# How to Configure Burp Suite MCP Integration in the reverse-skill Repository

> Learn how to configure Burp Suite MCP integration easily. Follow simple steps to build the Java extension, load it into Burp, and register the MCP server URL with the reverse-skill orchestrator.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-16

---

**To configure Burp Suite MCP integration, build the burp-mcp-full Java extension, load the resulting JAR into Burp Suite, and register the MCP server URL (default `http://localhost:9876/mcp`) with the reverse-skill orchestrator.**

The **reverse-skill** open-source repository ships with a **Burp Suite MCP (Multi-Capability Proxy)** extension that exposes Burp's proxy history, Intruder, Repeater, Scanner, and Collaborator features as a JSON-RPC server. This guide walks through the exact source files and commands needed to activate the integration, referencing paths from `zhaoxuya520/reverse-skill` as implemented in the codebase.

---

## Build the Burp MCP Extension

The extension source lives in `burp-mcp-full/`, a dedicated subdirectory of the repository. Compile it using the provided Gradle wrapper script:

```bash
cd burp-mcp-full
chmod +x build.sh
./build.sh

```

The script produces `build/libs/burp-mcp-full.jar`, which contains the Montoya-API implementation for the MCP server. This JAR is the bridge between Burp Suite's internal APIs and reverse-skill's AI routing engine.

**Key file:** [`burp-mcp-full/build.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/burp-mcp-full/build.sh)

---

## Load the JAR into Burp Suite

1. Open **Burp Suite Professional** or **Community Edition**.
2. Navigate to **Extensions → Extensions**.
3. Click **Add**, select **Java** as the extension type, and browse to `burp-mcp-full.jar`.
4. Click **Next**, then **Close** when the extension loads successfully.

Once loaded, the extension spawns an MCP endpoint and displays a confirmation tab in Burp's UI. The server begins listening on the port configured in the next step.

**Reference:** Step-by-step instructions appear in [`skills/pentest-tools/references/burpsuite-mcp-guide.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/references/burpsuite-mcp-guide.md), lines 29-38.

---

## Register the MCP Server URL in reverse-skill

By default, reverse-skill expects the Burp MCP server at `http://localhost:9876/mcp`. The bootstrap script auto-detects and registers this endpoint when the `burpsuite-mcp` capability is enabled:

```bash

# From skills/scripts/bootstrap-reverse.sh (function ensure_burpsuite_mcp)

write_mcp_server "burpsuite" '{"url":"http://localhost:9876/mcp"}'

```

**Override the default port** by modifying the JSON argument or setting an environment variable before bootstrap:

```bash
export BURP_MCP_URL="http://localhost:9999/mcp"

```

---

## Verify the Integration

Run the repository's built-in routing regression tests to confirm Burp MCP is recognized:

**Windows:**

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/test-routing.ps1

```

**Linux/macOS:**

```bash
bash skills/scripts/test-routing.sh

```

Successful output lists `burpsuite-mcp` among detected capabilities. Additionally, `skills/scripts/verify-doc-facts.ps1` ensures the live tool count matches [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md), validating consistency between documentation and runtime state.

**Key files:** `skills/scripts/test-routing.ps1`, `skills/scripts/verify-doc-facts.ps1`, [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md)

---

## Invoke Burp MCP Commands from Skills

With the integration active, any skill in the `pentest-tools/` family can programmatically drive Burp. Example JSON-RPC calls:

**Fetch proxy history:**

```json
{
  "jsonrpc": "2.0",
  "method": "burpsuite.proxy_history",
  "params": {},
  "id": 1
}

```

**Launch Intruder attack:**

```json
{
  "jsonrpc": "2.0",
  "method": "burpsuite.intruder_attack",
  "params": {
    "request": "GET /admin HTTP/1.1\r\nHost: target.com\r\n\r\n",
    "payloads": ["admin", "login", "test"]
  },
  "id": 42
}

```

The AI routing engine forwards these requests to the local MCP server and returns Burp's response for downstream analysis.

---

## Source File Reference

| File | Purpose |
|------|---------|
| [`burp-mcp-full/build.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/burp-mcp-full/build.sh) | Compiles the MCP extension JAR |
| [`skills/pentest-tools/references/burpsuite-mcp-guide.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/references/burpsuite-mcp-guide.md) | User guide for Burp MCP configuration |
| [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) | Auto-registers MCP URL during environment setup |
| `skills/scripts/test-routing.ps1` | Validates Burp MCP detection in routing layer |
| `skills/scripts/verify-doc-facts.ps1` | Consistency check between [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) and live tools |
| [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) | Auto-generated capability list including `burpsuite-mcp` |
| [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) | Routing rules referencing Burp tool family |

---

## Summary

- **Build** the extension with [`./burp-mcp-full/build.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/./burp-mcp-full/build.sh) to produce `burp-mcp-full.jar`.
- **Load** the JAR into Burp Suite via Extensions → Add → Java.
- **Register** the MCP endpoint (default `http://localhost:9876/mcp`) using [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) or manual `write_mcp_server` call.
- **Verify** with `test-routing.ps1`/[`test-routing.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/test-routing.sh) and `verify-doc-facts.ps1`.
- **Invoke** Burp features via JSON-RPC from any pentest-tools skill.

Once configured, Burp Suite MCP integration enables fully automated, AI-driven penetration testing workflows with programmatic access to Burp's core capabilities.

---

## Frequently Asked Questions

### What is Burp Suite MCP in reverse-skill?

**Burp Suite MCP** is a Java extension that exposes Burp's internal APIs—proxy history, Intruder, Repeater, Scanner, and Collaborator—as a JSON-RPC server. It allows the reverse-skill AI routing engine to invoke Burp functions programmatically rather than through manual GUI interaction.

### Can I use Burp Suite Community Edition with MCP?

**Yes.** The `burp-mcp-full` extension loads into both Burp Suite Professional and Community Edition. However, some automated features like Scanner may have reduced functionality in Community compared to Professional, depending on Burp's licensing limits.

### How do I change the default MCP server port?

**Set a custom port** by modifying the `write_mcp_server` call in [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) or exporting `BURP_MCP_URL` before running bootstrap. The format is `http://localhost:{PORT}/mcp`. Ensure the same port is configured in the Burp extension's settings tab if non-default.

### Where is the MCP server URL stored after registration?

The URL is written to the tool index and routing configuration, visible in [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) and referenced by [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json). The `ensure_burpsuite_mcp` function in [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) handles persistence across environment restarts.