The Burp Suite MCP Server exposes Burp Suite's REST API as tools for AI assistants, enabling automated web application security scanning and vulnerability management.
Scan URLs for vulnerabilities – Initiate security scans against one or more target URLs, with optional scope configuration, and receive a task_id for tracking.
Check scan progress – Retrieve real-time scan status and findings by task_id, with the ability to filter results by severity (low, info, medium, high, or all).
Get scan summary – Obtain a high-level overview of scan results showing issue counts grouped by severity.
Wait for scan completion – Poll a scan until it finishes or a timeout is reached, with configurable polling interval — useful for CI/CD pipelines.
List active scans – View all currently running or pending scans (availability depends on Burp API version).
Cancel a scan – Stop an in-progress scan by its task_id (availability depends on Burp API version).
Query security issue definitions – Access Burp Suite's built-in knowledge base, including vulnerability names, descriptions, remediation guidance, and references.
Check Burp connectivity – Validate the connection and configuration to the Burp Suite REST API.
Allows interaction with Burp Suite's REST API to trigger vulnerability scans, monitor scan progress, retrieve security findings, and query Burp's security knowledge base.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Burp Suite MCP Server Scan https://example.com and alert me of any high severity vulnerabilities"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
An MCP (Model Context Protocol) server that exposes Burp Suite's REST API as tools for AI assistants. Use Cursor or other MCP clients to trigger vulnerability scans, check progress, and query Burp's security knowledge base.
Burp Suite Professional (or Burp Suite DAST) with the REST API enabled
Python 3.11+
Burp running locally with REST API bound to a reachable address (e.g. http://127.0.0.1:1337)
Related MCP server: MCPPentestBOT
Open Burp Suite → Settings → Suite → REST API
Check Service running
Set the URL/port (e.g. port 1337)
Create an API key and copy it
uv sync # or: pip install -e .Copy .env.example to .env and fill in your values:
cp .env.example .envEdit .env:
BURP_REST_API_BASE=http://127.0.0.1:1337
BURP_REST_API_KEY=your-api-key-here
BURP_REST_API_VERSION=v0.1The server supports three transports, selected with --transport:
Flag | Transport | Use case |
| stdio (default) | Local MCP clients (Cursor, Claude Desktop) |
| Server-Sent Events | HTTP clients using the legacy SSE protocol |
| Streamable HTTP | HTTP clients using the modern MCP HTTP protocol |
For sse and http, bind address and port are configurable:
# Default: localhost only, port 8000
uv run python main.py --transport http
# Expose on all interfaces, custom port
uv run python main.py --transport http --host 0.0.0.0 --port 9000
# SSE transport
uv run python main.py --transport sse --host 127.0.0.1 --port 8000Add to your Cursor MCP config (e.g. ~/.cursor/mcp.json or project .cursor/mcp.json):
{
"mcpServers": {
"burp-suite": {
"command": "uv",
"args": ["run", "python", "/path/to/burp-mcp/main.py"],
"cwd": "/path/to/burp-mcp"
}
}
}Start the server with HTTP transport, then point your MCP client at it:
uv run python main.py --transport http --host 0.0.0.0 --port 8000{
"mcpServers": {
"burp-suite": {
"url": "http://localhost:8000/mcp"
}
}
}Tool | Description |
| Get Burp's security issue definitions (name, description, remediation, references) |
| Start a scan for given URLs. Returns a |
| Get scan status and findings by |
| High-level summary: total issues by severity |
| List running/pending scans (may not be supported by all Burp API versions) |
| Cancel a scan by task_id (may not be supported by all Burp API versions) |
| Test connectivity to Burp API; validates config |
| Poll until scan completes or times out (for CI/CD) |
Scan a URL:
"Scan https://example.com for vulnerabilities"
Check scan progress:
"Check scan progress for task_id 123"
Get high-severity issues only:
"Check scan 123 and show only high severity issues"
Security knowledge:
"What security issues does Burp know about?"
Run scans from scripts or the terminal:
uv run python examples/ci-scan.py https://your-target.com
# or
./examples/ci-scan.sh https://your-target.comEndpoint | Method | Description |
| GET | Security issue definitions |
| POST | Start scan (body: |
| GET | List scans (may not be supported) |
| GET | Scan progress and results |
| DELETE | Cancel scan (may not be supported) |
Interactive API docs: [BURP_REST_API_BASE]/[API_KEY]
MIT
Get all Burp Suite security issue definitions (name, description, remediation, references).
Inputs: no named parameters. Returns: result
Cancel a scan by task_id. May not be supported by all Burp API versions.
Args:
task_id: Task ID of the scan to cancel
Inputs: task_id (required). Returns: result
Test connectivity to the Burp REST API. Validates config and performs a simple request.
Inputs: no named parameters. Returns: result
Retrieves scan progress and details using the task_id.
Args:
task_id: Task ID from an initiated scan (numeric ID or full path)
severity: Filter issues: low, info, medium, high, or "all" (default)
Inputs: task_id (required), severity. Returns: result
Get a high-level summary of scan results: total issues by severity.
Args:
task_id: Task ID from an initiated scan
Inputs: task_id (required). Returns: result
List running and pending scans. May not be supported by all Burp API versions.
Inputs: no named parameters. Returns: result
Scan URL(s) for security vulnerabilities.
Args:
urls: List of URLs to scan
scope: Optional scope configuration (passed to API if supported)
Inputs: urls (required), scope. Returns: result
Poll scan progress until the scan completes or times out.
Useful for long-running scans in CI/CD.
Args:
task_id: Task ID from an initiated scan
poll_interval_seconds: Seconds between polls (default: 10)
max_wait_seconds: Maximum time to wait (default: 3600 = 1 hour)
Inputs: task_id (required), poll_interval_seconds, max_wait_seconds. Returns: result
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 8 tools
Most tools have distinct purposes, but there is some potential overlap between check_security_scan_progress and get_scan_summary, as both retrieve scan results using a task_id, which could cause confusion. However, their descriptions clarify that one provides detailed progress and filtered issues while the other gives a high-level summary, helping to differentiate them.
All tool names follow a consistent snake_case pattern with clear verb_noun structures, such as cancel_scan, check_burp_connectivity, and scan_urls_for_vulnerabilities. This uniformity makes the tool set predictable and easy to navigate, with no deviations in naming conventions.
With 8 tools, the server is well-scoped for managing Burp Suite security scans, covering connectivity testing, scan initiation, progress monitoring, result retrieval, and cancellation. Each tool serves a specific role in the scanning lifecycle, and the count is appropriate for the domain without being excessive or insufficient.
The tool set provides comprehensive coverage for security scanning workflows, including initiation, monitoring, and result analysis, with minor gaps such as the lack of tools for configuring scan settings or managing scan history. However, core operations are well-covered, and agents can perform essential tasks without significant dead ends.
Scan websites and code for security, performance and SEO issues from your AI assistant.
AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets.
Real-time CVE, exploit, and vulnerability intelligence for AI assistants (350K+ CVEs, 115K+ PoCs)
Security scanner for AI-written code: SAST, secrets, dependencies, IaC, containers and DAST.
