BurpMCP-Ultra
A Burp Suite Professional extension with an embedded MCP server that exposes 150 tools for proxy analysis, active scanning, fuzzing, race-condition testing and guided exploitation to an AI agent such as Claude Code.
BurpMCP-Ultra is a native Kotlin Burp Suite extension that loads as a single JAR and exposes Burp's Montoya API as 150 structured tools over a token-secured local SSE transport, so an AI agent can drive proxy history analysis, active scans, an inline fuzzer with three modes, single-packet race-condition testing, out-of-band and Collaborator testing, custom BCheck and script-based scan checks, and guided SQL injection, SSTI and LFI probes from natural language.
It also adds JWT attacks such as alg:none and RS-to-HS key confusion, an access-control sweep for IDOR and privilege escalation across identities, full WebSocket testing, OpenAPI and Swagger schema import, passive intelligence extraction over 30-plus patterns, and a real-time web and Swing dashboard, with host, origin and token checks hardening the local connection. It connects to Claude Code or any MCP client over a bearer-token-authenticated local endpoint. Kotlin, MIT licensed, aimed at bug-bounty and penetration-testing work.