What should I check if an HTTP/2 request fails?

Examine the request for forbidden headers. The HTTP/2 tool parameter specifies that such headers should be excluded, but the model may ignore this instruction.

How can I fix CRLF line endings in HTTP/1.1 requests?

Some MCP clients cannot send `\r\n`. BurpMCP can automatically replace LF with CRLF. Enable this feature in the extension settings.

SSyncDev

Start a project

BurpMCP MCP Server

Burp Suite Extension with MCP Server to enhance manual application security testing

Local serverstdioGo

What is the BurpMCP MCP Server?

Burp Suite Extension with MCP Server to enhance manual application security testing

What it actually does

BurpMCP is a Burp Suite extension that augments application security testers, vulnerability researchers, and bug bounty hunters with modern AI. Every day, large language models gain larger context windows, faster response times, and improved knowledge and reasoning skills. BurpMCP lets you take advantage of these capabilities while testing HTTP-based applications, providing a super-intelligent sidekick to help navigate unfamiliar attack surfaces and chase down complex vulnerabilities.

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

How to install the BurpMCP MCP Server

{
  "mcpServers": {
    "burpmcp": {
      "autoApprove": [],
      "disabled": false,
      "timeout": 30,
      "url": "http://localhost:8181/mcp/sse",
      "transportType": "sse"
    }
  }
}

Configuration as documented by the project. Restart the client after saving.

Frequently asked questions

This is a known model limitation, not a bug in BurpMCP. The LLM occasionally fails to add required components to requests.

Alternatives to the BurpMCP MCP Server

NVD Database

Queries the NIST National Vulnerability Database (NVD) via its API.

DatabasesPython★ 14

Cursor Trivy

Scans projects for security vulnerabilities and automatically updates vulnerable dependencies using Trivy.

Security & IdentityPython★ 10

3ilm-mcp

Search 1,032 verified smart contract vulnerability findings from Sherlock audits by pattern.

Security & Identity

A2adependencyinspector-mcp

Remote MCP for A2A dependency inspector MCP, structured receipts, audit logs, and reviewer-ready evi

Security & IdentityRemote

A2areplayreceipt-mcp

Remote MCP for A2A failure replay MCP, structured receipts, audit logs, and reviewer-ready evidence.