Burp AI Agent, also known as Custom AI Agent, is a free extension for Burp Suite developed by Six2dez. Built with Java 21, this tool is distributed as a JAR file and operates as an embedded Model Context Protocol (MCP) server. It connects Burp Suite operations to external AI agents, enhancing security workflows for professionals. The agent supports various AI backends, including local models like Ollama and cloud providers such as Gemini CLI, extending Burp Suite's capabilities for pentesters and bug bounty hunters.

What does Burp AI Agent connect to?

Burp AI Agent connects to diverse AI backends, supporting both local models and cloud providers. For local AI, it integrates with Ollama and LM Studio. Cloud provider connections include Gemini CLI, Claude CLI, Codex CLI, and other generic OpenAI-compatible providers. The MCP server supports Server-Sent Events (SSE) as a transport protocol. Compatible AI clients confirmed include Claude Desktop, Gemini CLI, Codex CLI, Ollama, LM Studio, NVIDIA NIM, Perplexity, and other cloud CLI providers like Copilot and OpenCode.

Core features and tools

The full build of Burp AI Agent exposes an embedded MCP server with 59 callable tools. These tools cover Burp history, Repeater, Scanner, scope, and issue workflows. The store build provides 8 extension-native AI tools. While a complete list of all 59 tool names is not explicitly documented, they are categorized by their function within Burp Suite. This allows external AI agents to access and utilize Burp Suite's capabilities, acting as a reasoning engine for security tasks.

Who is it for?

The primary audience for Burp AI Agent includes security professionals, pentesters, and bug bounty hunters who actively use Burp Suite. It is designed for those seeking to integrate AI capabilities directly into their security testing and analysis processes. This tool helps automate and assist with various aspects of vulnerability discovery and triage. Skip this if you do not use Burp Suite for security assessments.

How to get started

The authentication model is token-based. If External Access is enabled in the MCP server settings, the MCP client must send an Authorization: Bearer <token> header with every request, using Server-Sent Events (SSE) as the transport protocol.

Use cases

• AI-assisted analysis and triage of HTTP requests by initiating a chat session for AI analysis from the Proxy history.
• Passive and Active AI scanning, where the extension's scanners automatically analyze traffic across 62 vulnerability classes.
• MCP-driven pentesting, allowing external AI agents to act as scanners via MCP, using Burp Suite's tools as the reasoning engine for tasks like scanning proxy history for specific vulnerabilities.

Burp AI Agent provides a valuable bridge between Burp Suite and various AI models, enhancing security workflows. It offers tools for AI-assisted analysis, automated scanning, and external agent-driven pentesting. The token-based authentication helps secure interactions with external AI clients. This extension can significantly augment the capabilities of security professionals. Try initiating a chat session for AI analysis from the Proxy history to experience its AI-assisted triage.