Burp Suite MCP Server

Example Use Cases

• 1

  Search and extract specific entries from Burp Suite proxy history (e.g., requests/responses by URL, method, or status code) to provide contextual vulnerability analysis.

• 2

  Retrieve only selected HTTP fields (raw request, response body, headers) to keep model context concise while investigating issues.

• 3

  Run SQL-like queries over Burp HTTP history to automate triage, fuzzing follow-ups, or evidence collection during security assessments.

Description

This project provides a model context protocol (MCP) server that exposes Burp Suite proxy history to LLMs, allowing targeted retrieval of raw requests, response bodies, headers, status codes, URLs, hosts, and other fields. It supports SQL-like query syntax and lets callers specify which HTTP history fields to return to avoid excessively long contexts. The server is implemented as a Burp extension (Java) that runs an HTTP server (default port 8889) and a Python client entrypoint; it is aimed at researchers and penetration testers who want programmatic LLM access to Burp data.