🔥 Burp Suite MCP Analyzer

An MCP (Model Context Protocol) server that lets AI assistants analyze Burp Suite XML exports — offline, no Burp running required.

Ask AI (or any MCP-compatible AI) to map endpoints, find secrets, detect vulnerabilities, analyze headers, export curl commands, and generate pentest reports — all from a Burp XML export file.

✨ Features — 19 Tools

Related MCP server: pentestMCP

📋 Prerequisites

• Python 3.10+

• Any MCP-compatible AI client (Claude Desktop, Claude Code, OpenCode, Cursor, GitHub Copilot, Windsurf)

• Burp Suite (any version — just for exporting XML)

🚀 Installation

1. Clone the repo

git clone https://github.com/YOUR_USERNAME/burp-mcp-analyzer.git
cd burp-mcp-analyzer

2. Install dependencies

pip install -r requirements.txt

3. Configure your AI client — see Configuration below

📤 Exporting from Burp Suite

The server works with Burp XML exports (not raw .burp project files).

Option A — Proxy history only (quickest):

Proxy tab → HTTP History → Ctrl+A (select all)
→ Right-click → Save items → save as export.xml

Option B — Site map scanner issues:

Target tab → Site map → Select URL → Under Contents → Right-click → Save items → save as export.xml

⚙️ Configuration

Claude Desktop

Edit %APPDATA%\Claude\claude_desktop_config.json (Windows) or ~/Library/Application Support/Claude/claude_desktop_config.json (Mac):

{
  "mcpServers": {
    "burp-analyzer": {
      "command": "python3",
      "args": ["/path/to/burp_mcp_server.py"]
    }
  }
}

Windows with WSL:

{
  "mcpServers": {
    "burp-analyzer": {
      "command": "wsl.exe",
      "args": ["python3", "/home/YOUR_USERNAME/burp-mcp-analyzer/burp_mcp_server.py"]
    }
  }
}

Claude Code

claude mcp add burp-analyzer python3 /path/to/burp_mcp_server.py

Or import from Claude Desktop if already configured:

claude mcp add-from-claude-desktop

OpenCode

Edit ~/.config/opencode/config.json:

{
  "mcpServers": {
    "burp-analyzer": {
      "command": "python3",
      "args": ["/path/to/burp_mcp_server.py"],
      "type": "stdio"
    }
  }
}

GitHub Copilot (VS Code)

Create .vscode/mcp.json in your project:

{
  "servers": {
    "burp-analyzer": {
      "type": "stdio",
      "command": "python3",
      "args": ["/path/to/burp_mcp_server.py"]
    }
  }
}

Cursor

Edit ~/.cursor/mcp.json:

{
  "mcpServers": {
    "burp-analyzer": {
      "command": "python3",
      "args": ["/path/to/burp_mcp_server.py"]
    }
  }
}

Windsurf

Edit ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "burp-analyzer": {
      "command": "python3",
      "args": ["/path/to/burp_mcp_server.py"]
    }
  }
}

Restart your AI client after editing config files.

💬 Usage

Once configured, load a Burp XML export and start asking:

Load this file: /path/to/export.xml

Example Prompts

Recon

Show me all unique endpoints and paths discovered

Security Analysis

Scan all traffic for secrets, API keys, and credentials
Check all responses for missing or misconfigured security headers

Traffic

Show me all POST requests that returned 200
Find all 500 errors with the full response body

Reporting

Generate a full penetration test report with all findings

Chained

Load the file, map all endpoints, find injection points, then tell me the top 3 things to test
Find all sensitive data exposed in responses and group by risk level

For a full list of example prompts, see PROMPTS.md.

🔍 Sensitive Data Patterns Detected

The server automatically scans for 20+ patterns:

• JWT Tokens, Bearer Tokens, Basic Auth

• AWS Access Keys & Secret Keys

• Google API Keys, GitHub Tokens, Slack Tokens, Stripe Keys, SendGrid Keys

• Passwords in URLs and request bodies

• Database connection strings

• Private keys (RSA, EC)

• Session cookies (PHPSESSID, JSESSIONID, connect.sid)

• SQL errors and stack traces

• Internal IP addresses

• Email addresses, Credit card numbers

🛡️ Security Headers Checked

Strict-Transport-Security · Content-Security-Policy · X-Frame-Options · X-Content-Type-Options · Referrer-Policy · Permissions-Policy · Cache-Control · Access-Control-Allow-Origin

🗂️ Supported File Formats

Raw .burp project files are not supported — they use a proprietary binary format. Use the XML export instead.

⚠️ Legal & Ethical Use

This tool is intended for authorized security testing only.

• Only analyze traffic from systems you have explicit permission to test

• Unauthorized interception or analysis of network traffic may be illegal

• The authors are not responsible for misuse of this tool