# How to Configure MCP Servers for AI Client Integration: A Complete Guide to reverse-skill

> Configure MCP servers for AI client integration. Learn to connect your LLM AI client to local security tools by building a JSON bridge for stdio to HTTP API calls with this complete guide.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-16

---

**Connect your LLM-driven AI client to local security tools using the Model Context Protocol by configuring a JSON bridge that translates stdio messages into HTTP API calls.**

The **reverse-skill** repository by zhaoxuya520 implements a complete **Model Context Protocol (MCP)** ecosystem that exposes penetration testing tools as native AI functions. MCP servers act as JSON-RPC 2.0 bridges, allowing clients like Kiro, Claude Code, or Cursor to invoke Burp Suite, jshook, and Metasploit through standardized function calls. This guide walks through the exact configuration steps, file paths, and verification commands needed for production integration.

## Understanding the MCP Architecture in reverse-skill

Each MCP server in reverse-skill follows a consistent two-layer pattern:

1. **Native tool layer** — The actual security tool (Burp Suite, jshook binary, etc.) exposing HTTP endpoints
2. **Bridge layer** — A thin Node.js script ([`mcp-bridge.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/mcp-bridge.js)) that converts MCP stdio traffic into HTTP requests

This design keeps the AI client isolated from tool-specific networking. The client only spawns the bridge process; the bridge handles all HTTP communication with the underlying tool.

### Core Components

| Component | Location | Purpose |
|-----------|----------|---------|
| `burp-mcp-full/` | Repository root | Burp Suite MCP extension + bridge |
| `skills/pentest-tools/src-hunter/` | `skills/pentest-tools/src-hunter/` | Documentation for jshook MCP and related tools |
| [`skills/pentest-tools/references/burpsuite-mcp-guide.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/references/burpsuite-mcp-guide.md) | `skills/pentest-tools/references/` | Complete tool reference and health-check specifications |
| [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) | `skills/` | Runtime MCP server discovery and routing rules |

## Step 1: Start the Local MCP Server

Before AI client integration, verify your target MCP server is running and reachable.

### Burp Suite MCP

1. Compile the Java extension once: `javac -cp burp.jar BurpMcpExtension.java`
2. Load the resulting JAR in Burp Suite via **Extensions → Add**
3. Confirm the HTTP API listener starts on `127.0.0.1:9876`

### jshook MCP

1. Install the `jshookmcp` binary or pull the Docker image
2. Start the server: it binds to port **23816** by default

## Step 2: Configure the AI Client

AI clients read MCP server definitions from a JSON configuration file. The standard location is `~/.mcp-config.json`, though clients like Cursor or Claude Code may use client-specific paths.

### Minimal Configuration Example

```json
{
  "mcpServers": {
    "burpsuite": {
      "command": "node",
      "args": ["/path/to/reverse-skill/burp-mcp-full/mcp-bridge.js"]
    },
    "jshook": {
      "command": "node",
      "args": ["/path/to/reverse-skill/skills/pentest-tools/src-hunter/jshook-mcp-bridge.js"]
    }
  }
}

```

Replace `/path/to/reverse-skill` with your actual clone path. Each entry requires:

- **Unique key** (`burpsuite`, `jshook`, `metasploit`) — used by the router
- **Command** — typically `node` to execute the bridge
- **Args** — absolute path to the specific [`mcp-bridge.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/mcp-bridge.js) or equivalent script

## Step 3: Verify Bridge Connectivity

Run direct health checks against the HTTP endpoints before testing through the AI client:

```bash

# Burp MCP health check

curl http://127.0.0.1:9876/health

# jshook MCP health check  

curl http://127.0.0.1:23816/health

```

A healthy response matches this structure (documented at lines 45–46 of [`burpsuite-mcp-guide.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/burpsuite-mcp-guide.md)):

```json
{"status":"ok","version":"2.0.0","tools":["proxy_history","scan_issue","intruder_payload",...]}

```

If either check fails, verify the native tool is running and ports are not blocked by firewall rules.

## Step 4: Enable Automatic Routing

The reverse-skill router dynamically discovers available MCP servers without manual registration. As implemented in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) (lines 222–230), the router:

1. Polls well-known ports on startup: **23816** (anything-analyzer/jshook) and **9876** (Burp)
2. Adds successful health-checks to the active MCP capability list
3. Exposes tool schemas to the AI client for function calling

No additional configuration is required. The router re-evaluates server availability on each request cycle.

