MCP Overview

Model Context Protocol (MCP) lets external AI clients use Burp data and actions through a controlled interface.

What MCP Enables

With MCP enabled, an external AI client can:

• query Burp history,

• run analysis tools,

• send controlled requests,

• create issues programmatically.

This keeps the operator in control while expanding automation options.

Connection Topology

SSE (Default)

Primary transport for MCP clients.

Default endpoint:

http://127.0.0.1:9876/sse

For external access, enable TLS and include Authorization: Bearer <token>.

STDIO Bridge

Cloud Client Setup (SSE via stdio bridge)

Some desktop clients expect a stdio MCP process. supergateway bridges to Burp SSE.

{
  "mcpServers": {
    "burp-ai-agent": {
      "command": "npx",
      "args": [
        "-y",
        "supergateway",
        "--sse",
        "http://127.0.0.1:9876/sse"
      ]
    }
  }
}

If token is required:

{
  "mcpServers": {
    "burp-ai-agent": {
      "command": "npx",
      "args": [
        "-y",
        "supergateway",
        "--sse",
        "http://127.0.0.1:9876/sse",
        "--oauth2Bearer",
        "your-token"
      ]
    }
  }
}

Features

• SSE and optional STDIO transport.

• 53+ tools across Burp workflows.

• Unsafe-tool gating.

• Configurable request limiter and body-size caps.

• Health endpoint (GET /__mcp/health).

• Privacy-aware tool output filtering.

Screenshot: MCP settings

Next Steps

• Security Model

• Tools Reference

• Issue Creation (MCP)