Post cover image

August 13, 2026

A Practical Guide to Connecting Burp Suite to Claude Code via MCP

30‑second summary:

By Abhishek meena

4 min read

30‑second summary:

Install Burp's MCP Server extension, enable it, then run one claude mcp add command.

Claude Code can read your proxy history, generate a CLAUDE.md context file automatically, and produce a prioritized testing plan.

Claude Code can read your proxy history, generate a CLAUDE.md context file automatically, and produce a prioritized testing plan.

Why this matters

  • Copy‑pasting requests into a chat loses context.
  • With MCP, Claude Code talks directly to Burp, keeping full traffic history and writing reports for you.

Quick mental model

  • Burp MCP Server — runs locally on 127.0.0.1:9876.
  • Claude Code — AI client that connects to the MCP server.
  • MCP — the protocol that lets Claude call Burp's tools.

Prerequisites

java --version   # Java on PATH
claude --version # Make Sure Claude Code is installed

Both Burp Suite (Community or Pro) and Claude Code must be running.

Step 1 — Install the MCP extension

  1. Open Burp → Extensions → BApp Store.
  2. Search MCP Server and click Install. The extension adds a new MCP tab in Burp.
None

Step 2 — Configure the MCP tab (essential toggles)

  • Enabled — turn on.
  • Enable tools that can edit your config — keep off for the first run.
  • Require approval for HTTP requests — checked.
  • Require approval for history access — checked (you can later enable Always allow for trusted sessions).
  • Auto‑approved HTTP targets — whitelist only the domains you are testing.
  • Port — leave the default 127.0.0.1:9876.
None

Step 3 — Connect Claude Code

claude mcp add burp --transport sse http://127.0.0.1:9876

# mainly it runs on port 9876
None

Verify:

# Open Claude And Type
/mcp
None

You should see burp listed as active.

Step 4 — ok let claude to do some real work

Open Claude Code in an empty folder as per your target where you were testing and give it this simple prompt to test how it is performing:

You are an expert bug bounty hunter and web application penetration tester. You specialize in fast, methodical vulnerability discovery with a strong emphasis on accuracy — you validate every finding before reporting it and never report false positives.

Target: https://ginandjuice.shop/

Objective:
Perform a thorough security assessment of the target application, using Burp Suite (via the Burp MCP integration) as your primary testing tool.

Instructions:

- Recon first — map the application: crawl all reachable pages, identify parameters, endpoints, cookies, headers, hidden/backup files, and technology stack (via Burp's site map, passive scanning, and manual browsing).
- Test systematically across common vulnerability classes, including but not limited to:
- Injection (SQLi, command injection, SSTI, XXE)
- Cross-Site Scripting (reflected, stored, DOM-based)
- Authentication & session management flaws
- Access control issues (IDOR, privilege escalation)
- Business logic flaws
- CSRF
- SSRF
- File upload vulnerabilities
- Information disclosure (error messages, debug endpoints, source maps)
- Validate before reporting — for every potential finding, confirm it with a reproducible proof-of-concept (e.g., actual Burp Repeater request/response showing impact). Discard anything you can't confirm.

Don't stop at first confirmation — once you find a vulnerability, dig deeper:

Determine the full impact (e.g., can reflected XSS be escalated to session theft? can an IDOR be chained into full account takeover?)
Check whether the same flaw pattern exists elsewhere in the app (same bug class, different endpoint/parameter).

Look for chaining opportunities between findings.

Document each finding with: vulnerability class, affected endpoint/parameter, steps to reproduce, evidence (request/response), impact, and suggested remediation.

Output format: For each confirmed vulnerability, provide a structured report entry (Title / Severity / Description / Steps to Reproduce / Evidence / Impact / Fix Recommendation). Summarize all findings in a final table at the end.

What actually happen when you let him run

Here the thing I want you to understand. Once you set this up and give Claude good starting prompt, he:

  • Do auto-recon on target
  • Jump right onto target and create good todo-list
  • Play with requests and responses
  • Test endpoints, send payloads, check responses
  • Keep going and going

You will be impressed with result already. But here the key — let him do his work. Don't micromanage. Use your skills to keep him on track, not to do his job for him. If he start going in wrong direction, just tell him what to do in simple words and he will adjust.

At end of testing, he will give you lots of vulnerabilities. I'm not joking about this — he already found 11 confirmed bugs for me. Real bugs, not hallucinations. Confirmed.

The workflow is simple:

  1. You give scope and direction
  2. Claude do recon, testing, report writing
  3. You verify findings and use your expertise to chain things together
  4. You tell him what to focus on when needed

That's it. You not doing busy work anymore. You doing the thinking, he doing the grinding.

None

I'm using opencode with burp mcp but it doesn't matter a lot. Claude Code is also perfect.

Available Burp tools (via MCP)

None

Safety reminders

  • Hallucinations: Verify every finding in Burp; Claude may suggest non‑existent bugs.
  • Prompt injection: Keep approval prompts on; untrusted responses can try to steer Claude.
  • Teamwork: Claude assists with recon and test‑case generation, but exploitation and impact analysis remain manual.

Bottom line

A single claude mcp add command gives you a persistent, context‑aware AI partner. Claude reads traffic, builds its own CLAUDE.md, creates a testing plan, and writes reports—no manual copy‑pasting or config gymnastics required.