six2dez/burp-ai-agent

What it solves

This project provides a bridge between Burp Suite and modern AI, allowing security researchers to integrate LLMs into their vulnerability scanning and manual testing workflows. It automates the discovery of vulnerabilities across 62 different classes using AI-driven passive and active scanners, reducing the manual effort required to analyze HTTP traffic and identify security flaws.

How it works

The extension integrates with Burp Suite as a Java-based plugin. It connects to various AI backends (including local models via Ollama or LM Studio and cloud providers like Anthropic and Gemini) to process security data. It utilizes the Model Context Protocol (MCP) to allow AI agents to interact with Burp Suite autonomously through a set of specialized tools. It also includes a "Burp Scan Skill" that enables terminal-based AI assistants (like Claude Code) to act as scanners by providing them with the necessary tool definitions and scanning protocols.

Who it’s for

Security researchers, penetration testers, and bug bounty hunters who use Burp Suite and Professional or Community editions.

Highlights

• Extensive Backend Support: Supports 12 different AI backends, including local and cloud-based options.
• MCP Integration: Features 59 MCP tools that allow external AI clients to drive Burp autonomously.
• AI-Powered Scanning: Includes passive and active scanners for 62 vulnerability classes.
• Privacy Controls: Offers three privacy modes (STRICT, BALANCED, OFF) to redact sensitive data before it is sent to AI backends.
• Human-in-the-Loop: Tool calls emitted by the AI are gated by approval cards, ensuring the user maintains control over actions taken within Burp.
• Custom Prompt Library: Allows users to save and launch free-form prompts tailored to specific HTTP requests or scanner issues.