six2dez/burp-ai-agent

What it solves

Custom AI Agent is a Burp Suite extension that integrates AI into security testing workflows. It allows security researchers to automate the discovery of vulnerabilities and analyze HTTP traffic using a variety of local and cloud-based AI models, reducing the manual effort required for complex security audits.

How it works

The extension acts as a bridge between Burp Suite and AI backends. It provides a chat interface for analyzing requests and a set of AI-powered passive and active scanners that can identify vulnerability classes across injection, authentication, and cryptography. It also implements the Model Context Protocol (MCP), allowing external AI clients (like Claude Desktop) to drive Burp Suite autonomously via a set of specialized tools.

Who it’s for

Security researchers, penetration testers, and bug bounty hunters who use Burp Suite and want to leverage LLMs to enhance their vulnerability research and traffic analysis.

Highlights

• Broad Backend Support: Supports 12 AI backends, including local options like Ollama and LM Studio, and cloud providers like Anthropic, Gemini, and Perplexity.
• MCP Integration: Includes 59 MCP tools that allow external AI assistants to interact with Burp Suite.
• AI-Powered Scanning: Features passive and active scanners covering 62 different vulnerability classes.
• Privacy Controls: Offers three privacy modes (STRICT, BALANCED, OFF) to redact sensitive data before it is sent to AI backends.
• Burp Scan Skill: A standalone skill that enables terminal-based AI assistants (e.g., Claude Code) to act as a Burp scanner.
• Safety Gating: Model-emitted tool calls require user approval based on security tiers to prevent unauthorized actions.