Burp MCP Agents

Practical setup guides and helpers to connect Burp Suite MCP Server to multiple AI backends (Codex, Gemini, Ollama, LM Studio).

This repo focuses on wiring, safety-first workflows, and reusable prompts to analyze real Burp traffic.

No fuzzing. No blind scanning. Only real traffic + reasoning.

---

What this is

Burp MCP Agents is a collection of:

• Backend setup guides (Codex, Gemini, Ollama, LM Studio) • Caddy proxy configuration for MCP SSE • Prompt templates for passive analysis and reporting

---

Architecture

Burp Suite MCP Server
▲
│
MCP Bridge
│
┌──────────────────────────────────────────────┐
│              │              │                │
Codex CLI   Ollama Agent   Gemini CLI   LM Studio Agent

---

Supported Backends

Backend	Mode	Privacy	Difficulty
Codex CLI	Cloud	Medium	Easy
Ollama	Local	Full	Advanced
Gemini CLI	Cloud	Medium	Easy
LM Studio	Local	Full	Advanced

---

Quick start

All setups require:

1. Burp MCP Server plguin enabled
2. Caddy reverse proxy (see common/caddy_setup.md)
3. One backend of your choice

Install the Burp MCP Server extension

1. Download the Burp MCP Server extension (MCP server jar) from: https://portswigger.net/bappstore/9952290f04ed4f628e624d0aa9dccebc
2. In Burp Suite: Extender → Extensions → Add → select the jar or from BApp Store.
3. Start the extension and confirm it listens on 127.0.0.1:9876.

---

Codex CLI

See: codex/README.md

Example models

Model	Use
gpt-5.2-codex	General use
gpt-5.1	Faster
gpt-5-mini	Low resource

---

Ollama (fully local)

See: ollama/README.md

Example models

Model	VRAM	Notes
llama3.1:8b-instruct	8GB+	Small, fast
qwen2.5:14b-instruct	16GB	Mid size
llama3.1:70b-instruct	48GB+	Large, high VRAM

---

Gemini CLI

See: gemini-cli/README.md

Example models

Model	Notes
gemini-2.0-flash	Fast
gemini-2.0-pro	Deeper reasoning

---

LM Studio (local OpenAI-compatible)

See: lmstudio/README.md

Example models

Model	Notes
llama-3.1-8b-instruct	Small, fast
qwen2.5-14b-instruct	Mid size
llama-3.1-70b-instruct	Large, high VRAM

---

Prompts

The real power lives in prompts/:

Prompt	Purpose
passive_hunter.md	Broad passive vuln surfacing
idor_hunter.md	IDOR/BOLA discovery
auth_flow_mapper.md	Auth vs unauth access mapping
ssrf_redirect_hunter.md	SSRF/open redirect candidates
logic_flaw_hunter.md	Multi-step logic issues
session_scope_hunter.md	Token scope/audience misuse
rate_limit_abuse_hunter.md	Rate-limit and abuse gaps
report_writer.md	Evidence-based reporting

See prompts/README.md for usage guidance.

---

Optional launchers

You can use the backend launchers to auto-start Caddy and shut it down when the backend exits.

Source them directly:

source /path/to/burp-mcp-agents/codex/burpcodex.sh
source /path/to/burp-mcp-agents/gemini-cli/burpgemini.sh
source /path/to/burp-mcp-agents/ollama/burpollama.sh
source /path/to/burp-mcp-agents/lmstudio/burplmstudio.sh

Then run:

burpcodex
burpgemini
burpollama deepseek-r1:14b
burplmstudio llama-3.1-8b-instruct

To make these available in every shell, add the source lines to your ~/.zshrc.

---

What this enables

You are not running a scanner. You are reviewing real traffic with assisted reasoning.