use-burpsuite-mcp-bridge

Use BurpSuite MCP Bridge

Use Burp as the runtime source of truth. Prefer compact indexes and one decisive flow over broad history dumps or speculative requests.

Start with the bridge

1. Call burp_bridge_status and confirm the loaded Burp version, bridge URL, buffers, pending intercepts, and last error.
2. Call burp_config_get when scope-only, body preview, static filtering, queue limits, or intercept timeout affect the task.
3. Do not clear buffers until useful existing traffic and selections have been checked.

Select the shortest workflow

Target triage

1. Call burp_target_overview(host=..., focus=...).
2. Use focus="logic" for client-controlled success, role, permission, verification, approval, payment, or status decisions.
3. Prefer marked candidates from burp_marked_flows when Burp comments or highlights exist.
4. Pull only the chosen flow with the source-specific getter.

Use this source mapping:

Source	Detail
history, live	burp_flow_get
logger	burp_logger_flow_get
selection	burp_selection_get(consume=False) while iterating

One-off request mutation

Use burp_replay_flow from a confirmed baseline. Change one variable at a time and compare the full server response. Use send_to_repeater=True only when human follow-up in Burp is useful.

Request or response intercept

Use an intercept when the browser must receive the modified message.

1. Create a narrow rule with action="intercept", exact host/path, max_matches=1, and auto_disable=True.
2. Choose intercept_mode="burp" for native Proxy Intercept editing.
3. Choose intercept_mode="mcp" when the MCP client must retrieve and decide the pending message.
4. For MCP mode, trigger the browser request, immediately call burp_intercept_poll(include_bodies=True), then call burp_intercept_decide with forward, replace, or drop.
5. For replace, change one response field, status, header, or body fragment. Observe the browser's next request before drawing a conclusion.
6. Confirm the rule auto-disabled or delete it after the experiment.