No	Host for attachment context.
targetPort	Int	No	Port for attachment context (default 443).
usesHttps	Boolean	No	HTTPS flag for attachment context (default true).

If httpRequest is present, targetHostname must also be non-blank (with a valid positive targetPort); otherwise the handler returns an error instead of creating the issue. httpResponseContent is attached only together with httpRequest. Without an explicit request, the handler tries to find a matching Proxy history item by baseUrl.

Recommended Practices

• Create issues after evidence is verified.
• Use TENTATIVE for suspected-only findings.
• Check duplicates before creating a new issue.
• Keep detail field evidence-based and reproducible.

Example Usage

{
  "name": "[AI] SQL Injection in user_id parameter",
  "detail": "The user_id parameter in GET /api/users is vulnerable to error-based SQL injection...",
  "severity": "HIGH",
  "confidence": "FIRM",
  "baseUrl": "https://example.com/api/users?user_id=1",
  "remediation": "Use parameterized queries and strict server-side validation."
}

Integration Pattern

Typical chain:

1. Search/collect candidate requests (proxy_http_history_regex).
2. Validate behavior (http1_request / http2_request).
3. Summarize exploit evidence.
4. Create issue (issue_create).

The intermediate steps above use generic Montoya tools (proxy_http_history_regex, http1_request, http2_request), which are only present in the full build. In the BApp Store build, issue_create is still available, but pair it with PortSwigger's official Burp MCP Server (or ai_findings_recent) to gather and validate evidence. The current ai_passive_scan MCP handler additionally requires Burp's Use AI for extensions gate even when an independent backend is selected.

See Typical Workflows.