Skip to main content
Glama
Cyreslab-AI

Burpsuite MCP Server

by Cyreslab-AI

Burpsuite MCP Server

A Model Context Protocol (MCP) server that provides an interface for interacting with Burpsuite Professional's scanning and proxy functionality.

Overview

This MCP server allows AI assistants to interact with Burpsuite Professional for web security testing and vulnerability scanning. It provides tools for:

  • Starting vulnerability scans on target URLs

  • Checking scan status and retrieving results

  • Accessing HTTP/HTTPS traffic captured by Burp Proxy

  • Viewing site structure discovered during scanning

Related MCP server: BurpSuite MCP Server

Features

Tools

The server exposes the following tools:

  1. start_scan: Start a new vulnerability scan on a target URL

    • Parameters:

      • target: Target URL to scan (e.g., https://example.com)

      • scan_type: Type of scan to perform (passive, active, or full)

  2. get_scan_status: Check the status of a running scan

    • Parameters:

      • scan_id: ID of the scan to check

  3. get_scan_issues: Get vulnerability issues found in a scan

    • Parameters:

      • scan_id: ID of the scan

      • severity: Filter issues by severity (high, medium, low, info, or all)

  4. get_proxy_history: Get HTTP/HTTPS traffic captured by Burp Proxy

    • Parameters:

      • host: Filter by host (optional)

      • method: Filter by HTTP method (optional)

      • status_code: Filter by HTTP status code (optional)

      • limit: Maximum number of items to return (default: 10)

  5. get_site_map: Get the site structure discovered during scanning and browsing

    • Parameters:

      • host: Filter by host (optional)

      • with_parameters: Only show URLs with parameters (optional)

      • limit: Maximum number of items to return (default: 20)

Resources

The server provides the following resources:

  1. Scan Results: burpsuite://scan/{scanId}

  2. Issue Details: burpsuite://scan/{scanId}/issue/{issueId}

  3. Proxy History: burpsuite://proxy/history

  4. Proxy History Item: burpsuite://proxy/history/{itemId}

  5. Site Map: burpsuite://sitemap

Installation

Installing via Smithery

To install Burpsuite Server for Claude Desktop automatically via Smithery:

npx -y @smithery/cli install @Cyreslab-AI/burpsuite-mcp-server --client claude

Manual Installation

  1. Build the server:

    cd /path/to/burpsuite-server
    npm install
    npm run build
  2. Add the server to your MCP settings configuration file:

    {
      "mcpServers": {
        "burpsuite": {
          "command": "node",
          "args": ["/path/to/burpsuite-server/build/index.js"],
          "env": {},
          "disabled": false,
          "autoApprove": []
        }
      }
    }

Future Enhancements

This server currently provides mock functionality. To connect it to a real Burpsuite Professional instance:

  1. Configure Burpsuite Professional to expose its REST API

  2. Update the server implementation to connect to the Burpsuite REST API

  3. Add authentication mechanisms for secure API communication

Example Usage

Here are some examples of how to use the Burpsuite MCP server with an AI assistant:

Starting a Scan

Use the Burpsuite MCP server to scan example.com for vulnerabilities.

Viewing Proxy History

Show me the HTTP traffic captured by Burp Proxy for domain example.com.

Analyzing Vulnerabilities

What high severity vulnerabilities were found in the latest scan?

