Burp MCP Agents

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/six2dez/burp-mcp-agents
• Blog Title: Burp MCP Agents
• Suggested Section: Pentesting Web / Web Vulnerabilities Methodology (or a new Burp Suite section) -> AI-assisted Burp traffic review (MCP) + safe proxying/data-handling guidance

🎯 Content Summary

Title/Repo: six2dez/burp-mcp-agents (“Burp MCP Agents”)

What this is (and what it is not)
This repository is a workflow/tooling repo to connect the Burp Suite MCP Server (a Burp extension) to AI backends for passive, evidence-driven analysis of real Burp-captured HTTP(S) traffic. It explicitly targets assisted manual review (reasoning over captured requests/responses), not active exploitation or automation:

• No fuz...

  🔧 Technical Details

  Passive LLM-assisted web security review via Burp MCP: Expose captured HTTP(S) traffic from Burp using the Burp MCP Server extension (listening on 127.0.0.1:9876), bridge it through an MCP layer and (optionally) a Caddy reverse proxy using MCP SSE, and feed that evidence to an LLM backend for reasoning-based analysis. This technique emphasizes reviewing observed requests/responses rather than generating traffic (no fuzzing/blind scans).

  Prompt-driven evidence checklists for common bug classes: Use specialized prompt templates to systematically look for vulnerability signals in real traffic: object ID changes and authorization mismatches (IDOR/BOLA), authenticated vs unauthenticated route differences, redirect chains and URL fetch parameters (SSRF/open redirect candidates), multi-step business logic flaws, token audience/scope mistakes, and rate-limit/abuse gaps—then convert findings into an evidence-based report.

  Safer, repeatable pro...

  🤖 Agent Actions

  Summary:

  • Added a Burp Suite MCP bridge section detailing how to stream Burp-captured traffic through an MCP bridge/Caddy SSE into Codex, Gemini, or Ollama backends for passive, evidence-driven analysis (no fuzzing).
  • Documented quick setup steps, launcher helpers, prompt pack focus areas (IDOR, SSRF, auth/logic flaws, session/rate-limit issues), and operational safety notes on privacy and exposure.
  • Updated references to include the Burp MCP Agents workflow repository.

  Files Modified:

  • src/AI/AI-MCP-Servers.md

  ---

  This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/six2dez/burp-mcp-agents

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web / Web Vulnerabilities Methodology (or a new Burp Suite section) -> AI-assisted Burp traffic review (MCP) + safe proxying/data-handling guidance".

Repository Maintenance:

• MD Files Formatting: 937 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0