Giving AI agents the keys to Burp Suite

What it does

Burp AI Agent is a Kotlin extension for Burp Suite that embeds AI analysis directly into your proxy workflow. It supports eleven backends—from local Ollama and LM Studio instances to cloud CLIs like Claude, Codex, and Copilot—and exposes Burp’s internals as over fifty MCP tools. That means external AI clients can read traffic, send requests, and create issues programmatically while built-in passive and active scanners hunt across 62 vulnerability classes in the background.

The interesting bit

The project flips the usual “chatbot in a plugin” model on its head: instead of supplying its own reasoning engine, it exposes Burp as a tool suite that your terminal AI assistant—Claude Code, Gemini CLI, whatever—drives via MCP. A bundled burp-scan skill gives that terminal AI a structured playbook with 200+ payloads and detection patterns, effectively turning your command-line copilot into an interactive pentester while the GUI extension handles the grunt-work scanning.

Key highlights

• Eleven AI backends including local HTTP servers, generic OpenAI-compatible APIs, and cloud CLIs (Gemini, Claude, Codex, Copilot, OpenCode).
• 53+ MCP tools let external agents autonomously query proxy history, fire requests, and file issues.
• Three privacy modes (STRICT, BALANCED, OFF) that redact sensitive data before it leaves Burp.
• JSONL audit logging with SHA-256 integrity hashing and per-request promptSource / contextKind stamps for compliance.
• Custom prompt library tied to HTTP requests or scanner issues, accessible from the right-click menu.

Caveats

• Requires Burp Suite 2023.12+ and Java 21; several backends demand separate CLI tools and API keys.
• Enabling MCP external access forces you to manage bearer tokens manually (Authorization: Bearer <token>).

Verdict

Penetration testers and bug bounty hunters already living in Burp Suite who want to augment manual testing with LLM analysis should install this. If you do not use Burp or you are looking for a standalone AI scanner that works without a proxy, this is not your tool.