Available Tools

5 tools
get_proxy_historyC

Get HTTP/HTTPS traffic captured by Burp Proxy

ParametersJSON Schema
NameRequiredDescriptionDefault
hostNoFilter by host (optional)
limitNoMaximum number of items to return (default: 10)
methodNoFilter by HTTP method (optional)
status_codeNoFilter by HTTP status code (optional)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states what the tool does but lacks details on permissions needed, rate limits, whether it returns real-time or historical data, or the format of the returned traffic. For a tool that retrieves potentially sensitive proxy data, this is a significant gap in transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that directly states the tool's purpose with zero wasted words. It's appropriately sized and front-loaded, making it easy to understand at a glance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of retrieving proxy traffic (which could involve large datasets or sensitive information), no annotations, and no output schema, the description is incomplete. It doesn't explain what the returned data looks like, any limitations, or how it integrates with the sibling tools, leaving gaps for an AI agent to use it effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 100%, with clear descriptions for all four parameters (host, limit, method, status_code). The description adds no additional parameter semantics beyond what the schema provides, so it meets the baseline score of 3 without compensating for any gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Get') and resource ('HTTP/HTTPS traffic captured by Burp Proxy'), making the tool's purpose immediately understandable. However, it doesn't differentiate from sibling tools like 'get_site_map' or 'get_scan_issues', which might also retrieve related data, so it doesn't reach the highest score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It doesn't mention any prerequisites, context for filtering traffic, or how it differs from siblings like 'get_site_map' (which might retrieve site structure) or 'get_scan_issues' (which might retrieve security findings).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_scan_issuesC

Get vulnerability issues found in a scan

ParametersJSON Schema
NameRequiredDescriptionDefault
scan_idYesID of the scan
severityNoFilter issues by severity

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden but only states what the tool does without behavioral details. It lacks information on permissions, rate limits, pagination, or what happens if the scan_id is invalid, which is critical for a tool accessing vulnerability data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that directly states the tool's function without unnecessary words. It's appropriately sized and front-loaded, making it easy to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of vulnerability scanning, lack of annotations, and no output schema, the description is insufficient. It doesn't explain return values, error handling, or behavioral constraints, leaving gaps that could hinder correct tool invocation by an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description mentions 'vulnerability issues' and 'scan', which aligns with the 'scan_id' parameter, but adds no meaning beyond the schema's 100% coverage. Since the schema fully describes both parameters, the baseline score of 3 is appropriate as the description doesn't enhance parameter understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Get') and resource ('vulnerability issues found in a scan'), making the purpose understandable. However, it doesn't differentiate from sibling tools like 'get_scan_status' or 'get_proxy_history', which prevents a perfect score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. For example, it doesn't clarify if this should be used after 'start_scan' or alongside 'get_scan_status', leaving the agent without context for selection among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_scan_statusC

Check the status of a running scan

ParametersJSON Schema
NameRequiredDescriptionDefault
scan_idYesID of the scan to check

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states this is a status check, which implies a read-only operation, but doesn't specify what the status includes (e.g., progress percentage, completion state, errors), whether it's real-time or cached, or any rate limits. For a tool with zero annotation coverage, this leaves significant gaps in understanding how it behaves.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence with zero wasted words. It's front-loaded with the core purpose and efficiently communicates the essential action without unnecessary elaboration, making it easy to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of a scan status tool (which likely involves dynamic state), no annotations, and no output schema, the description is insufficient. It doesn't explain what information is returned (e.g., progress, errors, duration), how to interpret status values, or potential edge cases. For a tool that agents will rely on to monitor operations, more context is needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with the single parameter 'scan_id' documented as 'ID of the scan to check'. The description adds no additional meaning beyond this, such as format examples or where to obtain the ID. Since the schema does the heavy lifting, the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Check') and target resource ('status of a running scan'), making the purpose immediately understandable. It doesn't distinguish from siblings like 'get_scan_issues' or 'get_proxy_history', which would require more specific scope information, but it's unambiguous about what this tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., that a scan must be started first using 'start_scan'), nor does it differentiate from siblings like 'get_scan_issues' (which might return detailed problems) or 'get_proxy_history' (which might track proxy usage). Usage context is implied but not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_site_mapB

Get the site structure discovered during scanning and browsing

ParametersJSON Schema
NameRequiredDescriptionDefault
hostNoFilter by host (optional)
limitNoMaximum number of items to return (default: 20)
with_parametersNoOnly show URLs with parameters (optional)

