> For the complete documentation index, see [llms.txt](https://burp-ai-agent.six2dez.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://burp-ai-agent.six2dez.com/user-guide/ui-tour.md).
# UI Tour
This page explains each major area of the Custom AI Agent interface. (In Burp the extension loads under the display name **Custom AI Agent** — its entry in the **Extensions** list and the Suite tab title — to distinguish it from Burp's built-in "Burp AI" provider.)
## Top Bar
| Control | Description |
| -------------------- | ------------------------------------------------------- |
| **MCP toggle** | Starts/stops MCP runtime. |
| **Passive toggle** | Enables/disables passive scanner. |
| **Active toggle** | Enables/disables active scanner. |
| **Backend selector** | Backend for new sessions (available only). |
| **Status indicator** | Health state (`AI: OK`, `AI: Degraded`, `AI: Offline`). |
## Chat Panel
* Session list and per-session metadata.
* Usage stats (messages, chars, token estimates).
* Markdown-rendered responses delivered as a completed block by current built-in backends (the renderer supports chunks, but the current adapters invoke it once per response).
* Input box (`Enter` send, `Shift+Enter` newline).
* **Tools** menu for MCP-assisted prompts.
* Context preview and cancellation controls.
* Markdown export per session.
## Settings Panel
The panel is docked at the bottom of the **Custom AI Agent** Suite tab and can be resized/collapsed.
All Settings tabs are built on a shared internal design system (consistent spacing/typography, one-line section descriptions, and collapsible sections on the dense scanner tabs). Colors are theme-aware tokens, so the UI re-themes automatically when Burp switches between light and dark — there are no hardcoded colors. Settings keys and persistence are unchanged, so previously saved configs load as-is.
| Tab | Purpose |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **AI Backend** | Backend commands/URLs/models/auth and health testing. |
| **AI Passive Scanner** | Scope/rate/size controls, dedup/cache, context caps, findings. |
| **AI Active Scanner** | Concurrency, risk level, scan mode, queue controls, Collaborator. |
| **MCP Server** | Host/port/TLS/token/limits/unsafe-tool master switch. |
| **Burp Integration** | Redesigned MCP Tools panel with search/filter and per-group bulk toggles. Tools are grouped under two subtitles: "Extension-native tools — available in both the BApp Store and the full build." and "Generic Montoya API wrappers — available in the full build only." In the BApp Store build only the extension-native group lists tools; the generic group reads "No Montoya tools available in this build." |
| **Prompt Templates** | Built-in request and scanner-issue template editing. |
| **Custom Prompts** | Saved free-form prompt library plus BountyPrompt enablement, directory, issue threshold, and curated-ID controls. |
| **Privacy & Logging** | Privacy mode, determinism, salt, audit logging, AI request logger. |
| **AI Logger** | Real-time AI activity log with filters, trace correlation, and export. |
| **Help** | Quick docs and setup references. |
## Privacy Indicator
Visual pill indicates active mode (`STRICT`, `BALANCED`, `OFF`) so you can confirm policy before sending prompts. A second pill — the **Safety Indicator** — surfaces the active scanner posture as `OK` (green), `WARN` (yellow), or `RISK` (red), with a tooltip explaining which switches drove the level.
## Advisory Banner (SubtleNotice)
The **Privacy & Logging** and **MCP Server** settings tabs render advisory state through a single inline banner instead of stacked red labels. It auto-selects one of three levels based on the combined state of privacy mode, MCP exposure, **Enable Unsafe Tools**, and the active scanner:
| Level | When it shows | Typical example |
| ----------------- | ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| **INFO** (blue) | Posture is unusual but not risky — worth noting before you click Save. | Privacy mode `OFF` with MCP running. |
| **WARN** (yellow) | A reversible combination that increases exposure if left in place. | Privacy `STRICT` with the active scanner on; external MCP without **Allowed Origins** populated. |
| **RISK** (red) | A combination that should be deliberate — exposes traffic or tools outside the loopback boundary. | External MCP with **Enable Unsafe Tools** on; active scanner on with Privacy `OFF`. |
The banner supports multi-line HTML wrapping inside the `GridBagLayout` rows, repaints automatically when you switch Burp's theme, and collapses cleanly when there is nothing to report — no dangling "Advisory:" label remains visible. See [Privacy Modes](/privacy-and-logging/privacy-modes.md) and [MCP Overview](/mcp-server/overview.md) for the per-setting consequences the banner is summarizing.
## Context Preview Dialog
Every right-click action that auto-captures context (proxy item, scanner issue, site-map node, Repeater) opens a modal before that captured context is dispatched. The modal shows the action, current privacy mode, resolved action prompt, and post-policy context JSON. Backend protocol framing, conversation history, a tool preamble, and a separate system-role profile can be added afterward; see [Context Menus → Context Preview Dialog](/user-guide/context-menus.md#context-preview-dialog). Confirm with **Send** or abort with **Cancel**.
## Keyboard Shortcuts
* `Cmd/Ctrl + N`: new session
* `Cmd/Ctrl + W`: delete session
* `Cmd/Ctrl + L`: clear chat
* `Cmd/Ctrl + E`: export chat
* `Esc`: toggle settings panel
## Findings Panels
Scanner dialogs expose findings, severity/confidence, and queue/runtime metrics.
## Next Steps
* [Context Menus](/user-guide/context-menus.md)
* [Chat & Sessions](/user-guide/chat-sessions.md)
* [Burp Integration](/user-guide/burp-integration.md)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://burp-ai-agent.six2dez.com/user-guide/ui-tour.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
