burp-ai-agent
starsforks
How to install burp-ai-agent?
six2dez/burp-ai-agent
$git clone https://github.com/six2dez/burp-ai-agentThe bridge between Burp Suite and modern AI.
README.md
| 1 | # Custom AI Agent |
| 2 | |
| 3 | **The bridge between Burp Suite and modern AI.** |
| 4 | |
| 5 | > **A note on the name:** This extension is published as **Custom AI Agent** (formerly *Burp AI Agent*). It was renamed to comply with PortSwigger's BApp Store naming requirements and to avoid confusion with Burp Suite's built-in **Burp AI** provider. The GitHub repository (`github.com/six2dez/burp-ai-agent`), the documentation site (`burp-ai-agent.six2dez.com`), and the configuration directory (`~/.burp-ai-agent/`) keep the `burp-ai-agent` identifier for continuity. |
| 6 | |
| 7 | <!-- screenshot: main extension tab with chat and settings visible --> |
| 8 |  |
| 9 | |
| 10 | Custom AI Agent is an extension for Burp Suite that integrates AI into your security workflow. Use local models or cloud providers, connect external AI agents via MCP, and let passive/active scanners find vulnerabilities while you focus on manual testing. |
| 11 | |
| 12 | ## What's new in v0.9.0 |
| 13 | |
| 14 | - **Native [Anthropic](docs/anthropic-backend.md) backend** (CAP-01) — direct Anthropic Messages API via Burp's HTTP transport; all traffic appears in Proxy history. |
| 15 | - **AES-256-GCM secrets at rest** (SEC-01) — all stored API keys and tokens are encrypted with a per-install key using `javax.crypto`; no plaintext in preferences. |
| 16 | - **Real HKDF host anonymization** (PRIV-01) — STRICT mode now uses genuine HMAC-SHA256 extract/expand (not salted SHA-256) for host anonymization. |
| 17 | - **Request/response body redaction + custom patterns** (PRIV-02) — redaction pipeline covers body fields and user-configurable regex patterns validated against ReDoS. |
| 18 | - **Pre-send secret tripwire** (PRIV-03) — warns before high-entropy values leave Burp; allowlist actions are audit-logged. |
| 19 | - **[External MCP servers](docs/external-mcp-servers.md)** (CAP-02) — connect to external/custom MCP servers (SSE or stdio) so AI agents can call their tools alongside Burp's built-in tools. |
| 20 | - **Per-session token-budget guardrails** (CAP-04) — `BudgetGuard` caps passive-scanner spend with WARN/CAP/OFF states; passive scanner pauses automatically at the hard cap. |
| 21 | |
| 22 | ## Highlights |
| 23 | |
| 24 | - **11 AI Backends** — Burp AI (built-in), Ollama, LM Studio, NVIDIA NIM, Perplexity, Generic OpenAI-compatible, Gemini CLI, Claude CLI, Codex CLI, OpenCode CLI, Copilot CLI. |
| 25 | - **59 MCP Tools** — Let Claude Desktop (or any MCP client) drive Burp autonomously (8 extension-native AI tools in the BApp Store build, all 59 in the full build). |
| 26 | - **Scoped MCP Access** — Optionally confine every MCP tool to your in-scope hosts, so external AI clients can't reach out-of-scope targets through Burp. |
| 27 | - **62 Vulnerability Classes** — Passive and Active AI scanners across injection, auth, crypto, and more. The passive scanner runs as a Burp `PassiveScanCheck` (Burp Pro). |
| 28 | - **Available on the BApp Store** — Install **Custom AI Agent** directly from Burp's BApp Store, or grab the full build from Releases. |
| 29 | - **Theme-Aware UI** — An internal design system styles the settings panel and re-themes automatically with Burp's light/dark switch. |
| 30 | - **Burp Scan Skill** — Use your preferred AI coding assistant (Claude Code, Gemini CLI, Codex, etc.) as a scanner via MCP. |
| 31 | - **3 Privacy Modes** — STRICT / BALANCED / OFF. Redact sensitive data before it leaves Burp. |
| 32 | - **Custom Prompt Library** — Save free-form prompts per context (HTTP request or scanner issue); launch them from the right-click menu or type ad-hoc ones via `Custom…`. |
| 33 | - **Audit Logging** — JSONL with SHA-256 integrity hashing for compliance; every launch stamped with `promptSource` / `contextKind` for reproducibility. |
| 34 | |
| 35 | ## Quick Start |
| 36 | |
| 37 | ### 1. Install |
| 38 | |
| 39 | Install **Custom AI Agent** from Burp's **BApp Store**, download the latest JAR from [Releases](https://github.com/six2dez/burp-ai-agent/releases), or build from source (Java 21): |
| 40 | |
| 41 | ```bash |
| 42 | git clone https://github.com/six2dez/burp-ai-agent.git |
| 43 | cd burp-ai-agent |
| 44 | |
| 45 | # Full build (default, GitHub releases) — all 59 MCP tools |
| 46 | JAVA_HOME=/path/to/jdk-21 ./gradlew clean shadowJar |
| 47 | # Output: buil |
People who liked this also viewed
6 picksType
- mcp-scannerScan MCP servers for potential threats & security findings.MCP ServersJul 2026
- hol-guardOpen-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.MCP ServersJul 2026
- agent-scanSecurity scanner for AI agents, MCP servers and agent skills.MCP ServersJul 2026
- falcon-mcpConnect AI agents to CrowdStrike Falcon for automated security analysis and threat huntingMCP ServersJul 2026
- python🔐 Plug-and-play auth for Python MCP servers.MCP ServersAug 2025
- auth0-mcp-serverConnect LLMs and AI agents to Auth0 Management APIs via an MCP server. Use natural-language commands to create apps, deploy Actions, and query logs—runs locally and supports interactive tenant authentication for secure Auth0 administration from AI tools/CLIs.MCP ServersJul 2026
