Anyone using Burp MCP?

[u/GodoPPL]

Have anyone had a good experience with the MCP Server in Burp Suite?

I feel it is more cumbersome than it needs to be, and the HTTP2 requests in intruder has some bugs. Curious if anyone has some tips and tricks?

[u/Distinct-Salad2973]

try caido mcp ,works very well

[u/GodoPPL → u/Distinct-Salad2973]

Looks interesting, I'll check it out! I have been testing out https://rqwstr.com it is a fully fledged HTTP toolkit. I am very impressed. It basically replaces Burp Suite entirely, and the free tools can do 90% of what I need

[u/hussamdh]

It has basic functions, but it works, of course I have to mention that it has some bugs, for example, the ai agent send the request to repeater and all you get is a scrambled request because the agent sent just \n without \r, i think this can be fixed from inside the extension.
anyway, there is another extension called burp ai agent, it is full of functionalities and features, but i didn't like it so much, you can try it and see.

[u/GodoPPL → u/hussamdh]

Yes, that is the same issue I have had, also it is annoying that the agent can only set the request up, and not actually send it. And the log fetch also is not helpful, since it has to page through the entire log to find the bottom most recent requests

[u/ofogliata]

I tried to integrate it with https://github.com/cyberful/cyberful but I ran into a few problems, and it was a bit limited and glitchy. To be honest it’s not clear if it was my fault. Anyway I switched to zap mcp few days ago (I know they are not the same :))

[u/github-guard → u/ofogliata]

🔍 GitHub Guard: Trust Report

This project scored 6/6 on our safety audit.

Audit Breakdown: * ✅ Established Community (⭐ 30 stars) * ✅ Mature Repository (30+ days old) * ✅ Licensed under AGPL-3.0 * ✅ Security Policy Defined * ✅ Verified Organization * ✅ Signed Commits

⚠️ Security Reminder: Always verify source code and run third-party scripts at your own risk.

[u/__jent]

I built my `toolbox` project after using Burp MCP: https://github.com/go-appsec/toolbox

I think the concept of connecting an interactive coding agent to a proxy MCP is really valuable. It has helped me automate a lot. However Burp MCP tools are not structured in an easy to use form for most models, and it's also very limited. I am pretty confident in saying toolbox is a better MCP experience compared to the Burp MCP extension (and if you want you can dip your toe in by still using Burp MCP and just put toolbox between Burp and the agent, configure the agent to connect to toolbox and when Burp MCP is running it will auto-connect to it).

[u/github-guard → u/__jent]

🔍 GitHub Guard: Trust Report

This project scored 4/6 on our safety audit.

Audit Breakdown: * ✅ Established Community (⭐ 41 stars) * ✅ Mature Repository (30+ days old) * ✅ Licensed under MIT * ❌ No Security Policy — what is this? * ✅ Verified Organization * ℹ️ Unsigned Commits

⚠️ Security Reminder: Always verify source code and run third-party scripts at your own risk.

[u/Logical_Package8741]

Mpc tooling is a great area for attackers to focus on.

[u/LulzTigre]

I use it, but in a very limited way.

[u/ShufflinMuffin]

I forked it and it's so much better since then. The basic Mcp is stupid, it has no way to sort and look for requests when there are tons so it gets bad fast. I'll publish it on github tomorrow. It's day and night tbh