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the tool retrieves 'site structure discovered during scanning and browsing,' implying a read-only operation, but doesn't specify if this is real-time data, cached results, or requires specific permissions. It also lacks details on output format, pagination, or error handling, which are critical for a tool with parameters like 'limit' and filtering options.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence: 'Get the site structure discovered during scanning and browsing.' It is front-loaded with the core purpose, uses clear language, and avoids unnecessary words. Every part of the sentence contributes directly to understanding the tool's function, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 3 parameters with full schema coverage but no annotations or output schema, the description is minimally adequate. It covers the basic purpose but lacks context on behavioral aspects like data freshness, permissions, or output format. For a scanning-related tool that likely interacts with dynamic data, more details on how it integrates with siblings (e.g., after 'start_scan') would improve completeness, but it meets the minimum viable threshold.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, with clear documentation for 'host' (filter by host), 'limit' (maximum items), and 'with_parameters' (only show URLs with parameters). The description doesn't add any meaning beyond this, as it doesn't explain how these parameters affect the 'site structure' retrieval or provide usage examples. With high schema coverage, the baseline score of 3 is appropriate, as the schema handles the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Get the site structure discovered during scanning and browsing.' It specifies the verb ('Get') and resource ('site structure'), and distinguishes it from siblings like 'get_proxy_history' or 'get_scan_issues' by focusing on site structure rather than proxy logs or issues. However, it doesn't explicitly differentiate from 'get_scan_status' in terms of what 'site structure' entails versus 'status,' leaving some ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It doesn't mention any prerequisites, such as needing a scan to have been performed first, or compare it to siblings like 'get_scan_status' for status updates or 'start_scan' for initiating scans. Without such context, users might struggle to choose the right tool in this scanning-related set.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

start_scanC

Start a new vulnerability scan on a target URL

ParametersJSON Schema
NameRequiredDescriptionDefault
scan_typeNoType of scan to perform
targetYesTarget URL to scan (e.g., https://example.com)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states the action ('Start a new vulnerability scan') but lacks details on execution traits, such as whether it's asynchronous, requires authentication, has rate limits, or what happens upon invocation (e.g., scan initiation vs. immediate results). This is inadequate for a mutation tool with zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that directly states the tool's purpose without unnecessary words. It is front-loaded with the core action and resource, making it easy to parse and understand quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of starting a vulnerability scan (a mutation operation with potential side effects), no annotations, and no output schema, the description is incomplete. It fails to address key contextual aspects like what the tool returns (e.g., a scan ID), error conditions, or behavioral implications, leaving significant gaps for the agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, with clear documentation for both parameters (scan_type with enum values and target with examples). The description adds no additional parameter semantics beyond what the schema provides, such as explaining scan_type differences or target format nuances, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Start a new vulnerability scan') and the target ('on a target URL'), providing a specific verb+resource combination. However, it doesn't differentiate from sibling tools like 'get_scan_status' or 'get_scan_issues', which are related but not direct alternatives for initiating scans.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description offers no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites, such as needing a target URL, or clarify its role relative to sibling tools like 'get_can_status' for monitoring scans. This leaves the agent without context for tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 5 tool updatesv1.0.0
    • First observedget_proxy_history
    • First observedget_scan_issues
    • First observedget_scan_status
    • First observedget_site_map
    • First observedstart_scan

TDQS

B3.3/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose with no overlap: get_proxy_history retrieves captured traffic, get_scan_issues fetches vulnerability findings, get_scan_status checks scan progress, get_site_map provides site structure, and start_scan initiates new scans. The descriptions make it unambiguous which tool to use for each specific task.

Naming Consistency5/5

All tools follow a consistent verb_noun pattern with 'get_' or 'start_' prefixes followed by descriptive nouns (proxy_history, scan_issues, scan_status, site_map, scan). This uniform snake_case naming makes the tool set predictable and easy to understand.

Tool Count4/5

Five tools is reasonable for a BurpSuite security testing server, covering core functions like traffic capture, scanning, and results retrieval. While slightly lean, it provides essential operations without being overwhelming. A few additional tools for scan configuration or issue management could enhance completeness but aren't critical.

Completeness3/5

The tools cover basic scanning workflow (start, check status, get results) and proxy history, but lack operations for managing scans (e.g., pause, stop, configure) or interacting with issues (e.g., export, filter, annotate). This creates minor gaps that agents might need to work around, though core functionality is present.

Maintenance

ActivityInactive
ResponsivenessUnresponsive

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Cyreslab-AI/burpsuite-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server