Burp AI Agent

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/six2dez/burp-ai-agent
• Blog Title: Burp AI Agent
• Suggested Section: 🤖 AI -> AI Security (or add a new page under Web Pentesting / Burp Suite for 'Burp MCP / AI agent integrations')

🎯 Content Summary

What it is
Burp AI Agent is a Burp Suite extension (packaged as a .jar; implemented in Java) designed to “bridge” Burp Suite with modern AI/LLMs. It adds:
- AI-assisted analysis directly on captured HTTP traffic.
- Passive + active AI scanners covering 62 vulnerability classes (the README lists the number and broad areas like injection/auth/crypto, but does not enumerate each class in the provided content).
- MCP (Model Context P...

🔧 Technical Details

AI-assisted Burp request triage via context menu: Capture traffic in Burp Proxy, then in Proxy > HTTP History right-click a request and run Extensions > Burp AI Agent > Analyze this request. This opens an AI chat bound to that request/response, letting the model explain functionality and highlight attack surfaces to guide manual testing.

Swap LLM backends to control privacy vs capability: Use local HTTP inference (Ollama/LM Studio) to keep data on-host, or use OpenAI-compatible HTTP / cloud CLIs (Gemini/Claude/Codex/OpenCode) for different model capabilities. Configure required authentication (e.g., gemini auth login, ANTHROPIC_API_KEY/claude login, OPENAI_API_KEY).

Autonomous/programmable Burp control via MCP: Enable the extension’s MCP server (Settings > MCP Server) so an external MCP client can call the extension’s 53+ tools to automate...

🤖 Agent Actions

Summary:

• Added a comprehensive “Burp AI Agent” section to the Burp MCP page covering AI-assisted Burp request triage, supported LLM backends (local HTTP, OpenAI-compatible, Gemini/Claude/Codex/OpenCode CLIs), agent profile management, MCP server exposure to external clients, privacy/audit controls, and build/load steps.
• Included operational cautions on data exposure and MCP access.
• Updated references with the Burp AI Agent project link.

Tests:

• Not run (not applicable for documentation changes).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/six2dez/burp-ai-agent

Content Categories: Based on the analysis, this content was categorized under "🤖 AI -> AI Security (or add a new page under Web Pentesting / Burp Suite for 'Burp MCP / AI agent integrations')".

Repository Maintenance:

• MD Files Formatting: 944 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0