## Step 5: Optional Environment Configuration

Override default networking parameters when running tools on non-standard interfaces:

| Variable | Default | Used By |
|----------|---------|---------|
| `BURP_MCP_HOST` | `127.0.0.1` | Burp MCP bridge |
| `BURP_MCP_PORT` | `9876` | Burp MCP bridge |

These variables are documented in [`burpsuite-mcp-guide.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/burpsuite-mcp-guide.md) (lines 79–82). Set them before starting the AI client to propagate to spawned bridge processes.

## Testing the Integration

Send a test function call through your AI client to validate the full pipeline. Example request compatible with any MCP-aware client:

```json
{
  "tool": "proxy_history",
  "params": { "limit": 5 }
}

```

The execution flow:

1. AI client serializes the request as JSON-RPC 2.0 over stdio to the bridge
2. [`mcp-bridge.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/mcp-bridge.js) translates to: `GET http://127.0.0.1:9876/proxy_history?limit=5`
3. Burp Suite returns proxy entries as JSON
4. Bridge streams the response back to the AI client

## Security Considerations

The reverse-skill routing engine implements a **local-only trust policy** as documented in [`skills/ops/skill-supply-chain.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/skill-supply-chain.md) (line 27). Key restrictions:

- Remote MCP servers are rejected regardless of authentication
- Only servers passing localhost health-checks are enabled
- Bridge processes inherit limited environment scope

Do not expose MCP HTTP ports to external interfaces. Keep `BURP_MCP_HOST` at `127.0.0.1` unless operating within a controlled container network.

## Complete Configuration Examples

### Kiro AI Client (`~/.mcp-config.json`)

```json
{
  "mcpServers": {
    "burpsuite": {
      "command": "node",
      "args": [
        "/home/user/reverse-skill/burp-mcp-full/mcp-bridge.js"
      ]
    }
  }
}

```

### Automated Health Verification Script

```bash
#!/usr/bin/env bash

# save as: check-mcp-health.sh

check_server() {
  local name=$1
  local port=$2
  
  if curl -s "http://127.0.0.1:${port}/health" | grep -q '"status":"ok"'; then
    echo "✅ ${name} MCP is alive on port ${port}"
    return 0
  else
    echo "❌ ${name} MCP not reachable on port ${port}"
    return 1
  fi
}

check_server "Burp" 9876
check_server "jshook" 23816

```

### Raw JSON-RPC Request Format

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "proxy_history",
  "params": { "limit": 10 }
}

```

## Summary

- **MCP servers** in reverse-skill use [`mcp-bridge.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/mcp-bridge.js) scripts to translate AI client stdio into HTTP API calls
- Configure AI clients via JSON entries specifying the Node.js command and absolute bridge path
- Verify deployments with `curl` health checks against ports **9876** (Burp) and **23816** (jshook)
- The routing engine auto-discovers servers; no manual skill registration required
- Maintain security by binding to localhost and respecting the local-only trust policy

## Frequently Asked Questions

### What file do I edit to add a new MCP server to my AI client?

Add an entry to **`~/.mcp-config.json`** (or your client's specific MCP configuration file). Each server needs a unique key, the `node` command, and the absolute path to the appropriate [`mcp-bridge.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/mcp-bridge.js) file from the reverse-skill repository.

### Why does my AI client show no available tools after configuration?

The bridge process likely failed to start or cannot reach the native tool. Run `curl http://127.0.0.1:9876/health` for Burp or `curl http://127.0.0.1:23816/health` for jshook directly. If these fail, verify the native tool is running and ports are not blocked.

### Can I run MCP servers on a remote machine?

No. According to [`skills/ops/skill-supply-chain.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/skill-supply-chain.md), the reverse-skill router explicitly rejects remote MCP servers as a security measure. Bridges must bind to `127.0.0.1` and pass localhost health-checks to be enabled.

### How do I expose custom tools through the MCP interface?

Create a new bridge script following the pattern in [`burp-mcp-full/mcp-bridge.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/burp-mcp-full/mcp-bridge.js), then add its path to your AI client configuration. The bridge must accept JSON-RPC 2.0 on stdio and translate requests to your tool's HTTP API.