Burpsuite MCP Server

🚀 Burpsuite MCP Server

A Model Context Protocol (MCP) server that provides an interface for interacting with the scanning and proxy functions of Burpsuite Professional.

🚀 Quick Start

This MCP server enables AI assistants to interact with Burpsuite Professional for web security testing and vulnerability scanning. It offers the following capabilities:

• Initiate vulnerability scans on target URLs.
• Check the status of scans and retrieve results.
• Access HTTP/HTTPS traffic captured by the Burp proxy.
• View the website structure discovered during the scanning process.

✨ Features

Tools

The server exposes the following tools:

1. start_scan: Initiate a new vulnerability scan on a target URL.
   • Parameters:
     • target: The target URL to scan (e.g., https://example.com).
     • scan_type: The type of scan to perform (passive, active, or full).
2. get_scan_status: Check the status of an ongoing scan.
   • Parameters:
     • scan_id: The ID of the scan to check.
3. get_scan_issues: Retrieve the vulnerability issues discovered in a scan.
   • Parameters:
     • scan_id: The scan ID.
     • severity: Filter issues by severity (high, medium, low, information, or all).
4. get_proxy_history: Retrieve the HTTP/HTTPS traffic captured by the Burp proxy.
   • Parameters:
     • host: Filter by host (optional).
     • method: Filter by HTTP method (optional).
     • status_code: Filter by HTTP status code (optional).
     • limit: The maximum number of items to return (default: 10).
5. get_site_map: Retrieve the website structure discovered during scanning and browsing.
   • Parameters:
     • host: Filter by host (optional).
     • with_parameters: Only show URLs with parameters (optional).
     • limit: The maximum number of items to return (default: 20).

Resources

The server provides the following resources:

1. Scan Results: burpsuite://scan/{scanId}
2. Issue Details: burpsuite://scan/{scanId}/issue/{issueId}
3. Proxy History: burpsuite://proxy/history
4. Proxy History Item: burpsuite://proxy/history/{itemId}
5. Site Map: burpsuite://sitemap

📦 Installation

1. Build the server:

cd /path/to/burpsuite-server
npm install
npm run build

2. Add the server to your MCP settings configuration file:

{
    "mcpServers": {
        "burpsuite": {
            "command": "node",
            "args": ["/path/to/burpsuite-server/build/index.js"],
            "env": {},
            "disabled": false,
            "autoApprove": []
        }
    }
}

💻 Usage Examples

Basic Usage

Here are examples of interacting with the server through your AI assistant:

# Start a scan
/start_scan --target https://example.com --scan_type full

# Check the scan status
/get_scan_status --scan_id 12345

# Get scan results
/get_scan_issues --scan_id 12345 --severity high

# Get proxy history
/get_proxy_history --limit 10

# Get the site map
/get_site_map --host example.com

Through these interactions, you can effectively conduct security tests and obtain the required information.