A workflow for using Burp Suite, a web-security testing tool, through its MCP connection. It reviews captured web traffic and can send requests for approved testing activities.

Use it to inspect proxy history, replay requests in Repeater, test approved inputs with Intruder, use Collaborator for out-of-band checks, and pass findings to the relevant vulnerability-testing workflow.

It helps sort useful signals from proxy history and investigate suspected security issues through request replay, controlled fuzzing, and blind-test checks.

hunt-burp — Skill for Claude Code by Encod3d-Sec

Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo

git clone --depth 1 https://github.com/Encod3d-Sec/TORCH

agentmods

npx agentmods add skills/encod3d-sec/torch/hunt-burp

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/encod3d-sec/torch/hunt-burp/github.svg)](https://agentmods.dev/skills/encod3d-sec/torch/hunt-burp)

Your own site

<a href="https://agentmods.dev/skills/encod3d-sec/torch/hunt-burp"><img src="https://agentmods.dev/badge/skills/encod3d-sec/torch/hunt-burp/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/encod3d-sec/torch/hunt-burp"><img src="https://agentmods.dev/badge/skills/encod3d-sec/torch/hunt-burp.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 69 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 3,336 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 3 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium Excessive Agency · line 31
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
medium Excessive Agency · line 77
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
medium Excessive Agency · line 31
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00069	$0.03336
Opus 5	$0.00034	$0.01668
Sonnet 5	$0.00014	$0.00667
Haiku 4.5	$0.00007	$0.00334

Measured 9d ago against content hash 2954c800c97a, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

hunt-burp scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

`curl -x 127.0.0.1:8080` lands in Proxy history but is NOT "using Burp" -- the operator gets no

skills/burp/hunt-burp/SKILL.md · 102 lines

How it starts

The opening of the file, as written. The whole thing — 102 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Hunt: Burp Suite via MCP

Force-multiplier skill. Burp is the transport + triage layer; the vuln-class hunt-* skills carry the methodology. Use when Burp is running with the MCP Server extension and you want the model to read captured traffic and drive Burp directly.

Pre-Attack: Wiki Query (MANDATORY)

qmd_query "burp mcp proxy history repeater collaborator" via wiki-search MCP -> read matches.

Core pages: [[burp-mcp]] (setup + tool inventory + workflow), [[burp-suite]] (GUI + BApps). Self-heal: query empty -> read wiki/tools/burp-mcp.md directly.

On the box (prereqs)

Kali runs Burp + the "MCP Server" BApp; SSE at 127.0.0.1:9876. Community works (loses Collaborator + Scanner). Full setup + BApp loadout: [[burp-mcp]].
Resolve the transport ONCE (run this first). PREFER NATIVE; the CLI bridge is the fallback:
- Native (PREFERRED): the burp MCP server is registered on the host (/root/vm-mcp-burp.sh -> SSH -> mcp-proxy.jar --sse-url :9876), so the real mcp__burp__* tools appear natively. Check first: ToolSearch("select:mcp__burp__create_repeater_tab,mcp__burp__send_http1_request"). If they load -> USE THEM (cleanest; no double-base64 quoting); export BURP_NATIVE=1 if you also shell out.
- Absent? classify with the resolver: bash scripts/burp/burp-transport.sh prints bridge (VM+Burp up, use the CLI below) or down (the VM was almost certainly DOWN at session start so the native server never attached -- it only connects at startup and does not auto-reconnect; recovery is bring the VM+Burp up then RESTART the session, or use the bridge if a restart is unacceptable).
- Bridge (FALLBACK): run the CLI on Kali over the SSH bridge:

bash /root/vm.sh 'python3 ~/burp-mcp-cli.py list'                          # tools up? empty = server/port down
bash /root/vm.sh 'python3 ~/burp-mcp-cli.py schema get_proxy_http_history' # a tool's input schema
bash /root/vm.sh 'python3 ~/burp-mcp-cli.py call get_proxy_http_history "{\"count\":50}"'

(push `scripts/burp/burp-mcp-cli.py` to `~/` on Kali once, or forward 9876 and run it locally with `BURP_MCP_URL` set; see [[burp-mcp]].) Each `call` opens a fresh SSE session, which is fine -- the old "wedges after ~1 call" was really the approval gate on `send_http1_request` (see the scope bullet).

Sync scope ONCE (makes in-scope MCP sends auto-approve): python3 scripts/burp/burp-scope-sync.py pushes targets/<eng>/scope.md into Burp's project scope. The MCP extension AUTO-APPROVES in-scope targets, so native mcp__burp__send_* to in-scope hosts then flow headless; out-of-scope sends stay gated on the GUI approval prompt a headless seat cannot answer (a send_http1_request that "hangs" IS that gate, not a wedge). This is also the scope gate for native MCP calls, which scope-guard.py (PreToolUse/Bash) never sees.

Read the full file on GitHub · 102 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

9d ago First seen · 102 lines · 69 tokens per session scan A 2954c800c97a

Subscribe to this mod's changes

hunt-burp is a skill published in the GitHub repository Encod3d-Sec/TORCH (318 stars, last pushed 7d ago), licensed MIT. It adds 69 tokens to every session and 3,336 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Browser automation Security

opencli-sitemap-author

Use when creating or maintaining OpenCLI site sitemaps: agent-facing navigation, page-state, action, workflow, API-reference, pitfall, and fallback knowledge for a website. Use after browser exploration discovers durable site context, when a sitemap is stale, or when promoting local site knowledge into the repo.

jackwener/OpenCLI · 67 tokens

debug-optimize-lcp

Guides debugging and optimizing Largest Contentful Paint (LCP) using Chrome DevTools MCP tools. Use this skill whenever the user asks about LCP performance, slow page loads, Core Web Vitals optimization, or wants to understand why their page's main content takes too long to appear. Also use when the user mentions…

ChromeDevTools/chrome-devtools-mcp · 99 tokens

interactive-login

How to complete browser/interactive logins (aws / gh / glab / gcloud). The platform backgrounds the login poller so it survives the human's browser round-trip — and when that does NOT work.

yc-software/qm · 46 tokens

pinchtab-mcp

Use this skill when a task requires browser automation through PinchTab's MCP server connected to a remote browser instance. Covers navigation, element interaction, data extraction, form filling, multi-step flows, and session management via MCP tools.

pinchtab/pinchtab · 52 tokens

azure-messaging-webpubsub-java

Build real-time web applications with Azure Web PubSub SDK for Java. Use when implementing WebSocket-based messaging, live updates, chat applications, or server-to-client push notifications.

microsoft/skills · 43 tokens

google-safe-browsing

Prevent and fix Google Safe Browsing "Dangerous site" flags. Use when launching a public web app, buying/picking a domain, building a login or signup page, or when any site shows a red "Dangerous site" / "Deceptive site" warning in Chrome, Brave, Safari, Firefox, or Edge. Triggers on "dangerous site", "deceptive…

davidondrej/skills · 105 tokens

hunt-burp