The most comprehensive MCP server for Burp Suite Professional — 137 tools, real-time dashboard, custom scan checks, inline fuzzer, race condition testing, auth diffing, and more.
Config is the same across clients — only the file and path differ.
{
"mcpServers": {
"burp": {
"url": "http://127.0.0.1:9876/sse",
"type": "sse"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
137 Tools • 14 Resources • 12 Event Types • Real-time Dashboard • Full Montoya API Coverage
No automated test available for this server. Check the GitHub README for setup instructions.
Five weighted categories — click any category to see the underlying evidence.
No known CVEs.
No package registry to scan.
Click any tool to inspect its schema.
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Others in security
An evil MCP server used for redteam testing
AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.
Proof primitive for AI agents on MultiversX. Anchor file hashes on-chain as verifiable proofs.
mcpki-server is the backend infrastructure for https://www.mcpki.org, enabling secure public key management and autonomous certificate handling for large language models (LLMs).
MCP Security Weekly
Get CVE alerts and security updates for BurpMCP Ultra and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
The most powerful MCP server for Burp Suite Professional
137 Tools • 14 Resources • 12 Event Types • Real-time Dashboard • Full Montoya API Coverage
Quick Start • All Tools • Features • Dashboard • Setup Guides
BurpMCP-Ultra is a native Kotlin Burp Suite extension with an embedded MCP (Model Context Protocol) server. Drop a single JAR into Burp, connect Claude Code or any MCP client, and control every aspect of Burp Suite programmatically through AI agents.
| BurpMCP-Ultra | burp-ai-agent | PortSwigger Official | |
|---|---|---|---|
| MCP Tools | 137 | 53 | 12 |
| Custom Scan Checks | BCheck + Script | - | - |
| WebSocket Testing | Full lifecycle | - | - |
| Inline Fuzzer | 3 modes (FUZZ/Marker/Offset) | - | - |
| Race Condition Testing | Single-packet attack | - | - |
| Auth Level Diffing | IDOR/privesc detection | - | - |
| API Schema Import | OpenAPI/Swagger | - | - |
| Passive Intel Extraction | 30+ patterns | - | - |
| Real-time Dashboard | Web + Swing | - | - |
| Event Streaming | 12 event types | - | - |
| Response Variation Analysis | Blind injection detect | - | - |
| Request Chain Macros | Multi-step with token extraction | - | - |
| Collaborator OOB | Full create/poll/correlate | Partial | Partial |
git clone https://github.com/Cy-S3c/BurpMCP-Ultra.git
cd BurpMCP-Ultra
./gradlew shadowJar
Output: build/libs/burpmcp-ultra-2.0.1.jar (13 MB)
{
"mcpServers": {
"burp": {
"type": "sse",
"url": "http://127.0.0.1:9876/sse"
}
}
}
Add to ~/.claude.json or your project's .mcp.json.
Browse to http://127.0.0.1:9878 for the real-time web dashboard.
The simplest setup. Add to your MCP config:
{
"mcpServers": {
"burp": {
"type": "sse",
"url": "http://127.0.0.1:9876/sse"
}
}
}
Config file locations:
~/.claude.json.mcp.json in project rootCaddy prevents SSE timeout disconnections and provides reliable buffering.
Install Caddy:
sudo apt install caddy
Create /etc/caddy/Caddyfile:
:9900 {
reverse_proxy 127.0.0.1:9876 {
transport http {
read_timeout 0
write_timeout 0
response_header_timeout 0
}
flush_interval -1
header_up Connection {>Connection}
header_up Upgrade {>Upgrade}
}
}
sudo systemctl restart caddy
Then use port 9900 in your MCP config:
{
"mcpServers": {
"burp": {
"type": "sse",
"url": "http://127.0.0.1:9900/sse"
}
}
}
Pre-built Caddyfile included: configs/Caddyfile
Claude Desktop only supports stdio transport. Use supergateway as a bridge:
{
"mcpServers": {
"burp": {
"command": "npx",
"args": ["-y", "supergateway", "--sse", "http://127.0.0.1:9876/sse"]
}
}
}
chmod +x configs/setup.sh
./configs/setup.sh
`
... [View full README on GitHub](https://github.com/Cy-S3c/BurpMCP-Ultra#readme)